[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-tanstack-auth-server-primitives":3,"mdc-a8ok3c-key":50,"related-repo-tanstack-auth-server-primitives":8663,"related-org-tanstack-auth-server-primitives":8761},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":45,"sourceUrl":48,"mdContent":49},"auth-server-primitives","implement server-side authentication primitives","Server-side authentication primitives for TanStack Start: session cookies (HttpOnly, Secure, SameSite, __Host- prefix), session read\u002Fissue\u002Fdestroy via createServerFn and middleware, OAuth authorization-code flow with state and PKCE, password-reset enumeration defense, CSRF for non-GET RPCs, rate limiting auth endpoints, session rotation on privilege change. Pairs with router-core\u002Fauth-and-guards for the routing side.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},"tanstack","TanStack","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftanstack.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Auth","auth",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"OAuth","oauth",14787,"https:\u002F\u002Fgithub.com\u002FTanStack\u002Frouter","2026-07-30T05:26:59.504396",null,1761,[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"framework","fullstack","javascript","react","route","router","routing","rpc","search","searchparams","server-functions","ssr","state-management","typesafe","typescript","url",{"repoUrl":24,"stars":23,"forks":27,"topics":46,"description":47},[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"🤖 A client-first, server-capable, fully type-safe router and full-stack framework for the web (React and more).","https:\u002F\u002Fgithub.com\u002FTanStack\u002Frouter\u002Ftree\u002FHEAD\u002Fpackages\u002Fstart-client-core\u002Fskills\u002Fstart-core\u002Fauth-server-primitives","---\nname: auth-server-primitives\ndescription: >-\n  Server-side authentication primitives for TanStack Start: session\n  cookies (HttpOnly, Secure, SameSite, __Host- prefix), session\n  read\u002Fissue\u002Fdestroy via createServerFn and middleware, OAuth\n  authorization-code flow with state and PKCE, password-reset\n  enumeration defense, CSRF for non-GET RPCs, rate limiting auth\n  endpoints, session rotation on privilege change. Pairs with\n  router-core\u002Fauth-and-guards for the routing side.\nmetadata:\n  type: sub-skill\n  library: tanstack-start\n  library_version: '1.170.14'\nrequires:\n  - start-core\n  - start-core\u002Fserver-functions\n  - start-core\u002Fmiddleware\nsources:\n  - TanStack\u002Frouter:docs\u002Fstart\u002Fframework\u002Freact\u002Fguide\u002Fauthentication-overview.md\n  - TanStack\u002Frouter:docs\u002Fstart\u002Fframework\u002Freact\u002Fguide\u002Fauthentication-server-primitives.md\n---\n\n# Auth Server Primitives\n\nThis skill covers the **server half** of authentication: session storage, cookie issuance, OAuth flow, password-reset hardening, CSRF, rate limiting. For the **routing half** (`_authenticated` layout, `beforeLoad` redirects, RBAC checks), see [router-core\u002Fauth-and-guards](..\u002F..\u002F..\u002F..\u002Frouter-core\u002Fskills\u002Frouter-core\u002Fauth-and-guards\u002FSKILL.md).\n\n> **CRITICAL**: Protect the data\u002FAPI boundary first. Server functions, server routes, and other API endpoints that touch private data must enforce auth **inside the handler** or middleware. Route guards are route UX, not the data security boundary.\n> **CRITICAL**: Validating the _shape_ of a client-supplied identifier (`z.string().uuid().parse(...)`) is not authorization. A parsed UUID is still _some_ tenant — re-check membership against the session principal before using it.\n> **CRITICAL**: Read session\u002Fcookies inside `.handler()` or middleware `.server()`, not at module scope. Module-level reads run before requests exist (and are also undefined on Cloudflare Workers).\n\n## Production Checklist\n\n- Enforce auth in every server function, server route, or API endpoint that reads or writes private user, tenant, or account data. Use route `beforeLoad` for page UX, not as the data boundary.\n- Use `.validator()` on every server function that accepts input.\n- Store sessions in `HttpOnly`, `Secure`, `SameSite` cookies. Do not store session tokens in `localStorage` or `sessionStorage`.\n- Hash passwords with bcrypt, scrypt, or Argon2. For missing users, verify against a dummy hash and return the same login\u002Freset message.\n- Rate limit login, registration, and password-reset endpoints.\n- Use CSRF or same-origin protections for non-GET server functions and server routes.\n- Log authentication events and monitor failures.\n- Test direct unauthenticated calls to protected server functions; they should reject before returning data.\n- Follow the anonymous redirect and inspect its HTML and serialized state. Login and unauthorized pages must not name the protected user, tenant, or record.\n\n## Session Cookies\n\nThe recommended session storage is an HTTP-only cookie holding either an opaque session ID (with server-side lookup) or a signed\u002Fencrypted token. The cookie flags matter — set them all.\n\n```tsx\n\u002F\u002F src\u002Fserver\u002Fsession.ts\nimport {\n  getRequestHeader,\n  setResponseHeader,\n} from '@tanstack\u002Freact-start\u002Fserver'\n\nconst SESSION_COOKIE = '__Host-session' \u002F\u002F __Host- prefix binds to the exact origin + path '\u002F'\nconst ONE_DAY = 60 * 60 * 24\n\nexport function setSessionCookie(token: string) {\n  setResponseHeader(\n    'Set-Cookie',\n    [\n      `${SESSION_COOKIE}=${token}`,\n      `HttpOnly`, \u002F\u002F not readable from JS — defeats XSS exfiltration\n      `Secure`, \u002F\u002F HTTPS only (required for __Host- prefix)\n      `SameSite=Lax`, \u002F\u002F sent on top-level navigations, blocks most CSRF\n      `Path=\u002F`, \u002F\u002F required for __Host- prefix\n      `Max-Age=${ONE_DAY}`,\n    ].join('; '),\n  )\n}\n\nexport function clearSessionCookie() {\n  setResponseHeader(\n    'Set-Cookie',\n    `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Lax; Path=\u002F; Max-Age=0`,\n  )\n}\n\nexport function readSessionToken(): string | null {\n  const header = getRequestHeader('cookie')\n  if (!header) return null\n  for (const part of header.split(\u002F;\\s*\u002F)) {\n    \u002F\u002F Split only on the FIRST '=' — signed\u002Fbase64 values often contain '='.\n    const eq = part.indexOf('=')\n    if (eq === -1) continue\n    if (part.slice(0, eq) === SESSION_COOKIE) return part.slice(eq + 1)\n  }\n  return null\n}\n```\n\nFlag rationale:\n\n- `HttpOnly` — JavaScript can't read the cookie, so an XSS bug can't steal the session.\n- `Secure` — HTTPS only. Required when using `__Host-` prefix.\n- `SameSite=Lax` — blocks CSRF on most cross-origin POST\u002FPUT\u002FDELETE. Use `Strict` for highest-security flows where loss of cross-site GET navigation is acceptable.\n- `__Host-` prefix — binds the cookie to the exact origin (no Domain attribute, Path must be `\u002F`, Secure must be set). Prevents subdomain takeover from forging a session cookie.\n- `Path=\u002F` — required by `__Host-`.\n- `Max-Age` — finite lifetime so a stolen cookie isn't useful forever. Pair with server-side session rotation.\n\n## Session Lookup as Middleware\n\nUse middleware to centralize session loading so every protected handler sees a typed session:\n\n```tsx\n\u002F\u002F src\u002Fserver\u002Fauth-middleware.ts\nimport { createMiddleware } from '@tanstack\u002Freact-start'\nimport { readSessionToken } from '.\u002Fsession'\n\nexport const authMiddleware = createMiddleware({ type: 'function' }).server(\n  async ({ next }) => {\n    const token = readSessionToken()\n    const session = token ? await db.sessions.findValid(token) : null\n    if (!session) throw new Error('Unauthorized')\n    return next({ context: { session } })\n  },\n)\n```\n\nAttach it to every server function that needs a logged-in user:\n\n```tsx\nimport { createServerFn } from '@tanstack\u002Freact-start'\nimport { authMiddleware } from '~\u002Fserver\u002Fauth-middleware'\n\nexport const getMyOrders = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .handler(async ({ context }) => {\n    return db.orders.findMany({ where: { userId: context.session.userId } })\n  })\n```\n\n> **Route guards do not cover this.** A `createFileRoute('\u002F_authenticated\u002Forders')` with a `beforeLoad` redirect does NOT protect `getMyOrders` — the RPC is reachable directly whether or not the user ever hits the route. Apply `authMiddleware` (or re-check inside `.handler()`) on every server function that needs auth.\n\n## Issuing a Session on Login\n\n```tsx\n\u002F\u002F src\u002Fserver\u002Flogin.functions.ts\nimport { createServerFn } from '@tanstack\u002Freact-start'\nimport { z } from 'zod'\nimport { setSessionCookie } from '.\u002Fsession'\n\nexport const login = createServerFn({ method: 'POST' })\n  .validator(z.object({ email: z.string().email(), password: z.string() }))\n  .handler(async ({ data }) => {\n    const user = await db.users.findByEmail(data.email)\n    \u002F\u002F Always run verifyPasswordHash — even when the user doesn't exist —\n    \u002F\u002F so the user-not-found branch takes the same time as wrong-password.\n    \u002F\u002F DUMMY_PASSWORD_HASH is a hash of any throwaway password computed once\n    \u002F\u002F at startup with the same algorithm\u002Fcost as real password hashes.\n    const hashToCheck = user?.passwordHash ?? DUMMY_PASSWORD_HASH\n    const passwordMatches = await verifyPasswordHash(hashToCheck, data.password)\n    const ok = user != null && passwordMatches\n    if (!ok) throw new Error('Invalid email or password')\n\n    \u002F\u002F ROTATE on privilege change: destroy any existing session, then issue fresh.\n    await db.sessions.revokeAllForUser(user.id)\n    const token = await db.sessions.create({ userId: user.id })\n    setSessionCookie(token)\n    return { ok: true }\n  })\n```\n\n## Logout\n\n```tsx\nimport { createServerFn } from '@tanstack\u002Freact-start'\nimport { authMiddleware } from '~\u002Fserver\u002Fauth-middleware'\nimport { clearSessionCookie } from '~\u002Fserver\u002Fsession'\n\nexport const logout = createServerFn({ method: 'POST' })\n  .middleware([authMiddleware])\n  .handler(async ({ context }) => {\n    await db.sessions.revoke(context.session.id)\n    clearSessionCookie()\n    return { ok: true }\n  })\n```\n\n## OAuth: state + PKCE\n\nFor OAuth authorization-code flow, generate a one-time `state` (CSRF defense) and a PKCE verifier (defense against authorization-code interception). Store both in a short-lived signed cookie keyed to this exact login attempt.\n\n```tsx\n\u002F\u002F src\u002Fserver\u002Foauth.functions.ts\nimport { createServerFn } from '@tanstack\u002Freact-start'\nimport { redirect } from '@tanstack\u002Freact-router'\nimport {\n  getRequestHeader,\n  setResponseHeader,\n} from '@tanstack\u002Freact-start\u002Fserver'\nimport crypto from 'node:crypto'\n\nconst OAUTH_STATE_COOKIE = '__Host-oauth' \u002F\u002F expires fast; one-shot\n\nfunction base64url(buf: Buffer) {\n  return buf\n    .toString('base64')\n    .replace(\u002F=\u002Fg, '')\n    .replace(\u002F\\+\u002Fg, '-')\n    .replace(\u002F\\\u002F\u002Fg, '_')\n}\n\nexport const startOAuth = createServerFn({ method: 'GET' }).handler(\n  async () => {\n    const state = base64url(crypto.randomBytes(32))\n    const verifier = base64url(crypto.randomBytes(32))\n    const challenge = base64url(\n      crypto.createHash('sha256').update(verifier).digest(),\n    )\n\n    setResponseHeader(\n      'Set-Cookie',\n      `${OAUTH_STATE_COOKIE}=${signed({ state, verifier })}; HttpOnly; Secure; SameSite=Lax; Path=\u002F; Max-Age=600`,\n    )\n\n    throw redirect({\n      href:\n        `https:\u002F\u002Fprovider.example\u002Fauthorize` +\n        `?response_type=code` +\n        `&client_id=${process.env.OAUTH_CLIENT_ID}` +\n        `&redirect_uri=${encodeURIComponent(process.env.OAUTH_REDIRECT_URI!)}` +\n        `&state=${state}` +\n        `&code_challenge=${challenge}` +\n        `&code_challenge_method=S256`,\n    })\n  },\n)\n```\n\nIn the callback handler, **verify the cookie state matches the returned state** and exchange the code with the verifier. If state is missing or doesn't match, abort — the request did not originate from your `startOAuth`.\n\n## Password Reset: defeat user enumeration\n\nWhen a user requests a reset, do not let the response shape or timing reveal whether the email is registered.\n\n```tsx\nimport { createServerFn } from '@tanstack\u002Freact-start'\nimport { z } from 'zod'\n\nexport const requestPasswordReset = createServerFn({ method: 'POST' })\n  .validator(z.object({ email: z.string().email() }))\n  .handler(async ({ data }) => {\n    const user = await db.users.findByEmail(data.email)\n    if (user) {\n      const token = await db.passwordResets.issue(user.id)\n      await sendResetEmail(user.email, token)\n    }\n    \u002F\u002F Always 200, always the same body, regardless of whether the user exists.\n    \u002F\u002F The user is told to check their inbox; no confirmation either way.\n    return { ok: true }\n  })\n```\n\nDo NOT:\n\n- Return 200 if exists, 404 if not.\n- Use a different message (\"we sent you a link\" vs \"no account found\").\n- Skip the work when the user doesn't exist (timing leak — measurable from the wire).\n\n## CSRF for non-GET RPCs\n\n`SameSite=Lax` on the session cookie blocks most cross-site CSRF for POST\u002FPUT\u002FDELETE. Two cases need extra defense:\n\n1. **Top-level GET navigation that mutates** — never do this. Always use POST\u002FPUT\u002FDELETE for mutations.\n2. **POST from a page on a sibling subdomain** — `SameSite=Lax` does NOT block this; verify the `Origin` header matches your app's origin in middleware.\n\n```tsx\nimport { createMiddleware } from '@tanstack\u002Freact-start'\nimport { getRequest } from '@tanstack\u002Freact-start\u002Fserver'\n\nexport const csrfMiddleware = createMiddleware().server(async ({ next }) => {\n  const request = getRequest()\n  if (request.method !== 'GET' && request.method !== 'HEAD') {\n    const origin = request.headers.get('origin')\n    \u002F\u002F Compare the FULL origin (scheme + host + port) — host alone lets\n    \u002F\u002F http:\u002F\u002Fexample.com pass a check meant for https:\u002F\u002Fexample.com.\n    if (!origin || new URL(origin).origin !== process.env.APP_ORIGIN) {\n      throw new Error('Origin check failed')\n    }\n  }\n  return next()\n})\n```\n\nAttach this to global request middleware in `src\u002Fstart.ts` so it covers every non-GET request, including server routes and SSR.\n\n## Rate Limiting Auth Endpoints\n\nA login endpoint without rate limiting is a credential-stuffing target. Limit per-IP (and ideally per-account) with a sliding window.\n\n```tsx\nimport { createMiddleware } from '@tanstack\u002Freact-start'\nimport { getRequest } from '@tanstack\u002Freact-start\u002Fserver'\n\nfunction rateLimitMiddleware(opts: {\n  key: string\n  max: number\n  windowMs: number\n}) {\n  return createMiddleware().server(async ({ next }) => {\n    const request = getRequest()\n    const ip =\n      request.headers.get('cf-connecting-ip') ??\n      request.headers.get('x-forwarded-for')?.split(',')[0] ??\n      'unknown'\n    const bucketKey = `rl:${opts.key}:${ip}`\n    const allowed = await rateLimiter.consume(\n      bucketKey,\n      opts.max,\n      opts.windowMs,\n    )\n    if (!allowed) throw new Error('Too many requests')\n    return next()\n  })\n}\n\n\u002F\u002F On the login server function:\nexport const login = createServerFn({ method: 'POST' }).middleware([\n  rateLimitMiddleware({ key: 'login', max: 5, windowMs: 60_000 }),\n])\n\u002F\u002F ...\n```\n\n## Session Rotation on Privilege Change\n\nWhenever the user's privileges change — login, logout, role change, password change — **destroy the old session and issue a new one**. This neutralizes session-fixation attacks where an attacker plants their own session ID in the victim's browser before login.\n\n```tsx\n\u002F\u002F In the login handler (already shown above): destroy any pre-login session, then create a fresh one.\nawait db.sessions.revokeAllForUser(user.id)\nconst token = await db.sessions.create({ userId: user.id })\nsetSessionCookie(token)\n```\n\n```tsx\n\u002F\u002F On password change \u002F role grant:\nawait db.sessions.revokeAllForUser(user.id) \u002F\u002F destroy existing\nconst token = await db.sessions.create({ userId: user.id }) \u002F\u002F issue fresh\nsetSessionCookie(token)\n```\n\n## Common Mistakes\n\n### CRITICAL: Trusting the route guard for server-function auth\n\n```tsx\n\u002F\u002F WRONG — the RPC is callable directly via POST regardless of the route\nexport const Route = createFileRoute('\u002F_authenticated\u002Forders')({\n  beforeLoad: ({ context }) => {\n    if (!context.auth.isAuthenticated) throw redirect({ to: '\u002Flogin' })\n  },\n})\nconst getMyOrders = createServerFn({ method: 'GET' }).handler(async () => {\n  return db.orders.findMany() \u002F\u002F ← anyone can hit the RPC and get all orders\n})\n\n\u002F\u002F CORRECT — auth enforced on the handler itself\nconst getMyOrders = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .handler(async ({ context }) => {\n    return db.orders.findMany({ where: { userId: context.session.userId } })\n  })\n```\n\n### CRITICAL: Treating shape validation as authorization\n\nA parsed UUID is _some_ workspace, not an _authorized_ workspace.\n\n```tsx\n\u002F\u002F WRONG — UUID is well-formed but the user may not be a member\nconst getWorkspaceData = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .validator(z.object({ workspaceId: z.string().uuid() }))\n  .handler(async ({ context, data }) => {\n    return db.workspaces.findById(data.workspaceId) \u002F\u002F missing membership check!\n  })\n\n\u002F\u002F CORRECT — verify the session principal has access to that workspace\nconst getWorkspaceData = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .validator(z.object({ workspaceId: z.string().uuid() }))\n  .handler(async ({ context, data }) => {\n    const member = await db.memberships.find({\n      userId: context.session.userId,\n      workspaceId: data.workspaceId,\n    })\n    if (!member) throw new Error('Not a member of this workspace')\n    return db.workspaces.findById(data.workspaceId)\n  })\n```\n\n### HIGH: Returning different responses based on email existence\n\nAlready covered above — `requestPasswordReset` must return the same body regardless of whether the email matches a user.\n\n### HIGH: Reading cookies\u002Fenv at module scope\n\n```tsx\n\u002F\u002F WRONG — module-load time, before any request exists\nconst SESSION_SECRET = process.env.SESSION_SECRET\nexport function signSession(payload) {\n  return sign(payload, SESSION_SECRET)\n}\n\n\u002F\u002F CORRECT — read inside per-request callback\nexport function signSession(payload) {\n  return sign(payload, process.env.SESSION_SECRET)\n}\n```\n\nOn Cloudflare Workers and other edge runtimes, the module-level read evaluates to `undefined` even on the server because env is injected per-request. See [start-core\u002Fexecution-model](..\u002Fexecution-model\u002FSKILL.md).\n\n### MEDIUM: Long-lived sessions with no rotation\n\nA session token that never rotates is functionally a long-lived credential. Rotate on login, logout, password change, and role\u002Fpermission change.\n\n## Cross-References\n\n- [router-core\u002Fauth-and-guards](..\u002F..\u002F..\u002F..\u002Frouter-core\u002Fskills\u002Frouter-core\u002Fauth-and-guards\u002FSKILL.md) — the routing side: `_authenticated` layout, `beforeLoad`, `redirect`, RBAC checks.\n- [start-core\u002Fserver-functions](..\u002Fserver-functions\u002FSKILL.md) — how to expose RPCs (and how the route guard does NOT cover them).\n- [start-core\u002Fmiddleware](..\u002Fmiddleware\u002FSKILL.md) — composing `authMiddleware` and others.\n- [start-core\u002Fexecution-model](..\u002Fexecution-model\u002FSKILL.md) — why module-level env\u002Fsecret reads are wrong.\n",{"data":51,"body":63},{"name":4,"description":6,"metadata":52,"requires":56,"sources":60},{"type":53,"library":54,"library_version":55},"sub-skill","tanstack-start","1.170.14",[57,58,59],"start-core","start-core\u002Fserver-functions","start-core\u002Fmiddleware",[61,62],"TanStack\u002Frouter:docs\u002Fstart\u002Fframework\u002Freact\u002Fguide\u002Fauthentication-overview.md","TanStack\u002Frouter:docs\u002Fstart\u002Fframework\u002Freact\u002Fguide\u002Fauthentication-server-primitives.md",{"type":64,"children":65},"root",[66,74,121,193,200,303,309,314,1385,1390,1483,1489,1494,1922,1927,2239,2290,2296,3127,3133,3474,3480,3493,4679,4698,4704,4709,5214,5219,5237,5243,5253,5292,5787,5800,5806,5811,6671,6677,6689,6836,6987,6993,7000,7554,7560,7578,8301,8307,8320,8326,8552,8572,8578,8583,8589,8657],{"type":67,"tag":68,"props":69,"children":70},"element","h1",{"id":4},[71],{"type":72,"value":73},"text","Auth Server Primitives",{"type":67,"tag":75,"props":76,"children":77},"p",{},[78,80,86,88,93,95,102,104,110,112,119],{"type":72,"value":79},"This skill covers the ",{"type":67,"tag":81,"props":82,"children":83},"strong",{},[84],{"type":72,"value":85},"server half",{"type":72,"value":87}," of authentication: session storage, cookie issuance, OAuth flow, password-reset hardening, CSRF, rate limiting. For the ",{"type":67,"tag":81,"props":89,"children":90},{},[91],{"type":72,"value":92},"routing half",{"type":72,"value":94}," (",{"type":67,"tag":96,"props":97,"children":99},"code",{"className":98},[],[100],{"type":72,"value":101},"_authenticated",{"type":72,"value":103}," layout, ",{"type":67,"tag":96,"props":105,"children":107},{"className":106},[],[108],{"type":72,"value":109},"beforeLoad",{"type":72,"value":111}," redirects, RBAC checks), see ",{"type":67,"tag":113,"props":114,"children":116},"a",{"href":115},"..\u002F..\u002F..\u002F..\u002Frouter-core\u002Fskills\u002Frouter-core\u002Fauth-and-guards\u002FSKILL.md",[117],{"type":72,"value":118},"router-core\u002Fauth-and-guards",{"type":72,"value":120},".",{"type":67,"tag":122,"props":123,"children":124},"blockquote",{},[125],{"type":67,"tag":75,"props":126,"children":127},{},[128,133,135,140,142,146,148,154,156,162,164,169,171,175,177,183,185,191],{"type":67,"tag":81,"props":129,"children":130},{},[131],{"type":72,"value":132},"CRITICAL",{"type":72,"value":134},": Protect the data\u002FAPI boundary first. Server functions, server routes, and other API endpoints that touch private data must enforce auth ",{"type":67,"tag":81,"props":136,"children":137},{},[138],{"type":72,"value":139},"inside the handler",{"type":72,"value":141}," or middleware. Route guards are route UX, not the data security boundary.\n",{"type":67,"tag":81,"props":143,"children":144},{},[145],{"type":72,"value":132},{"type":72,"value":147},": Validating the ",{"type":67,"tag":149,"props":150,"children":151},"em",{},[152],{"type":72,"value":153},"shape",{"type":72,"value":155}," of a client-supplied identifier (",{"type":67,"tag":96,"props":157,"children":159},{"className":158},[],[160],{"type":72,"value":161},"z.string().uuid().parse(...)",{"type":72,"value":163},") is not authorization. A parsed UUID is still ",{"type":67,"tag":149,"props":165,"children":166},{},[167],{"type":72,"value":168},"some",{"type":72,"value":170}," tenant — re-check membership against the session principal before using it.\n",{"type":67,"tag":81,"props":172,"children":173},{},[174],{"type":72,"value":132},{"type":72,"value":176},": Read session\u002Fcookies inside ",{"type":67,"tag":96,"props":178,"children":180},{"className":179},[],[181],{"type":72,"value":182},".handler()",{"type":72,"value":184}," or middleware ",{"type":67,"tag":96,"props":186,"children":188},{"className":187},[],[189],{"type":72,"value":190},".server()",{"type":72,"value":192},", not at module scope. Module-level reads run before requests exist (and are also undefined on Cloudflare Workers).",{"type":67,"tag":194,"props":195,"children":197},"h2",{"id":196},"production-checklist",[198],{"type":72,"value":199},"Production Checklist",{"type":67,"tag":201,"props":202,"children":203},"ul",{},[204,217,230,273,278,283,288,293,298],{"type":67,"tag":205,"props":206,"children":207},"li",{},[208,210,215],{"type":72,"value":209},"Enforce auth in every server function, server route, or API endpoint that reads or writes private user, tenant, or account data. Use route ",{"type":67,"tag":96,"props":211,"children":213},{"className":212},[],[214],{"type":72,"value":109},{"type":72,"value":216}," for page UX, not as the data boundary.",{"type":67,"tag":205,"props":218,"children":219},{},[220,222,228],{"type":72,"value":221},"Use ",{"type":67,"tag":96,"props":223,"children":225},{"className":224},[],[226],{"type":72,"value":227},".validator()",{"type":72,"value":229}," on every server function that accepts input.",{"type":67,"tag":205,"props":231,"children":232},{},[233,235,241,243,249,250,256,258,264,266,272],{"type":72,"value":234},"Store sessions in ",{"type":67,"tag":96,"props":236,"children":238},{"className":237},[],[239],{"type":72,"value":240},"HttpOnly",{"type":72,"value":242},", ",{"type":67,"tag":96,"props":244,"children":246},{"className":245},[],[247],{"type":72,"value":248},"Secure",{"type":72,"value":242},{"type":67,"tag":96,"props":251,"children":253},{"className":252},[],[254],{"type":72,"value":255},"SameSite",{"type":72,"value":257}," cookies. Do not store session tokens in ",{"type":67,"tag":96,"props":259,"children":261},{"className":260},[],[262],{"type":72,"value":263},"localStorage",{"type":72,"value":265}," or ",{"type":67,"tag":96,"props":267,"children":269},{"className":268},[],[270],{"type":72,"value":271},"sessionStorage",{"type":72,"value":120},{"type":67,"tag":205,"props":274,"children":275},{},[276],{"type":72,"value":277},"Hash passwords with bcrypt, scrypt, or Argon2. For missing users, verify against a dummy hash and return the same login\u002Freset message.",{"type":67,"tag":205,"props":279,"children":280},{},[281],{"type":72,"value":282},"Rate limit login, registration, and password-reset endpoints.",{"type":67,"tag":205,"props":284,"children":285},{},[286],{"type":72,"value":287},"Use CSRF or same-origin protections for non-GET server functions and server routes.",{"type":67,"tag":205,"props":289,"children":290},{},[291],{"type":72,"value":292},"Log authentication events and monitor failures.",{"type":67,"tag":205,"props":294,"children":295},{},[296],{"type":72,"value":297},"Test direct unauthenticated calls to protected server functions; they should reject before returning data.",{"type":67,"tag":205,"props":299,"children":300},{},[301],{"type":72,"value":302},"Follow the anonymous redirect and inspect its HTML and serialized state. Login and unauthorized pages must not name the protected user, tenant, or record.",{"type":67,"tag":194,"props":304,"children":306},{"id":305},"session-cookies",[307],{"type":72,"value":308},"Session Cookies",{"type":67,"tag":75,"props":310,"children":311},{},[312],{"type":72,"value":313},"The recommended session storage is an HTTP-only cookie holding either an opaque session ID (with server-side lookup) or a signed\u002Fencrypted token. The cookie flags matter — set them all.",{"type":67,"tag":315,"props":316,"children":321},"pre",{"className":317,"code":318,"language":319,"meta":320,"style":320},"language-tsx shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F src\u002Fserver\u002Fsession.ts\nimport {\n  getRequestHeader,\n  setResponseHeader,\n} from '@tanstack\u002Freact-start\u002Fserver'\n\nconst SESSION_COOKIE = '__Host-session' \u002F\u002F __Host- prefix binds to the exact origin + path '\u002F'\nconst ONE_DAY = 60 * 60 * 24\n\nexport function setSessionCookie(token: string) {\n  setResponseHeader(\n    'Set-Cookie',\n    [\n      `${SESSION_COOKIE}=${token}`,\n      `HttpOnly`, \u002F\u002F not readable from JS — defeats XSS exfiltration\n      `Secure`, \u002F\u002F HTTPS only (required for __Host- prefix)\n      `SameSite=Lax`, \u002F\u002F sent on top-level navigations, blocks most CSRF\n      `Path=\u002F`, \u002F\u002F required for __Host- prefix\n      `Max-Age=${ONE_DAY}`,\n    ].join('; '),\n  )\n}\n\nexport function clearSessionCookie() {\n  setResponseHeader(\n    'Set-Cookie',\n    `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Lax; Path=\u002F; Max-Age=0`,\n  )\n}\n\nexport function readSessionToken(): string | null {\n  const header = getRequestHeader('cookie')\n  if (!header) return null\n  for (const part of header.split(\u002F;\\s*\u002F)) {\n    \u002F\u002F Split only on the FIRST '=' — signed\u002Fbase64 values often contain '='.\n    const eq = part.indexOf('=')\n    if (eq === -1) continue\n    if (part.slice(0, eq) === SESSION_COOKIE) return part.slice(eq + 1)\n  }\n  return null\n}\n","tsx","",[322],{"type":67,"tag":96,"props":323,"children":324},{"__ignoreMap":320},[325,337,353,368,381,411,421,460,501,509,560,574,596,605,645,673,698,724,750,780,823,832,841,849,875,887,907,937,945,953,961,1001,1047,1085,1154,1163,1214,1256,1355,1364,1377],{"type":67,"tag":326,"props":327,"children":330},"span",{"class":328,"line":329},"line",1,[331],{"type":67,"tag":326,"props":332,"children":334},{"style":333},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[335],{"type":72,"value":336},"\u002F\u002F src\u002Fserver\u002Fsession.ts\n",{"type":67,"tag":326,"props":338,"children":340},{"class":328,"line":339},2,[341,347],{"type":67,"tag":326,"props":342,"children":344},{"style":343},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[345],{"type":72,"value":346},"import",{"type":67,"tag":326,"props":348,"children":350},{"style":349},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[351],{"type":72,"value":352}," {\n",{"type":67,"tag":326,"props":354,"children":356},{"class":328,"line":355},3,[357,363],{"type":67,"tag":326,"props":358,"children":360},{"style":359},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[361],{"type":72,"value":362},"  getRequestHeader",{"type":67,"tag":326,"props":364,"children":365},{"style":349},[366],{"type":72,"value":367},",\n",{"type":67,"tag":326,"props":369,"children":371},{"class":328,"line":370},4,[372,377],{"type":67,"tag":326,"props":373,"children":374},{"style":359},[375],{"type":72,"value":376},"  setResponseHeader",{"type":67,"tag":326,"props":378,"children":379},{"style":349},[380],{"type":72,"value":367},{"type":67,"tag":326,"props":382,"children":384},{"class":328,"line":383},5,[385,390,395,400,406],{"type":67,"tag":326,"props":386,"children":387},{"style":349},[388],{"type":72,"value":389},"}",{"type":67,"tag":326,"props":391,"children":392},{"style":343},[393],{"type":72,"value":394}," from",{"type":67,"tag":326,"props":396,"children":397},{"style":349},[398],{"type":72,"value":399}," '",{"type":67,"tag":326,"props":401,"children":403},{"style":402},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[404],{"type":72,"value":405},"@tanstack\u002Freact-start\u002Fserver",{"type":67,"tag":326,"props":407,"children":408},{"style":349},[409],{"type":72,"value":410},"'\n",{"type":67,"tag":326,"props":412,"children":414},{"class":328,"line":413},6,[415],{"type":67,"tag":326,"props":416,"children":418},{"emptyLinePlaceholder":417},true,[419],{"type":72,"value":420},"\n",{"type":67,"tag":326,"props":422,"children":424},{"class":328,"line":423},7,[425,431,436,441,445,450,455],{"type":67,"tag":326,"props":426,"children":428},{"style":427},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[429],{"type":72,"value":430},"const",{"type":67,"tag":326,"props":432,"children":433},{"style":359},[434],{"type":72,"value":435}," SESSION_COOKIE ",{"type":67,"tag":326,"props":437,"children":438},{"style":349},[439],{"type":72,"value":440},"=",{"type":67,"tag":326,"props":442,"children":443},{"style":349},[444],{"type":72,"value":399},{"type":67,"tag":326,"props":446,"children":447},{"style":402},[448],{"type":72,"value":449},"__Host-session",{"type":67,"tag":326,"props":451,"children":452},{"style":349},[453],{"type":72,"value":454},"'",{"type":67,"tag":326,"props":456,"children":457},{"style":333},[458],{"type":72,"value":459}," \u002F\u002F __Host- prefix binds to the exact origin + path '\u002F'\n",{"type":67,"tag":326,"props":461,"children":463},{"class":328,"line":462},8,[464,468,473,477,483,488,492,496],{"type":67,"tag":326,"props":465,"children":466},{"style":427},[467],{"type":72,"value":430},{"type":67,"tag":326,"props":469,"children":470},{"style":359},[471],{"type":72,"value":472}," ONE_DAY ",{"type":67,"tag":326,"props":474,"children":475},{"style":349},[476],{"type":72,"value":440},{"type":67,"tag":326,"props":478,"children":480},{"style":479},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[481],{"type":72,"value":482}," 60",{"type":67,"tag":326,"props":484,"children":485},{"style":349},[486],{"type":72,"value":487}," *",{"type":67,"tag":326,"props":489,"children":490},{"style":479},[491],{"type":72,"value":482},{"type":67,"tag":326,"props":493,"children":494},{"style":349},[495],{"type":72,"value":487},{"type":67,"tag":326,"props":497,"children":498},{"style":479},[499],{"type":72,"value":500}," 24\n",{"type":67,"tag":326,"props":502,"children":504},{"class":328,"line":503},9,[505],{"type":67,"tag":326,"props":506,"children":507},{"emptyLinePlaceholder":417},[508],{"type":72,"value":420},{"type":67,"tag":326,"props":510,"children":512},{"class":328,"line":511},10,[513,518,523,529,534,540,545,551,556],{"type":67,"tag":326,"props":514,"children":515},{"style":343},[516],{"type":72,"value":517},"export",{"type":67,"tag":326,"props":519,"children":520},{"style":427},[521],{"type":72,"value":522}," function",{"type":67,"tag":326,"props":524,"children":526},{"style":525},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[527],{"type":72,"value":528}," setSessionCookie",{"type":67,"tag":326,"props":530,"children":531},{"style":349},[532],{"type":72,"value":533},"(",{"type":67,"tag":326,"props":535,"children":537},{"style":536},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic",[538],{"type":72,"value":539},"token",{"type":67,"tag":326,"props":541,"children":542},{"style":349},[543],{"type":72,"value":544},":",{"type":67,"tag":326,"props":546,"children":548},{"style":547},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[549],{"type":72,"value":550}," string",{"type":67,"tag":326,"props":552,"children":553},{"style":349},[554],{"type":72,"value":555},")",{"type":67,"tag":326,"props":557,"children":558},{"style":349},[559],{"type":72,"value":352},{"type":67,"tag":326,"props":561,"children":563},{"class":328,"line":562},11,[564,568],{"type":67,"tag":326,"props":565,"children":566},{"style":525},[567],{"type":72,"value":376},{"type":67,"tag":326,"props":569,"children":571},{"style":570},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[572],{"type":72,"value":573},"(\n",{"type":67,"tag":326,"props":575,"children":577},{"class":328,"line":576},12,[578,583,588,592],{"type":67,"tag":326,"props":579,"children":580},{"style":349},[581],{"type":72,"value":582},"    '",{"type":67,"tag":326,"props":584,"children":585},{"style":402},[586],{"type":72,"value":587},"Set-Cookie",{"type":67,"tag":326,"props":589,"children":590},{"style":349},[591],{"type":72,"value":454},{"type":67,"tag":326,"props":593,"children":594},{"style":349},[595],{"type":72,"value":367},{"type":67,"tag":326,"props":597,"children":599},{"class":328,"line":598},13,[600],{"type":67,"tag":326,"props":601,"children":602},{"style":570},[603],{"type":72,"value":604},"    [\n",{"type":67,"tag":326,"props":606,"children":608},{"class":328,"line":607},14,[609,614,619,623,627,632,636,641],{"type":67,"tag":326,"props":610,"children":611},{"style":349},[612],{"type":72,"value":613},"      `${",{"type":67,"tag":326,"props":615,"children":616},{"style":359},[617],{"type":72,"value":618},"SESSION_COOKIE",{"type":67,"tag":326,"props":620,"children":621},{"style":349},[622],{"type":72,"value":389},{"type":67,"tag":326,"props":624,"children":625},{"style":402},[626],{"type":72,"value":440},{"type":67,"tag":326,"props":628,"children":629},{"style":349},[630],{"type":72,"value":631},"${",{"type":67,"tag":326,"props":633,"children":634},{"style":359},[635],{"type":72,"value":539},{"type":67,"tag":326,"props":637,"children":638},{"style":349},[639],{"type":72,"value":640},"}`",{"type":67,"tag":326,"props":642,"children":643},{"style":349},[644],{"type":72,"value":367},{"type":67,"tag":326,"props":646,"children":648},{"class":328,"line":647},15,[649,654,658,663,668],{"type":67,"tag":326,"props":650,"children":651},{"style":349},[652],{"type":72,"value":653},"      `",{"type":67,"tag":326,"props":655,"children":656},{"style":402},[657],{"type":72,"value":240},{"type":67,"tag":326,"props":659,"children":660},{"style":349},[661],{"type":72,"value":662},"`",{"type":67,"tag":326,"props":664,"children":665},{"style":349},[666],{"type":72,"value":667},",",{"type":67,"tag":326,"props":669,"children":670},{"style":333},[671],{"type":72,"value":672}," \u002F\u002F not readable from JS — defeats XSS exfiltration\n",{"type":67,"tag":326,"props":674,"children":676},{"class":328,"line":675},16,[677,681,685,689,693],{"type":67,"tag":326,"props":678,"children":679},{"style":349},[680],{"type":72,"value":653},{"type":67,"tag":326,"props":682,"children":683},{"style":402},[684],{"type":72,"value":248},{"type":67,"tag":326,"props":686,"children":687},{"style":349},[688],{"type":72,"value":662},{"type":67,"tag":326,"props":690,"children":691},{"style":349},[692],{"type":72,"value":667},{"type":67,"tag":326,"props":694,"children":695},{"style":333},[696],{"type":72,"value":697}," \u002F\u002F HTTPS only (required for __Host- prefix)\n",{"type":67,"tag":326,"props":699,"children":701},{"class":328,"line":700},17,[702,706,711,715,719],{"type":67,"tag":326,"props":703,"children":704},{"style":349},[705],{"type":72,"value":653},{"type":67,"tag":326,"props":707,"children":708},{"style":402},[709],{"type":72,"value":710},"SameSite=Lax",{"type":67,"tag":326,"props":712,"children":713},{"style":349},[714],{"type":72,"value":662},{"type":67,"tag":326,"props":716,"children":717},{"style":349},[718],{"type":72,"value":667},{"type":67,"tag":326,"props":720,"children":721},{"style":333},[722],{"type":72,"value":723}," \u002F\u002F sent on top-level navigations, blocks most CSRF\n",{"type":67,"tag":326,"props":725,"children":727},{"class":328,"line":726},18,[728,732,737,741,745],{"type":67,"tag":326,"props":729,"children":730},{"style":349},[731],{"type":72,"value":653},{"type":67,"tag":326,"props":733,"children":734},{"style":402},[735],{"type":72,"value":736},"Path=\u002F",{"type":67,"tag":326,"props":738,"children":739},{"style":349},[740],{"type":72,"value":662},{"type":67,"tag":326,"props":742,"children":743},{"style":349},[744],{"type":72,"value":667},{"type":67,"tag":326,"props":746,"children":747},{"style":333},[748],{"type":72,"value":749}," \u002F\u002F required for __Host- prefix\n",{"type":67,"tag":326,"props":751,"children":753},{"class":328,"line":752},19,[754,758,763,767,772,776],{"type":67,"tag":326,"props":755,"children":756},{"style":349},[757],{"type":72,"value":653},{"type":67,"tag":326,"props":759,"children":760},{"style":402},[761],{"type":72,"value":762},"Max-Age=",{"type":67,"tag":326,"props":764,"children":765},{"style":349},[766],{"type":72,"value":631},{"type":67,"tag":326,"props":768,"children":769},{"style":359},[770],{"type":72,"value":771},"ONE_DAY",{"type":67,"tag":326,"props":773,"children":774},{"style":349},[775],{"type":72,"value":640},{"type":67,"tag":326,"props":777,"children":778},{"style":349},[779],{"type":72,"value":367},{"type":67,"tag":326,"props":781,"children":783},{"class":328,"line":782},20,[784,789,793,798,802,806,811,815,819],{"type":67,"tag":326,"props":785,"children":786},{"style":570},[787],{"type":72,"value":788},"    ]",{"type":67,"tag":326,"props":790,"children":791},{"style":349},[792],{"type":72,"value":120},{"type":67,"tag":326,"props":794,"children":795},{"style":525},[796],{"type":72,"value":797},"join",{"type":67,"tag":326,"props":799,"children":800},{"style":570},[801],{"type":72,"value":533},{"type":67,"tag":326,"props":803,"children":804},{"style":349},[805],{"type":72,"value":454},{"type":67,"tag":326,"props":807,"children":808},{"style":402},[809],{"type":72,"value":810},"; ",{"type":67,"tag":326,"props":812,"children":813},{"style":349},[814],{"type":72,"value":454},{"type":67,"tag":326,"props":816,"children":817},{"style":570},[818],{"type":72,"value":555},{"type":67,"tag":326,"props":820,"children":821},{"style":349},[822],{"type":72,"value":367},{"type":67,"tag":326,"props":824,"children":826},{"class":328,"line":825},21,[827],{"type":67,"tag":326,"props":828,"children":829},{"style":570},[830],{"type":72,"value":831},"  )\n",{"type":67,"tag":326,"props":833,"children":835},{"class":328,"line":834},22,[836],{"type":67,"tag":326,"props":837,"children":838},{"style":349},[839],{"type":72,"value":840},"}\n",{"type":67,"tag":326,"props":842,"children":844},{"class":328,"line":843},23,[845],{"type":67,"tag":326,"props":846,"children":847},{"emptyLinePlaceholder":417},[848],{"type":72,"value":420},{"type":67,"tag":326,"props":850,"children":852},{"class":328,"line":851},24,[853,857,861,866,871],{"type":67,"tag":326,"props":854,"children":855},{"style":343},[856],{"type":72,"value":517},{"type":67,"tag":326,"props":858,"children":859},{"style":427},[860],{"type":72,"value":522},{"type":67,"tag":326,"props":862,"children":863},{"style":525},[864],{"type":72,"value":865}," clearSessionCookie",{"type":67,"tag":326,"props":867,"children":868},{"style":349},[869],{"type":72,"value":870},"()",{"type":67,"tag":326,"props":872,"children":873},{"style":349},[874],{"type":72,"value":352},{"type":67,"tag":326,"props":876,"children":878},{"class":328,"line":877},25,[879,883],{"type":67,"tag":326,"props":880,"children":881},{"style":525},[882],{"type":72,"value":376},{"type":67,"tag":326,"props":884,"children":885},{"style":570},[886],{"type":72,"value":573},{"type":67,"tag":326,"props":888,"children":890},{"class":328,"line":889},26,[891,895,899,903],{"type":67,"tag":326,"props":892,"children":893},{"style":349},[894],{"type":72,"value":582},{"type":67,"tag":326,"props":896,"children":897},{"style":402},[898],{"type":72,"value":587},{"type":67,"tag":326,"props":900,"children":901},{"style":349},[902],{"type":72,"value":454},{"type":67,"tag":326,"props":904,"children":905},{"style":349},[906],{"type":72,"value":367},{"type":67,"tag":326,"props":908,"children":910},{"class":328,"line":909},27,[911,916,920,924,929,933],{"type":67,"tag":326,"props":912,"children":913},{"style":349},[914],{"type":72,"value":915},"    `${",{"type":67,"tag":326,"props":917,"children":918},{"style":359},[919],{"type":72,"value":618},{"type":67,"tag":326,"props":921,"children":922},{"style":349},[923],{"type":72,"value":389},{"type":67,"tag":326,"props":925,"children":926},{"style":402},[927],{"type":72,"value":928},"=; HttpOnly; Secure; SameSite=Lax; Path=\u002F; Max-Age=0",{"type":67,"tag":326,"props":930,"children":931},{"style":349},[932],{"type":72,"value":662},{"type":67,"tag":326,"props":934,"children":935},{"style":349},[936],{"type":72,"value":367},{"type":67,"tag":326,"props":938,"children":940},{"class":328,"line":939},28,[941],{"type":67,"tag":326,"props":942,"children":943},{"style":570},[944],{"type":72,"value":831},{"type":67,"tag":326,"props":946,"children":948},{"class":328,"line":947},29,[949],{"type":67,"tag":326,"props":950,"children":951},{"style":349},[952],{"type":72,"value":840},{"type":67,"tag":326,"props":954,"children":956},{"class":328,"line":955},30,[957],{"type":67,"tag":326,"props":958,"children":959},{"emptyLinePlaceholder":417},[960],{"type":72,"value":420},{"type":67,"tag":326,"props":962,"children":964},{"class":328,"line":963},31,[965,969,973,978,983,987,992,997],{"type":67,"tag":326,"props":966,"children":967},{"style":343},[968],{"type":72,"value":517},{"type":67,"tag":326,"props":970,"children":971},{"style":427},[972],{"type":72,"value":522},{"type":67,"tag":326,"props":974,"children":975},{"style":525},[976],{"type":72,"value":977}," readSessionToken",{"type":67,"tag":326,"props":979,"children":980},{"style":349},[981],{"type":72,"value":982},"():",{"type":67,"tag":326,"props":984,"children":985},{"style":547},[986],{"type":72,"value":550},{"type":67,"tag":326,"props":988,"children":989},{"style":349},[990],{"type":72,"value":991}," |",{"type":67,"tag":326,"props":993,"children":994},{"style":547},[995],{"type":72,"value":996}," null",{"type":67,"tag":326,"props":998,"children":999},{"style":349},[1000],{"type":72,"value":352},{"type":67,"tag":326,"props":1002,"children":1004},{"class":328,"line":1003},32,[1005,1010,1015,1020,1025,1029,1033,1038,1042],{"type":67,"tag":326,"props":1006,"children":1007},{"style":427},[1008],{"type":72,"value":1009},"  const",{"type":67,"tag":326,"props":1011,"children":1012},{"style":359},[1013],{"type":72,"value":1014}," header",{"type":67,"tag":326,"props":1016,"children":1017},{"style":349},[1018],{"type":72,"value":1019}," =",{"type":67,"tag":326,"props":1021,"children":1022},{"style":525},[1023],{"type":72,"value":1024}," getRequestHeader",{"type":67,"tag":326,"props":1026,"children":1027},{"style":570},[1028],{"type":72,"value":533},{"type":67,"tag":326,"props":1030,"children":1031},{"style":349},[1032],{"type":72,"value":454},{"type":67,"tag":326,"props":1034,"children":1035},{"style":402},[1036],{"type":72,"value":1037},"cookie",{"type":67,"tag":326,"props":1039,"children":1040},{"style":349},[1041],{"type":72,"value":454},{"type":67,"tag":326,"props":1043,"children":1044},{"style":570},[1045],{"type":72,"value":1046},")\n",{"type":67,"tag":326,"props":1048,"children":1050},{"class":328,"line":1049},33,[1051,1056,1060,1065,1070,1075,1080],{"type":67,"tag":326,"props":1052,"children":1053},{"style":343},[1054],{"type":72,"value":1055},"  if",{"type":67,"tag":326,"props":1057,"children":1058},{"style":570},[1059],{"type":72,"value":94},{"type":67,"tag":326,"props":1061,"children":1062},{"style":349},[1063],{"type":72,"value":1064},"!",{"type":67,"tag":326,"props":1066,"children":1067},{"style":359},[1068],{"type":72,"value":1069},"header",{"type":67,"tag":326,"props":1071,"children":1072},{"style":570},[1073],{"type":72,"value":1074},") ",{"type":67,"tag":326,"props":1076,"children":1077},{"style":343},[1078],{"type":72,"value":1079},"return",{"type":67,"tag":326,"props":1081,"children":1082},{"style":349},[1083],{"type":72,"value":1084}," null\n",{"type":67,"tag":326,"props":1086,"children":1088},{"class":328,"line":1087},34,[1089,1094,1098,1102,1107,1112,1116,1120,1125,1129,1134,1139,1144,1149],{"type":67,"tag":326,"props":1090,"children":1091},{"style":343},[1092],{"type":72,"value":1093},"  for",{"type":67,"tag":326,"props":1095,"children":1096},{"style":570},[1097],{"type":72,"value":94},{"type":67,"tag":326,"props":1099,"children":1100},{"style":427},[1101],{"type":72,"value":430},{"type":67,"tag":326,"props":1103,"children":1104},{"style":359},[1105],{"type":72,"value":1106}," part",{"type":67,"tag":326,"props":1108,"children":1109},{"style":349},[1110],{"type":72,"value":1111}," of",{"type":67,"tag":326,"props":1113,"children":1114},{"style":359},[1115],{"type":72,"value":1014},{"type":67,"tag":326,"props":1117,"children":1118},{"style":349},[1119],{"type":72,"value":120},{"type":67,"tag":326,"props":1121,"children":1122},{"style":525},[1123],{"type":72,"value":1124},"split",{"type":67,"tag":326,"props":1126,"children":1127},{"style":570},[1128],{"type":72,"value":533},{"type":67,"tag":326,"props":1130,"children":1131},{"style":349},[1132],{"type":72,"value":1133},"\u002F",{"type":67,"tag":326,"props":1135,"children":1136},{"style":402},[1137],{"type":72,"value":1138},";\\s",{"type":67,"tag":326,"props":1140,"children":1141},{"style":349},[1142],{"type":72,"value":1143},"*\u002F",{"type":67,"tag":326,"props":1145,"children":1146},{"style":570},[1147],{"type":72,"value":1148},")) ",{"type":67,"tag":326,"props":1150,"children":1151},{"style":349},[1152],{"type":72,"value":1153},"{\n",{"type":67,"tag":326,"props":1155,"children":1157},{"class":328,"line":1156},35,[1158],{"type":67,"tag":326,"props":1159,"children":1160},{"style":333},[1161],{"type":72,"value":1162},"    \u002F\u002F Split only on the FIRST '=' — signed\u002Fbase64 values often contain '='.\n",{"type":67,"tag":326,"props":1164,"children":1166},{"class":328,"line":1165},36,[1167,1172,1177,1181,1185,1189,1194,1198,1202,1206,1210],{"type":67,"tag":326,"props":1168,"children":1169},{"style":427},[1170],{"type":72,"value":1171},"    const",{"type":67,"tag":326,"props":1173,"children":1174},{"style":359},[1175],{"type":72,"value":1176}," eq",{"type":67,"tag":326,"props":1178,"children":1179},{"style":349},[1180],{"type":72,"value":1019},{"type":67,"tag":326,"props":1182,"children":1183},{"style":359},[1184],{"type":72,"value":1106},{"type":67,"tag":326,"props":1186,"children":1187},{"style":349},[1188],{"type":72,"value":120},{"type":67,"tag":326,"props":1190,"children":1191},{"style":525},[1192],{"type":72,"value":1193},"indexOf",{"type":67,"tag":326,"props":1195,"children":1196},{"style":570},[1197],{"type":72,"value":533},{"type":67,"tag":326,"props":1199,"children":1200},{"style":349},[1201],{"type":72,"value":454},{"type":67,"tag":326,"props":1203,"children":1204},{"style":402},[1205],{"type":72,"value":440},{"type":67,"tag":326,"props":1207,"children":1208},{"style":349},[1209],{"type":72,"value":454},{"type":67,"tag":326,"props":1211,"children":1212},{"style":570},[1213],{"type":72,"value":1046},{"type":67,"tag":326,"props":1215,"children":1217},{"class":328,"line":1216},37,[1218,1223,1227,1232,1237,1242,1247,1251],{"type":67,"tag":326,"props":1219,"children":1220},{"style":343},[1221],{"type":72,"value":1222},"    if",{"type":67,"tag":326,"props":1224,"children":1225},{"style":570},[1226],{"type":72,"value":94},{"type":67,"tag":326,"props":1228,"children":1229},{"style":359},[1230],{"type":72,"value":1231},"eq",{"type":67,"tag":326,"props":1233,"children":1234},{"style":349},[1235],{"type":72,"value":1236}," ===",{"type":67,"tag":326,"props":1238,"children":1239},{"style":349},[1240],{"type":72,"value":1241}," -",{"type":67,"tag":326,"props":1243,"children":1244},{"style":479},[1245],{"type":72,"value":1246},"1",{"type":67,"tag":326,"props":1248,"children":1249},{"style":570},[1250],{"type":72,"value":1074},{"type":67,"tag":326,"props":1252,"children":1253},{"style":343},[1254],{"type":72,"value":1255},"continue\n",{"type":67,"tag":326,"props":1257,"children":1259},{"class":328,"line":1258},38,[1260,1264,1268,1273,1277,1282,1286,1291,1295,1299,1303,1308,1313,1317,1321,1325,1329,1333,1337,1341,1346,1351],{"type":67,"tag":326,"props":1261,"children":1262},{"style":343},[1263],{"type":72,"value":1222},{"type":67,"tag":326,"props":1265,"children":1266},{"style":570},[1267],{"type":72,"value":94},{"type":67,"tag":326,"props":1269,"children":1270},{"style":359},[1271],{"type":72,"value":1272},"part",{"type":67,"tag":326,"props":1274,"children":1275},{"style":349},[1276],{"type":72,"value":120},{"type":67,"tag":326,"props":1278,"children":1279},{"style":525},[1280],{"type":72,"value":1281},"slice",{"type":67,"tag":326,"props":1283,"children":1284},{"style":570},[1285],{"type":72,"value":533},{"type":67,"tag":326,"props":1287,"children":1288},{"style":479},[1289],{"type":72,"value":1290},"0",{"type":67,"tag":326,"props":1292,"children":1293},{"style":349},[1294],{"type":72,"value":667},{"type":67,"tag":326,"props":1296,"children":1297},{"style":359},[1298],{"type":72,"value":1176},{"type":67,"tag":326,"props":1300,"children":1301},{"style":570},[1302],{"type":72,"value":1074},{"type":67,"tag":326,"props":1304,"children":1305},{"style":349},[1306],{"type":72,"value":1307},"===",{"type":67,"tag":326,"props":1309,"children":1310},{"style":359},[1311],{"type":72,"value":1312}," SESSION_COOKIE",{"type":67,"tag":326,"props":1314,"children":1315},{"style":570},[1316],{"type":72,"value":1074},{"type":67,"tag":326,"props":1318,"children":1319},{"style":343},[1320],{"type":72,"value":1079},{"type":67,"tag":326,"props":1322,"children":1323},{"style":359},[1324],{"type":72,"value":1106},{"type":67,"tag":326,"props":1326,"children":1327},{"style":349},[1328],{"type":72,"value":120},{"type":67,"tag":326,"props":1330,"children":1331},{"style":525},[1332],{"type":72,"value":1281},{"type":67,"tag":326,"props":1334,"children":1335},{"style":570},[1336],{"type":72,"value":533},{"type":67,"tag":326,"props":1338,"children":1339},{"style":359},[1340],{"type":72,"value":1231},{"type":67,"tag":326,"props":1342,"children":1343},{"style":349},[1344],{"type":72,"value":1345}," +",{"type":67,"tag":326,"props":1347,"children":1348},{"style":479},[1349],{"type":72,"value":1350}," 1",{"type":67,"tag":326,"props":1352,"children":1353},{"style":570},[1354],{"type":72,"value":1046},{"type":67,"tag":326,"props":1356,"children":1358},{"class":328,"line":1357},39,[1359],{"type":67,"tag":326,"props":1360,"children":1361},{"style":349},[1362],{"type":72,"value":1363},"  }\n",{"type":67,"tag":326,"props":1365,"children":1367},{"class":328,"line":1366},40,[1368,1373],{"type":67,"tag":326,"props":1369,"children":1370},{"style":343},[1371],{"type":72,"value":1372},"  return",{"type":67,"tag":326,"props":1374,"children":1375},{"style":349},[1376],{"type":72,"value":1084},{"type":67,"tag":326,"props":1378,"children":1380},{"class":328,"line":1379},41,[1381],{"type":67,"tag":326,"props":1382,"children":1383},{"style":349},[1384],{"type":72,"value":840},{"type":67,"tag":75,"props":1386,"children":1387},{},[1388],{"type":72,"value":1389},"Flag rationale:",{"type":67,"tag":201,"props":1391,"children":1392},{},[1393,1403,1421,1439,1456,1472],{"type":67,"tag":205,"props":1394,"children":1395},{},[1396,1401],{"type":67,"tag":96,"props":1397,"children":1399},{"className":1398},[],[1400],{"type":72,"value":240},{"type":72,"value":1402}," — JavaScript can't read the cookie, so an XSS bug can't steal the session.",{"type":67,"tag":205,"props":1404,"children":1405},{},[1406,1411,1413,1419],{"type":67,"tag":96,"props":1407,"children":1409},{"className":1408},[],[1410],{"type":72,"value":248},{"type":72,"value":1412}," — HTTPS only. Required when using ",{"type":67,"tag":96,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":72,"value":1418},"__Host-",{"type":72,"value":1420}," prefix.",{"type":67,"tag":205,"props":1422,"children":1423},{},[1424,1429,1431,1437],{"type":67,"tag":96,"props":1425,"children":1427},{"className":1426},[],[1428],{"type":72,"value":710},{"type":72,"value":1430}," — blocks CSRF on most cross-origin POST\u002FPUT\u002FDELETE. Use ",{"type":67,"tag":96,"props":1432,"children":1434},{"className":1433},[],[1435],{"type":72,"value":1436},"Strict",{"type":72,"value":1438}," for highest-security flows where loss of cross-site GET navigation is acceptable.",{"type":67,"tag":205,"props":1440,"children":1441},{},[1442,1447,1449,1454],{"type":67,"tag":96,"props":1443,"children":1445},{"className":1444},[],[1446],{"type":72,"value":1418},{"type":72,"value":1448}," prefix — binds the cookie to the exact origin (no Domain attribute, Path must be ",{"type":67,"tag":96,"props":1450,"children":1452},{"className":1451},[],[1453],{"type":72,"value":1133},{"type":72,"value":1455},", Secure must be set). Prevents subdomain takeover from forging a session cookie.",{"type":67,"tag":205,"props":1457,"children":1458},{},[1459,1464,1466,1471],{"type":67,"tag":96,"props":1460,"children":1462},{"className":1461},[],[1463],{"type":72,"value":736},{"type":72,"value":1465}," — required by ",{"type":67,"tag":96,"props":1467,"children":1469},{"className":1468},[],[1470],{"type":72,"value":1418},{"type":72,"value":120},{"type":67,"tag":205,"props":1473,"children":1474},{},[1475,1481],{"type":67,"tag":96,"props":1476,"children":1478},{"className":1477},[],[1479],{"type":72,"value":1480},"Max-Age",{"type":72,"value":1482}," — finite lifetime so a stolen cookie isn't useful forever. Pair with server-side session rotation.",{"type":67,"tag":194,"props":1484,"children":1486},{"id":1485},"session-lookup-as-middleware",[1487],{"type":72,"value":1488},"Session Lookup as Middleware",{"type":67,"tag":75,"props":1490,"children":1491},{},[1492],{"type":72,"value":1493},"Use middleware to centralize session loading so every protected handler sees a typed session:",{"type":67,"tag":315,"props":1495,"children":1497},{"className":317,"code":1496,"language":319,"meta":320,"style":320},"\u002F\u002F src\u002Fserver\u002Fauth-middleware.ts\nimport { createMiddleware } from '@tanstack\u002Freact-start'\nimport { readSessionToken } from '.\u002Fsession'\n\nexport const authMiddleware = createMiddleware({ type: 'function' }).server(\n  async ({ next }) => {\n    const token = readSessionToken()\n    const session = token ? await db.sessions.findValid(token) : null\n    if (!session) throw new Error('Unauthorized')\n    return next({ context: { session } })\n  },\n)\n",[1498],{"type":67,"tag":96,"props":1499,"children":1500},{"__ignoreMap":320},[1501,1509,1548,1584,1591,1668,1700,1725,1798,1858,1907,1915],{"type":67,"tag":326,"props":1502,"children":1503},{"class":328,"line":329},[1504],{"type":67,"tag":326,"props":1505,"children":1506},{"style":333},[1507],{"type":72,"value":1508},"\u002F\u002F src\u002Fserver\u002Fauth-middleware.ts\n",{"type":67,"tag":326,"props":1510,"children":1511},{"class":328,"line":339},[1512,1516,1521,1526,1531,1535,1539,1544],{"type":67,"tag":326,"props":1513,"children":1514},{"style":343},[1515],{"type":72,"value":346},{"type":67,"tag":326,"props":1517,"children":1518},{"style":349},[1519],{"type":72,"value":1520}," {",{"type":67,"tag":326,"props":1522,"children":1523},{"style":359},[1524],{"type":72,"value":1525}," createMiddleware",{"type":67,"tag":326,"props":1527,"children":1528},{"style":349},[1529],{"type":72,"value":1530}," }",{"type":67,"tag":326,"props":1532,"children":1533},{"style":343},[1534],{"type":72,"value":394},{"type":67,"tag":326,"props":1536,"children":1537},{"style":349},[1538],{"type":72,"value":399},{"type":67,"tag":326,"props":1540,"children":1541},{"style":402},[1542],{"type":72,"value":1543},"@tanstack\u002Freact-start",{"type":67,"tag":326,"props":1545,"children":1546},{"style":349},[1547],{"type":72,"value":410},{"type":67,"tag":326,"props":1549,"children":1550},{"class":328,"line":355},[1551,1555,1559,1563,1567,1571,1575,1580],{"type":67,"tag":326,"props":1552,"children":1553},{"style":343},[1554],{"type":72,"value":346},{"type":67,"tag":326,"props":1556,"children":1557},{"style":349},[1558],{"type":72,"value":1520},{"type":67,"tag":326,"props":1560,"children":1561},{"style":359},[1562],{"type":72,"value":977},{"type":67,"tag":326,"props":1564,"children":1565},{"style":349},[1566],{"type":72,"value":1530},{"type":67,"tag":326,"props":1568,"children":1569},{"style":343},[1570],{"type":72,"value":394},{"type":67,"tag":326,"props":1572,"children":1573},{"style":349},[1574],{"type":72,"value":399},{"type":67,"tag":326,"props":1576,"children":1577},{"style":402},[1578],{"type":72,"value":1579},".\u002Fsession",{"type":67,"tag":326,"props":1581,"children":1582},{"style":349},[1583],{"type":72,"value":410},{"type":67,"tag":326,"props":1585,"children":1586},{"class":328,"line":370},[1587],{"type":67,"tag":326,"props":1588,"children":1589},{"emptyLinePlaceholder":417},[1590],{"type":72,"value":420},{"type":67,"tag":326,"props":1592,"children":1593},{"class":328,"line":383},[1594,1598,1603,1608,1612,1616,1620,1625,1630,1634,1638,1643,1647,1651,1655,1659,1664],{"type":67,"tag":326,"props":1595,"children":1596},{"style":343},[1597],{"type":72,"value":517},{"type":67,"tag":326,"props":1599,"children":1600},{"style":427},[1601],{"type":72,"value":1602}," const",{"type":67,"tag":326,"props":1604,"children":1605},{"style":359},[1606],{"type":72,"value":1607}," authMiddleware ",{"type":67,"tag":326,"props":1609,"children":1610},{"style":349},[1611],{"type":72,"value":440},{"type":67,"tag":326,"props":1613,"children":1614},{"style":525},[1615],{"type":72,"value":1525},{"type":67,"tag":326,"props":1617,"children":1618},{"style":359},[1619],{"type":72,"value":533},{"type":67,"tag":326,"props":1621,"children":1622},{"style":349},[1623],{"type":72,"value":1624},"{",{"type":67,"tag":326,"props":1626,"children":1627},{"style":570},[1628],{"type":72,"value":1629}," type",{"type":67,"tag":326,"props":1631,"children":1632},{"style":349},[1633],{"type":72,"value":544},{"type":67,"tag":326,"props":1635,"children":1636},{"style":349},[1637],{"type":72,"value":399},{"type":67,"tag":326,"props":1639,"children":1640},{"style":402},[1641],{"type":72,"value":1642},"function",{"type":67,"tag":326,"props":1644,"children":1645},{"style":349},[1646],{"type":72,"value":454},{"type":67,"tag":326,"props":1648,"children":1649},{"style":349},[1650],{"type":72,"value":1530},{"type":67,"tag":326,"props":1652,"children":1653},{"style":359},[1654],{"type":72,"value":555},{"type":67,"tag":326,"props":1656,"children":1657},{"style":349},[1658],{"type":72,"value":120},{"type":67,"tag":326,"props":1660,"children":1661},{"style":525},[1662],{"type":72,"value":1663},"server",{"type":67,"tag":326,"props":1665,"children":1666},{"style":359},[1667],{"type":72,"value":573},{"type":67,"tag":326,"props":1669,"children":1670},{"class":328,"line":413},[1671,1676,1681,1686,1691,1696],{"type":67,"tag":326,"props":1672,"children":1673},{"style":427},[1674],{"type":72,"value":1675},"  async",{"type":67,"tag":326,"props":1677,"children":1678},{"style":349},[1679],{"type":72,"value":1680}," ({",{"type":67,"tag":326,"props":1682,"children":1683},{"style":536},[1684],{"type":72,"value":1685}," next",{"type":67,"tag":326,"props":1687,"children":1688},{"style":349},[1689],{"type":72,"value":1690}," })",{"type":67,"tag":326,"props":1692,"children":1693},{"style":427},[1694],{"type":72,"value":1695}," =>",{"type":67,"tag":326,"props":1697,"children":1698},{"style":349},[1699],{"type":72,"value":352},{"type":67,"tag":326,"props":1701,"children":1702},{"class":328,"line":423},[1703,1707,1712,1716,1720],{"type":67,"tag":326,"props":1704,"children":1705},{"style":427},[1706],{"type":72,"value":1171},{"type":67,"tag":326,"props":1708,"children":1709},{"style":359},[1710],{"type":72,"value":1711}," token",{"type":67,"tag":326,"props":1713,"children":1714},{"style":349},[1715],{"type":72,"value":1019},{"type":67,"tag":326,"props":1717,"children":1718},{"style":525},[1719],{"type":72,"value":977},{"type":67,"tag":326,"props":1721,"children":1722},{"style":570},[1723],{"type":72,"value":1724},"()\n",{"type":67,"tag":326,"props":1726,"children":1727},{"class":328,"line":462},[1728,1732,1737,1741,1745,1750,1755,1760,1764,1769,1773,1778,1782,1786,1790,1794],{"type":67,"tag":326,"props":1729,"children":1730},{"style":427},[1731],{"type":72,"value":1171},{"type":67,"tag":326,"props":1733,"children":1734},{"style":359},[1735],{"type":72,"value":1736}," session",{"type":67,"tag":326,"props":1738,"children":1739},{"style":349},[1740],{"type":72,"value":1019},{"type":67,"tag":326,"props":1742,"children":1743},{"style":359},[1744],{"type":72,"value":1711},{"type":67,"tag":326,"props":1746,"children":1747},{"style":349},[1748],{"type":72,"value":1749}," ?",{"type":67,"tag":326,"props":1751,"children":1752},{"style":343},[1753],{"type":72,"value":1754}," await",{"type":67,"tag":326,"props":1756,"children":1757},{"style":359},[1758],{"type":72,"value":1759}," db",{"type":67,"tag":326,"props":1761,"children":1762},{"style":349},[1763],{"type":72,"value":120},{"type":67,"tag":326,"props":1765,"children":1766},{"style":359},[1767],{"type":72,"value":1768},"sessions",{"type":67,"tag":326,"props":1770,"children":1771},{"style":349},[1772],{"type":72,"value":120},{"type":67,"tag":326,"props":1774,"children":1775},{"style":525},[1776],{"type":72,"value":1777},"findValid",{"type":67,"tag":326,"props":1779,"children":1780},{"style":570},[1781],{"type":72,"value":533},{"type":67,"tag":326,"props":1783,"children":1784},{"style":359},[1785],{"type":72,"value":539},{"type":67,"tag":326,"props":1787,"children":1788},{"style":570},[1789],{"type":72,"value":1074},{"type":67,"tag":326,"props":1791,"children":1792},{"style":349},[1793],{"type":72,"value":544},{"type":67,"tag":326,"props":1795,"children":1796},{"style":349},[1797],{"type":72,"value":1084},{"type":67,"tag":326,"props":1799,"children":1800},{"class":328,"line":503},[1801,1805,1809,1813,1818,1822,1827,1832,1837,1841,1845,1850,1854],{"type":67,"tag":326,"props":1802,"children":1803},{"style":343},[1804],{"type":72,"value":1222},{"type":67,"tag":326,"props":1806,"children":1807},{"style":570},[1808],{"type":72,"value":94},{"type":67,"tag":326,"props":1810,"children":1811},{"style":349},[1812],{"type":72,"value":1064},{"type":67,"tag":326,"props":1814,"children":1815},{"style":359},[1816],{"type":72,"value":1817},"session",{"type":67,"tag":326,"props":1819,"children":1820},{"style":570},[1821],{"type":72,"value":1074},{"type":67,"tag":326,"props":1823,"children":1824},{"style":343},[1825],{"type":72,"value":1826},"throw",{"type":67,"tag":326,"props":1828,"children":1829},{"style":349},[1830],{"type":72,"value":1831}," new",{"type":67,"tag":326,"props":1833,"children":1834},{"style":525},[1835],{"type":72,"value":1836}," Error",{"type":67,"tag":326,"props":1838,"children":1839},{"style":570},[1840],{"type":72,"value":533},{"type":67,"tag":326,"props":1842,"children":1843},{"style":349},[1844],{"type":72,"value":454},{"type":67,"tag":326,"props":1846,"children":1847},{"style":402},[1848],{"type":72,"value":1849},"Unauthorized",{"type":67,"tag":326,"props":1851,"children":1852},{"style":349},[1853],{"type":72,"value":454},{"type":67,"tag":326,"props":1855,"children":1856},{"style":570},[1857],{"type":72,"value":1046},{"type":67,"tag":326,"props":1859,"children":1860},{"class":328,"line":511},[1861,1866,1870,1874,1878,1883,1887,1891,1895,1899,1903],{"type":67,"tag":326,"props":1862,"children":1863},{"style":343},[1864],{"type":72,"value":1865},"    return",{"type":67,"tag":326,"props":1867,"children":1868},{"style":525},[1869],{"type":72,"value":1685},{"type":67,"tag":326,"props":1871,"children":1872},{"style":570},[1873],{"type":72,"value":533},{"type":67,"tag":326,"props":1875,"children":1876},{"style":349},[1877],{"type":72,"value":1624},{"type":67,"tag":326,"props":1879,"children":1880},{"style":570},[1881],{"type":72,"value":1882}," context",{"type":67,"tag":326,"props":1884,"children":1885},{"style":349},[1886],{"type":72,"value":544},{"type":67,"tag":326,"props":1888,"children":1889},{"style":349},[1890],{"type":72,"value":1520},{"type":67,"tag":326,"props":1892,"children":1893},{"style":359},[1894],{"type":72,"value":1736},{"type":67,"tag":326,"props":1896,"children":1897},{"style":349},[1898],{"type":72,"value":1530},{"type":67,"tag":326,"props":1900,"children":1901},{"style":349},[1902],{"type":72,"value":1530},{"type":67,"tag":326,"props":1904,"children":1905},{"style":570},[1906],{"type":72,"value":1046},{"type":67,"tag":326,"props":1908,"children":1909},{"class":328,"line":562},[1910],{"type":67,"tag":326,"props":1911,"children":1912},{"style":349},[1913],{"type":72,"value":1914},"  },\n",{"type":67,"tag":326,"props":1916,"children":1917},{"class":328,"line":576},[1918],{"type":67,"tag":326,"props":1919,"children":1920},{"style":359},[1921],{"type":72,"value":1046},{"type":67,"tag":75,"props":1923,"children":1924},{},[1925],{"type":72,"value":1926},"Attach it to every server function that needs a logged-in user:",{"type":67,"tag":315,"props":1928,"children":1930},{"className":317,"code":1929,"language":319,"meta":320,"style":320},"import { createServerFn } from '@tanstack\u002Freact-start'\nimport { authMiddleware } from '~\u002Fserver\u002Fauth-middleware'\n\nexport const getMyOrders = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .handler(async ({ context }) => {\n    return db.orders.findMany({ where: { userId: context.session.userId } })\n  })\n",[1931],{"type":67,"tag":96,"props":1932,"children":1933},{"__ignoreMap":320},[1934,1970,2007,2014,2076,2094,2135,2227],{"type":67,"tag":326,"props":1935,"children":1936},{"class":328,"line":329},[1937,1941,1945,1950,1954,1958,1962,1966],{"type":67,"tag":326,"props":1938,"children":1939},{"style":343},[1940],{"type":72,"value":346},{"type":67,"tag":326,"props":1942,"children":1943},{"style":349},[1944],{"type":72,"value":1520},{"type":67,"tag":326,"props":1946,"children":1947},{"style":359},[1948],{"type":72,"value":1949}," createServerFn",{"type":67,"tag":326,"props":1951,"children":1952},{"style":349},[1953],{"type":72,"value":1530},{"type":67,"tag":326,"props":1955,"children":1956},{"style":343},[1957],{"type":72,"value":394},{"type":67,"tag":326,"props":1959,"children":1960},{"style":349},[1961],{"type":72,"value":399},{"type":67,"tag":326,"props":1963,"children":1964},{"style":402},[1965],{"type":72,"value":1543},{"type":67,"tag":326,"props":1967,"children":1968},{"style":349},[1969],{"type":72,"value":410},{"type":67,"tag":326,"props":1971,"children":1972},{"class":328,"line":339},[1973,1977,1981,1986,1990,1994,1998,2003],{"type":67,"tag":326,"props":1974,"children":1975},{"style":343},[1976],{"type":72,"value":346},{"type":67,"tag":326,"props":1978,"children":1979},{"style":349},[1980],{"type":72,"value":1520},{"type":67,"tag":326,"props":1982,"children":1983},{"style":359},[1984],{"type":72,"value":1985}," authMiddleware",{"type":67,"tag":326,"props":1987,"children":1988},{"style":349},[1989],{"type":72,"value":1530},{"type":67,"tag":326,"props":1991,"children":1992},{"style":343},[1993],{"type":72,"value":394},{"type":67,"tag":326,"props":1995,"children":1996},{"style":349},[1997],{"type":72,"value":399},{"type":67,"tag":326,"props":1999,"children":2000},{"style":402},[2001],{"type":72,"value":2002},"~\u002Fserver\u002Fauth-middleware",{"type":67,"tag":326,"props":2004,"children":2005},{"style":349},[2006],{"type":72,"value":410},{"type":67,"tag":326,"props":2008,"children":2009},{"class":328,"line":355},[2010],{"type":67,"tag":326,"props":2011,"children":2012},{"emptyLinePlaceholder":417},[2013],{"type":72,"value":420},{"type":67,"tag":326,"props":2015,"children":2016},{"class":328,"line":370},[2017,2021,2025,2030,2034,2038,2042,2046,2051,2055,2059,2064,2068,2072],{"type":67,"tag":326,"props":2018,"children":2019},{"style":343},[2020],{"type":72,"value":517},{"type":67,"tag":326,"props":2022,"children":2023},{"style":427},[2024],{"type":72,"value":1602},{"type":67,"tag":326,"props":2026,"children":2027},{"style":359},[2028],{"type":72,"value":2029}," getMyOrders ",{"type":67,"tag":326,"props":2031,"children":2032},{"style":349},[2033],{"type":72,"value":440},{"type":67,"tag":326,"props":2035,"children":2036},{"style":525},[2037],{"type":72,"value":1949},{"type":67,"tag":326,"props":2039,"children":2040},{"style":359},[2041],{"type":72,"value":533},{"type":67,"tag":326,"props":2043,"children":2044},{"style":349},[2045],{"type":72,"value":1624},{"type":67,"tag":326,"props":2047,"children":2048},{"style":570},[2049],{"type":72,"value":2050}," method",{"type":67,"tag":326,"props":2052,"children":2053},{"style":349},[2054],{"type":72,"value":544},{"type":67,"tag":326,"props":2056,"children":2057},{"style":349},[2058],{"type":72,"value":399},{"type":67,"tag":326,"props":2060,"children":2061},{"style":402},[2062],{"type":72,"value":2063},"GET",{"type":67,"tag":326,"props":2065,"children":2066},{"style":349},[2067],{"type":72,"value":454},{"type":67,"tag":326,"props":2069,"children":2070},{"style":349},[2071],{"type":72,"value":1530},{"type":67,"tag":326,"props":2073,"children":2074},{"style":359},[2075],{"type":72,"value":1046},{"type":67,"tag":326,"props":2077,"children":2078},{"class":328,"line":383},[2079,2084,2089],{"type":67,"tag":326,"props":2080,"children":2081},{"style":349},[2082],{"type":72,"value":2083},"  .",{"type":67,"tag":326,"props":2085,"children":2086},{"style":525},[2087],{"type":72,"value":2088},"middleware",{"type":67,"tag":326,"props":2090,"children":2091},{"style":359},[2092],{"type":72,"value":2093},"([authMiddleware])\n",{"type":67,"tag":326,"props":2095,"children":2096},{"class":328,"line":413},[2097,2101,2106,2110,2115,2119,2123,2127,2131],{"type":67,"tag":326,"props":2098,"children":2099},{"style":349},[2100],{"type":72,"value":2083},{"type":67,"tag":326,"props":2102,"children":2103},{"style":525},[2104],{"type":72,"value":2105},"handler",{"type":67,"tag":326,"props":2107,"children":2108},{"style":359},[2109],{"type":72,"value":533},{"type":67,"tag":326,"props":2111,"children":2112},{"style":427},[2113],{"type":72,"value":2114},"async",{"type":67,"tag":326,"props":2116,"children":2117},{"style":349},[2118],{"type":72,"value":1680},{"type":67,"tag":326,"props":2120,"children":2121},{"style":536},[2122],{"type":72,"value":1882},{"type":67,"tag":326,"props":2124,"children":2125},{"style":349},[2126],{"type":72,"value":1690},{"type":67,"tag":326,"props":2128,"children":2129},{"style":427},[2130],{"type":72,"value":1695},{"type":67,"tag":326,"props":2132,"children":2133},{"style":349},[2134],{"type":72,"value":352},{"type":67,"tag":326,"props":2136,"children":2137},{"class":328,"line":423},[2138,2142,2146,2150,2155,2159,2164,2168,2172,2177,2181,2185,2190,2194,2198,2202,2206,2210,2215,2219,2223],{"type":67,"tag":326,"props":2139,"children":2140},{"style":343},[2141],{"type":72,"value":1865},{"type":67,"tag":326,"props":2143,"children":2144},{"style":359},[2145],{"type":72,"value":1759},{"type":67,"tag":326,"props":2147,"children":2148},{"style":349},[2149],{"type":72,"value":120},{"type":67,"tag":326,"props":2151,"children":2152},{"style":359},[2153],{"type":72,"value":2154},"orders",{"type":67,"tag":326,"props":2156,"children":2157},{"style":349},[2158],{"type":72,"value":120},{"type":67,"tag":326,"props":2160,"children":2161},{"style":525},[2162],{"type":72,"value":2163},"findMany",{"type":67,"tag":326,"props":2165,"children":2166},{"style":570},[2167],{"type":72,"value":533},{"type":67,"tag":326,"props":2169,"children":2170},{"style":349},[2171],{"type":72,"value":1624},{"type":67,"tag":326,"props":2173,"children":2174},{"style":570},[2175],{"type":72,"value":2176}," where",{"type":67,"tag":326,"props":2178,"children":2179},{"style":349},[2180],{"type":72,"value":544},{"type":67,"tag":326,"props":2182,"children":2183},{"style":349},[2184],{"type":72,"value":1520},{"type":67,"tag":326,"props":2186,"children":2187},{"style":570},[2188],{"type":72,"value":2189}," userId",{"type":67,"tag":326,"props":2191,"children":2192},{"style":349},[2193],{"type":72,"value":544},{"type":67,"tag":326,"props":2195,"children":2196},{"style":359},[2197],{"type":72,"value":1882},{"type":67,"tag":326,"props":2199,"children":2200},{"style":349},[2201],{"type":72,"value":120},{"type":67,"tag":326,"props":2203,"children":2204},{"style":359},[2205],{"type":72,"value":1817},{"type":67,"tag":326,"props":2207,"children":2208},{"style":349},[2209],{"type":72,"value":120},{"type":67,"tag":326,"props":2211,"children":2212},{"style":359},[2213],{"type":72,"value":2214},"userId",{"type":67,"tag":326,"props":2216,"children":2217},{"style":349},[2218],{"type":72,"value":1530},{"type":67,"tag":326,"props":2220,"children":2221},{"style":349},[2222],{"type":72,"value":1530},{"type":67,"tag":326,"props":2224,"children":2225},{"style":570},[2226],{"type":72,"value":1046},{"type":67,"tag":326,"props":2228,"children":2229},{"class":328,"line":462},[2230,2235],{"type":67,"tag":326,"props":2231,"children":2232},{"style":349},[2233],{"type":72,"value":2234},"  }",{"type":67,"tag":326,"props":2236,"children":2237},{"style":359},[2238],{"type":72,"value":1046},{"type":67,"tag":122,"props":2240,"children":2241},{},[2242],{"type":67,"tag":75,"props":2243,"children":2244},{},[2245,2250,2252,2258,2260,2265,2267,2273,2275,2281,2283,2288],{"type":67,"tag":81,"props":2246,"children":2247},{},[2248],{"type":72,"value":2249},"Route guards do not cover this.",{"type":72,"value":2251}," A ",{"type":67,"tag":96,"props":2253,"children":2255},{"className":2254},[],[2256],{"type":72,"value":2257},"createFileRoute('\u002F_authenticated\u002Forders')",{"type":72,"value":2259}," with a ",{"type":67,"tag":96,"props":2261,"children":2263},{"className":2262},[],[2264],{"type":72,"value":109},{"type":72,"value":2266}," redirect does NOT protect ",{"type":67,"tag":96,"props":2268,"children":2270},{"className":2269},[],[2271],{"type":72,"value":2272},"getMyOrders",{"type":72,"value":2274}," — the RPC is reachable directly whether or not the user ever hits the route. Apply ",{"type":67,"tag":96,"props":2276,"children":2278},{"className":2277},[],[2279],{"type":72,"value":2280},"authMiddleware",{"type":72,"value":2282}," (or re-check inside ",{"type":67,"tag":96,"props":2284,"children":2286},{"className":2285},[],[2287],{"type":72,"value":182},{"type":72,"value":2289},") on every server function that needs auth.",{"type":67,"tag":194,"props":2291,"children":2293},{"id":2292},"issuing-a-session-on-login",[2294],{"type":72,"value":2295},"Issuing a Session on Login",{"type":67,"tag":315,"props":2297,"children":2299},{"className":317,"code":2298,"language":319,"meta":320,"style":320},"\u002F\u002F src\u002Fserver\u002Flogin.functions.ts\nimport { createServerFn } from '@tanstack\u002Freact-start'\nimport { z } from 'zod'\nimport { setSessionCookie } from '.\u002Fsession'\n\nexport const login = createServerFn({ method: 'POST' })\n  .validator(z.object({ email: z.string().email(), password: z.string() }))\n  .handler(async ({ data }) => {\n    const user = await db.users.findByEmail(data.email)\n    \u002F\u002F Always run verifyPasswordHash — even when the user doesn't exist —\n    \u002F\u002F so the user-not-found branch takes the same time as wrong-password.\n    \u002F\u002F DUMMY_PASSWORD_HASH is a hash of any throwaway password computed once\n    \u002F\u002F at startup with the same algorithm\u002Fcost as real password hashes.\n    const hashToCheck = user?.passwordHash ?? DUMMY_PASSWORD_HASH\n    const passwordMatches = await verifyPasswordHash(hashToCheck, data.password)\n    const ok = user != null && passwordMatches\n    if (!ok) throw new Error('Invalid email or password')\n\n    \u002F\u002F ROTATE on privilege change: destroy any existing session, then issue fresh.\n    await db.sessions.revokeAllForUser(user.id)\n    const token = await db.sessions.create({ userId: user.id })\n    setSessionCookie(token)\n    return { ok: true }\n  })\n",[2300],{"type":67,"tag":96,"props":2301,"children":2302},{"__ignoreMap":320},[2303,2311,2346,2383,2418,2425,2486,2598,2638,2701,2709,2717,2725,2733,2773,2828,2867,2924,2931,2939,2990,3066,3086,3116],{"type":67,"tag":326,"props":2304,"children":2305},{"class":328,"line":329},[2306],{"type":67,"tag":326,"props":2307,"children":2308},{"style":333},[2309],{"type":72,"value":2310},"\u002F\u002F src\u002Fserver\u002Flogin.functions.ts\n",{"type":67,"tag":326,"props":2312,"children":2313},{"class":328,"line":339},[2314,2318,2322,2326,2330,2334,2338,2342],{"type":67,"tag":326,"props":2315,"children":2316},{"style":343},[2317],{"type":72,"value":346},{"type":67,"tag":326,"props":2319,"children":2320},{"style":349},[2321],{"type":72,"value":1520},{"type":67,"tag":326,"props":2323,"children":2324},{"style":359},[2325],{"type":72,"value":1949},{"type":67,"tag":326,"props":2327,"children":2328},{"style":349},[2329],{"type":72,"value":1530},{"type":67,"tag":326,"props":2331,"children":2332},{"style":343},[2333],{"type":72,"value":394},{"type":67,"tag":326,"props":2335,"children":2336},{"style":349},[2337],{"type":72,"value":399},{"type":67,"tag":326,"props":2339,"children":2340},{"style":402},[2341],{"type":72,"value":1543},{"type":67,"tag":326,"props":2343,"children":2344},{"style":349},[2345],{"type":72,"value":410},{"type":67,"tag":326,"props":2347,"children":2348},{"class":328,"line":355},[2349,2353,2357,2362,2366,2370,2374,2379],{"type":67,"tag":326,"props":2350,"children":2351},{"style":343},[2352],{"type":72,"value":346},{"type":67,"tag":326,"props":2354,"children":2355},{"style":349},[2356],{"type":72,"value":1520},{"type":67,"tag":326,"props":2358,"children":2359},{"style":359},[2360],{"type":72,"value":2361}," z",{"type":67,"tag":326,"props":2363,"children":2364},{"style":349},[2365],{"type":72,"value":1530},{"type":67,"tag":326,"props":2367,"children":2368},{"style":343},[2369],{"type":72,"value":394},{"type":67,"tag":326,"props":2371,"children":2372},{"style":349},[2373],{"type":72,"value":399},{"type":67,"tag":326,"props":2375,"children":2376},{"style":402},[2377],{"type":72,"value":2378},"zod",{"type":67,"tag":326,"props":2380,"children":2381},{"style":349},[2382],{"type":72,"value":410},{"type":67,"tag":326,"props":2384,"children":2385},{"class":328,"line":370},[2386,2390,2394,2398,2402,2406,2410,2414],{"type":67,"tag":326,"props":2387,"children":2388},{"style":343},[2389],{"type":72,"value":346},{"type":67,"tag":326,"props":2391,"children":2392},{"style":349},[2393],{"type":72,"value":1520},{"type":67,"tag":326,"props":2395,"children":2396},{"style":359},[2397],{"type":72,"value":528},{"type":67,"tag":326,"props":2399,"children":2400},{"style":349},[2401],{"type":72,"value":1530},{"type":67,"tag":326,"props":2403,"children":2404},{"style":343},[2405],{"type":72,"value":394},{"type":67,"tag":326,"props":2407,"children":2408},{"style":349},[2409],{"type":72,"value":399},{"type":67,"tag":326,"props":2411,"children":2412},{"style":402},[2413],{"type":72,"value":1579},{"type":67,"tag":326,"props":2415,"children":2416},{"style":349},[2417],{"type":72,"value":410},{"type":67,"tag":326,"props":2419,"children":2420},{"class":328,"line":383},[2421],{"type":67,"tag":326,"props":2422,"children":2423},{"emptyLinePlaceholder":417},[2424],{"type":72,"value":420},{"type":67,"tag":326,"props":2426,"children":2427},{"class":328,"line":413},[2428,2432,2436,2441,2445,2449,2453,2457,2461,2465,2469,2474,2478,2482],{"type":67,"tag":326,"props":2429,"children":2430},{"style":343},[2431],{"type":72,"value":517},{"type":67,"tag":326,"props":2433,"children":2434},{"style":427},[2435],{"type":72,"value":1602},{"type":67,"tag":326,"props":2437,"children":2438},{"style":359},[2439],{"type":72,"value":2440}," login ",{"type":67,"tag":326,"props":2442,"children":2443},{"style":349},[2444],{"type":72,"value":440},{"type":67,"tag":326,"props":2446,"children":2447},{"style":525},[2448],{"type":72,"value":1949},{"type":67,"tag":326,"props":2450,"children":2451},{"style":359},[2452],{"type":72,"value":533},{"type":67,"tag":326,"props":2454,"children":2455},{"style":349},[2456],{"type":72,"value":1624},{"type":67,"tag":326,"props":2458,"children":2459},{"style":570},[2460],{"type":72,"value":2050},{"type":67,"tag":326,"props":2462,"children":2463},{"style":349},[2464],{"type":72,"value":544},{"type":67,"tag":326,"props":2466,"children":2467},{"style":349},[2468],{"type":72,"value":399},{"type":67,"tag":326,"props":2470,"children":2471},{"style":402},[2472],{"type":72,"value":2473},"POST",{"type":67,"tag":326,"props":2475,"children":2476},{"style":349},[2477],{"type":72,"value":454},{"type":67,"tag":326,"props":2479,"children":2480},{"style":349},[2481],{"type":72,"value":1530},{"type":67,"tag":326,"props":2483,"children":2484},{"style":359},[2485],{"type":72,"value":1046},{"type":67,"tag":326,"props":2487,"children":2488},{"class":328,"line":423},[2489,2493,2498,2503,2507,2512,2516,2520,2525,2529,2533,2537,2542,2546,2550,2555,2559,2563,2568,2572,2576,2580,2584,2589,2593],{"type":67,"tag":326,"props":2490,"children":2491},{"style":349},[2492],{"type":72,"value":2083},{"type":67,"tag":326,"props":2494,"children":2495},{"style":525},[2496],{"type":72,"value":2497},"validator",{"type":67,"tag":326,"props":2499,"children":2500},{"style":359},[2501],{"type":72,"value":2502},"(z",{"type":67,"tag":326,"props":2504,"children":2505},{"style":349},[2506],{"type":72,"value":120},{"type":67,"tag":326,"props":2508,"children":2509},{"style":525},[2510],{"type":72,"value":2511},"object",{"type":67,"tag":326,"props":2513,"children":2514},{"style":359},[2515],{"type":72,"value":533},{"type":67,"tag":326,"props":2517,"children":2518},{"style":349},[2519],{"type":72,"value":1624},{"type":67,"tag":326,"props":2521,"children":2522},{"style":570},[2523],{"type":72,"value":2524}," email",{"type":67,"tag":326,"props":2526,"children":2527},{"style":349},[2528],{"type":72,"value":544},{"type":67,"tag":326,"props":2530,"children":2531},{"style":359},[2532],{"type":72,"value":2361},{"type":67,"tag":326,"props":2534,"children":2535},{"style":349},[2536],{"type":72,"value":120},{"type":67,"tag":326,"props":2538,"children":2539},{"style":525},[2540],{"type":72,"value":2541},"string",{"type":67,"tag":326,"props":2543,"children":2544},{"style":359},[2545],{"type":72,"value":870},{"type":67,"tag":326,"props":2547,"children":2548},{"style":349},[2549],{"type":72,"value":120},{"type":67,"tag":326,"props":2551,"children":2552},{"style":525},[2553],{"type":72,"value":2554},"email",{"type":67,"tag":326,"props":2556,"children":2557},{"style":359},[2558],{"type":72,"value":870},{"type":67,"tag":326,"props":2560,"children":2561},{"style":349},[2562],{"type":72,"value":667},{"type":67,"tag":326,"props":2564,"children":2565},{"style":570},[2566],{"type":72,"value":2567}," password",{"type":67,"tag":326,"props":2569,"children":2570},{"style":349},[2571],{"type":72,"value":544},{"type":67,"tag":326,"props":2573,"children":2574},{"style":359},[2575],{"type":72,"value":2361},{"type":67,"tag":326,"props":2577,"children":2578},{"style":349},[2579],{"type":72,"value":120},{"type":67,"tag":326,"props":2581,"children":2582},{"style":525},[2583],{"type":72,"value":2541},{"type":67,"tag":326,"props":2585,"children":2586},{"style":359},[2587],{"type":72,"value":2588},"() ",{"type":67,"tag":326,"props":2590,"children":2591},{"style":349},[2592],{"type":72,"value":389},{"type":67,"tag":326,"props":2594,"children":2595},{"style":359},[2596],{"type":72,"value":2597},"))\n",{"type":67,"tag":326,"props":2599,"children":2600},{"class":328,"line":462},[2601,2605,2609,2613,2617,2621,2626,2630,2634],{"type":67,"tag":326,"props":2602,"children":2603},{"style":349},[2604],{"type":72,"value":2083},{"type":67,"tag":326,"props":2606,"children":2607},{"style":525},[2608],{"type":72,"value":2105},{"type":67,"tag":326,"props":2610,"children":2611},{"style":359},[2612],{"type":72,"value":533},{"type":67,"tag":326,"props":2614,"children":2615},{"style":427},[2616],{"type":72,"value":2114},{"type":67,"tag":326,"props":2618,"children":2619},{"style":349},[2620],{"type":72,"value":1680},{"type":67,"tag":326,"props":2622,"children":2623},{"style":536},[2624],{"type":72,"value":2625}," data",{"type":67,"tag":326,"props":2627,"children":2628},{"style":349},[2629],{"type":72,"value":1690},{"type":67,"tag":326,"props":2631,"children":2632},{"style":427},[2633],{"type":72,"value":1695},{"type":67,"tag":326,"props":2635,"children":2636},{"style":349},[2637],{"type":72,"value":352},{"type":67,"tag":326,"props":2639,"children":2640},{"class":328,"line":503},[2641,2645,2650,2654,2658,2662,2666,2671,2675,2680,2684,2689,2693,2697],{"type":67,"tag":326,"props":2642,"children":2643},{"style":427},[2644],{"type":72,"value":1171},{"type":67,"tag":326,"props":2646,"children":2647},{"style":359},[2648],{"type":72,"value":2649}," user",{"type":67,"tag":326,"props":2651,"children":2652},{"style":349},[2653],{"type":72,"value":1019},{"type":67,"tag":326,"props":2655,"children":2656},{"style":343},[2657],{"type":72,"value":1754},{"type":67,"tag":326,"props":2659,"children":2660},{"style":359},[2661],{"type":72,"value":1759},{"type":67,"tag":326,"props":2663,"children":2664},{"style":349},[2665],{"type":72,"value":120},{"type":67,"tag":326,"props":2667,"children":2668},{"style":359},[2669],{"type":72,"value":2670},"users",{"type":67,"tag":326,"props":2672,"children":2673},{"style":349},[2674],{"type":72,"value":120},{"type":67,"tag":326,"props":2676,"children":2677},{"style":525},[2678],{"type":72,"value":2679},"findByEmail",{"type":67,"tag":326,"props":2681,"children":2682},{"style":570},[2683],{"type":72,"value":533},{"type":67,"tag":326,"props":2685,"children":2686},{"style":359},[2687],{"type":72,"value":2688},"data",{"type":67,"tag":326,"props":2690,"children":2691},{"style":349},[2692],{"type":72,"value":120},{"type":67,"tag":326,"props":2694,"children":2695},{"style":359},[2696],{"type":72,"value":2554},{"type":67,"tag":326,"props":2698,"children":2699},{"style":570},[2700],{"type":72,"value":1046},{"type":67,"tag":326,"props":2702,"children":2703},{"class":328,"line":511},[2704],{"type":67,"tag":326,"props":2705,"children":2706},{"style":333},[2707],{"type":72,"value":2708},"    \u002F\u002F Always run verifyPasswordHash — even when the user doesn't exist —\n",{"type":67,"tag":326,"props":2710,"children":2711},{"class":328,"line":562},[2712],{"type":67,"tag":326,"props":2713,"children":2714},{"style":333},[2715],{"type":72,"value":2716},"    \u002F\u002F so the user-not-found branch takes the same time as wrong-password.\n",{"type":67,"tag":326,"props":2718,"children":2719},{"class":328,"line":576},[2720],{"type":67,"tag":326,"props":2721,"children":2722},{"style":333},[2723],{"type":72,"value":2724},"    \u002F\u002F DUMMY_PASSWORD_HASH is a hash of any throwaway password computed once\n",{"type":67,"tag":326,"props":2726,"children":2727},{"class":328,"line":598},[2728],{"type":67,"tag":326,"props":2729,"children":2730},{"style":333},[2731],{"type":72,"value":2732},"    \u002F\u002F at startup with the same algorithm\u002Fcost as real password hashes.\n",{"type":67,"tag":326,"props":2734,"children":2735},{"class":328,"line":607},[2736,2740,2745,2749,2753,2758,2763,2768],{"type":67,"tag":326,"props":2737,"children":2738},{"style":427},[2739],{"type":72,"value":1171},{"type":67,"tag":326,"props":2741,"children":2742},{"style":359},[2743],{"type":72,"value":2744}," hashToCheck",{"type":67,"tag":326,"props":2746,"children":2747},{"style":349},[2748],{"type":72,"value":1019},{"type":67,"tag":326,"props":2750,"children":2751},{"style":359},[2752],{"type":72,"value":2649},{"type":67,"tag":326,"props":2754,"children":2755},{"style":349},[2756],{"type":72,"value":2757},"?.",{"type":67,"tag":326,"props":2759,"children":2760},{"style":359},[2761],{"type":72,"value":2762},"passwordHash",{"type":67,"tag":326,"props":2764,"children":2765},{"style":349},[2766],{"type":72,"value":2767}," ??",{"type":67,"tag":326,"props":2769,"children":2770},{"style":359},[2771],{"type":72,"value":2772}," DUMMY_PASSWORD_HASH\n",{"type":67,"tag":326,"props":2774,"children":2775},{"class":328,"line":647},[2776,2780,2785,2789,2793,2798,2802,2807,2811,2815,2819,2824],{"type":67,"tag":326,"props":2777,"children":2778},{"style":427},[2779],{"type":72,"value":1171},{"type":67,"tag":326,"props":2781,"children":2782},{"style":359},[2783],{"type":72,"value":2784}," passwordMatches",{"type":67,"tag":326,"props":2786,"children":2787},{"style":349},[2788],{"type":72,"value":1019},{"type":67,"tag":326,"props":2790,"children":2791},{"style":343},[2792],{"type":72,"value":1754},{"type":67,"tag":326,"props":2794,"children":2795},{"style":525},[2796],{"type":72,"value":2797}," verifyPasswordHash",{"type":67,"tag":326,"props":2799,"children":2800},{"style":570},[2801],{"type":72,"value":533},{"type":67,"tag":326,"props":2803,"children":2804},{"style":359},[2805],{"type":72,"value":2806},"hashToCheck",{"type":67,"tag":326,"props":2808,"children":2809},{"style":349},[2810],{"type":72,"value":667},{"type":67,"tag":326,"props":2812,"children":2813},{"style":359},[2814],{"type":72,"value":2625},{"type":67,"tag":326,"props":2816,"children":2817},{"style":349},[2818],{"type":72,"value":120},{"type":67,"tag":326,"props":2820,"children":2821},{"style":359},[2822],{"type":72,"value":2823},"password",{"type":67,"tag":326,"props":2825,"children":2826},{"style":570},[2827],{"type":72,"value":1046},{"type":67,"tag":326,"props":2829,"children":2830},{"class":328,"line":675},[2831,2835,2840,2844,2848,2853,2857,2862],{"type":67,"tag":326,"props":2832,"children":2833},{"style":427},[2834],{"type":72,"value":1171},{"type":67,"tag":326,"props":2836,"children":2837},{"style":359},[2838],{"type":72,"value":2839}," ok",{"type":67,"tag":326,"props":2841,"children":2842},{"style":349},[2843],{"type":72,"value":1019},{"type":67,"tag":326,"props":2845,"children":2846},{"style":359},[2847],{"type":72,"value":2649},{"type":67,"tag":326,"props":2849,"children":2850},{"style":349},[2851],{"type":72,"value":2852}," !=",{"type":67,"tag":326,"props":2854,"children":2855},{"style":349},[2856],{"type":72,"value":996},{"type":67,"tag":326,"props":2858,"children":2859},{"style":349},[2860],{"type":72,"value":2861}," &&",{"type":67,"tag":326,"props":2863,"children":2864},{"style":359},[2865],{"type":72,"value":2866}," passwordMatches\n",{"type":67,"tag":326,"props":2868,"children":2869},{"class":328,"line":700},[2870,2874,2878,2882,2887,2891,2895,2899,2903,2907,2911,2916,2920],{"type":67,"tag":326,"props":2871,"children":2872},{"style":343},[2873],{"type":72,"value":1222},{"type":67,"tag":326,"props":2875,"children":2876},{"style":570},[2877],{"type":72,"value":94},{"type":67,"tag":326,"props":2879,"children":2880},{"style":349},[2881],{"type":72,"value":1064},{"type":67,"tag":326,"props":2883,"children":2884},{"style":359},[2885],{"type":72,"value":2886},"ok",{"type":67,"tag":326,"props":2888,"children":2889},{"style":570},[2890],{"type":72,"value":1074},{"type":67,"tag":326,"props":2892,"children":2893},{"style":343},[2894],{"type":72,"value":1826},{"type":67,"tag":326,"props":2896,"children":2897},{"style":349},[2898],{"type":72,"value":1831},{"type":67,"tag":326,"props":2900,"children":2901},{"style":525},[2902],{"type":72,"value":1836},{"type":67,"tag":326,"props":2904,"children":2905},{"style":570},[2906],{"type":72,"value":533},{"type":67,"tag":326,"props":2908,"children":2909},{"style":349},[2910],{"type":72,"value":454},{"type":67,"tag":326,"props":2912,"children":2913},{"style":402},[2914],{"type":72,"value":2915},"Invalid email or password",{"type":67,"tag":326,"props":2917,"children":2918},{"style":349},[2919],{"type":72,"value":454},{"type":67,"tag":326,"props":2921,"children":2922},{"style":570},[2923],{"type":72,"value":1046},{"type":67,"tag":326,"props":2925,"children":2926},{"class":328,"line":726},[2927],{"type":67,"tag":326,"props":2928,"children":2929},{"emptyLinePlaceholder":417},[2930],{"type":72,"value":420},{"type":67,"tag":326,"props":2932,"children":2933},{"class":328,"line":752},[2934],{"type":67,"tag":326,"props":2935,"children":2936},{"style":333},[2937],{"type":72,"value":2938},"    \u002F\u002F ROTATE on privilege change: destroy any existing session, then issue fresh.\n",{"type":67,"tag":326,"props":2940,"children":2941},{"class":328,"line":782},[2942,2947,2951,2955,2959,2963,2968,2972,2977,2981,2986],{"type":67,"tag":326,"props":2943,"children":2944},{"style":343},[2945],{"type":72,"value":2946},"    await",{"type":67,"tag":326,"props":2948,"children":2949},{"style":359},[2950],{"type":72,"value":1759},{"type":67,"tag":326,"props":2952,"children":2953},{"style":349},[2954],{"type":72,"value":120},{"type":67,"tag":326,"props":2956,"children":2957},{"style":359},[2958],{"type":72,"value":1768},{"type":67,"tag":326,"props":2960,"children":2961},{"style":349},[2962],{"type":72,"value":120},{"type":67,"tag":326,"props":2964,"children":2965},{"style":525},[2966],{"type":72,"value":2967},"revokeAllForUser",{"type":67,"tag":326,"props":2969,"children":2970},{"style":570},[2971],{"type":72,"value":533},{"type":67,"tag":326,"props":2973,"children":2974},{"style":359},[2975],{"type":72,"value":2976},"user",{"type":67,"tag":326,"props":2978,"children":2979},{"style":349},[2980],{"type":72,"value":120},{"type":67,"tag":326,"props":2982,"children":2983},{"style":359},[2984],{"type":72,"value":2985},"id",{"type":67,"tag":326,"props":2987,"children":2988},{"style":570},[2989],{"type":72,"value":1046},{"type":67,"tag":326,"props":2991,"children":2992},{"class":328,"line":825},[2993,2997,3001,3005,3009,3013,3017,3021,3025,3030,3034,3038,3042,3046,3050,3054,3058,3062],{"type":67,"tag":326,"props":2994,"children":2995},{"style":427},[2996],{"type":72,"value":1171},{"type":67,"tag":326,"props":2998,"children":2999},{"style":359},[3000],{"type":72,"value":1711},{"type":67,"tag":326,"props":3002,"children":3003},{"style":349},[3004],{"type":72,"value":1019},{"type":67,"tag":326,"props":3006,"children":3007},{"style":343},[3008],{"type":72,"value":1754},{"type":67,"tag":326,"props":3010,"children":3011},{"style":359},[3012],{"type":72,"value":1759},{"type":67,"tag":326,"props":3014,"children":3015},{"style":349},[3016],{"type":72,"value":120},{"type":67,"tag":326,"props":3018,"children":3019},{"style":359},[3020],{"type":72,"value":1768},{"type":67,"tag":326,"props":3022,"children":3023},{"style":349},[3024],{"type":72,"value":120},{"type":67,"tag":326,"props":3026,"children":3027},{"style":525},[3028],{"type":72,"value":3029},"create",{"type":67,"tag":326,"props":3031,"children":3032},{"style":570},[3033],{"type":72,"value":533},{"type":67,"tag":326,"props":3035,"children":3036},{"style":349},[3037],{"type":72,"value":1624},{"type":67,"tag":326,"props":3039,"children":3040},{"style":570},[3041],{"type":72,"value":2189},{"type":67,"tag":326,"props":3043,"children":3044},{"style":349},[3045],{"type":72,"value":544},{"type":67,"tag":326,"props":3047,"children":3048},{"style":359},[3049],{"type":72,"value":2649},{"type":67,"tag":326,"props":3051,"children":3052},{"style":349},[3053],{"type":72,"value":120},{"type":67,"tag":326,"props":3055,"children":3056},{"style":359},[3057],{"type":72,"value":2985},{"type":67,"tag":326,"props":3059,"children":3060},{"style":349},[3061],{"type":72,"value":1530},{"type":67,"tag":326,"props":3063,"children":3064},{"style":570},[3065],{"type":72,"value":1046},{"type":67,"tag":326,"props":3067,"children":3068},{"class":328,"line":834},[3069,3074,3078,3082],{"type":67,"tag":326,"props":3070,"children":3071},{"style":525},[3072],{"type":72,"value":3073},"    setSessionCookie",{"type":67,"tag":326,"props":3075,"children":3076},{"style":570},[3077],{"type":72,"value":533},{"type":67,"tag":326,"props":3079,"children":3080},{"style":359},[3081],{"type":72,"value":539},{"type":67,"tag":326,"props":3083,"children":3084},{"style":570},[3085],{"type":72,"value":1046},{"type":67,"tag":326,"props":3087,"children":3088},{"class":328,"line":843},[3089,3093,3097,3101,3105,3111],{"type":67,"tag":326,"props":3090,"children":3091},{"style":343},[3092],{"type":72,"value":1865},{"type":67,"tag":326,"props":3094,"children":3095},{"style":349},[3096],{"type":72,"value":1520},{"type":67,"tag":326,"props":3098,"children":3099},{"style":570},[3100],{"type":72,"value":2839},{"type":67,"tag":326,"props":3102,"children":3103},{"style":349},[3104],{"type":72,"value":544},{"type":67,"tag":326,"props":3106,"children":3108},{"style":3107},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[3109],{"type":72,"value":3110}," true",{"type":67,"tag":326,"props":3112,"children":3113},{"style":349},[3114],{"type":72,"value":3115}," }\n",{"type":67,"tag":326,"props":3117,"children":3118},{"class":328,"line":851},[3119,3123],{"type":67,"tag":326,"props":3120,"children":3121},{"style":349},[3122],{"type":72,"value":2234},{"type":67,"tag":326,"props":3124,"children":3125},{"style":359},[3126],{"type":72,"value":1046},{"type":67,"tag":194,"props":3128,"children":3130},{"id":3129},"logout",[3131],{"type":72,"value":3132},"Logout",{"type":67,"tag":315,"props":3134,"children":3136},{"className":317,"code":3135,"language":319,"meta":320,"style":320},"import { createServerFn } from '@tanstack\u002Freact-start'\nimport { authMiddleware } from '~\u002Fserver\u002Fauth-middleware'\nimport { clearSessionCookie } from '~\u002Fserver\u002Fsession'\n\nexport const logout = createServerFn({ method: 'POST' })\n  .middleware([authMiddleware])\n  .handler(async ({ context }) => {\n    await db.sessions.revoke(context.session.id)\n    clearSessionCookie()\n    return { ok: true }\n  })\n",[3137],{"type":67,"tag":96,"props":3138,"children":3139},{"__ignoreMap":320},[3140,3175,3210,3246,3253,3313,3328,3367,3424,3436,3463],{"type":67,"tag":326,"props":3141,"children":3142},{"class":328,"line":329},[3143,3147,3151,3155,3159,3163,3167,3171],{"type":67,"tag":326,"props":3144,"children":3145},{"style":343},[3146],{"type":72,"value":346},{"type":67,"tag":326,"props":3148,"children":3149},{"style":349},[3150],{"type":72,"value":1520},{"type":67,"tag":326,"props":3152,"children":3153},{"style":359},[3154],{"type":72,"value":1949},{"type":67,"tag":326,"props":3156,"children":3157},{"style":349},[3158],{"type":72,"value":1530},{"type":67,"tag":326,"props":3160,"children":3161},{"style":343},[3162],{"type":72,"value":394},{"type":67,"tag":326,"props":3164,"children":3165},{"style":349},[3166],{"type":72,"value":399},{"type":67,"tag":326,"props":3168,"children":3169},{"style":402},[3170],{"type":72,"value":1543},{"type":67,"tag":326,"props":3172,"children":3173},{"style":349},[3174],{"type":72,"value":410},{"type":67,"tag":326,"props":3176,"children":3177},{"class":328,"line":339},[3178,3182,3186,3190,3194,3198,3202,3206],{"type":67,"tag":326,"props":3179,"children":3180},{"style":343},[3181],{"type":72,"value":346},{"type":67,"tag":326,"props":3183,"children":3184},{"style":349},[3185],{"type":72,"value":1520},{"type":67,"tag":326,"props":3187,"children":3188},{"style":359},[3189],{"type":72,"value":1985},{"type":67,"tag":326,"props":3191,"children":3192},{"style":349},[3193],{"type":72,"value":1530},{"type":67,"tag":326,"props":3195,"children":3196},{"style":343},[3197],{"type":72,"value":394},{"type":67,"tag":326,"props":3199,"children":3200},{"style":349},[3201],{"type":72,"value":399},{"type":67,"tag":326,"props":3203,"children":3204},{"style":402},[3205],{"type":72,"value":2002},{"type":67,"tag":326,"props":3207,"children":3208},{"style":349},[3209],{"type":72,"value":410},{"type":67,"tag":326,"props":3211,"children":3212},{"class":328,"line":355},[3213,3217,3221,3225,3229,3233,3237,3242],{"type":67,"tag":326,"props":3214,"children":3215},{"style":343},[3216],{"type":72,"value":346},{"type":67,"tag":326,"props":3218,"children":3219},{"style":349},[3220],{"type":72,"value":1520},{"type":67,"tag":326,"props":3222,"children":3223},{"style":359},[3224],{"type":72,"value":865},{"type":67,"tag":326,"props":3226,"children":3227},{"style":349},[3228],{"type":72,"value":1530},{"type":67,"tag":326,"props":3230,"children":3231},{"style":343},[3232],{"type":72,"value":394},{"type":67,"tag":326,"props":3234,"children":3235},{"style":349},[3236],{"type":72,"value":399},{"type":67,"tag":326,"props":3238,"children":3239},{"style":402},[3240],{"type":72,"value":3241},"~\u002Fserver\u002Fsession",{"type":67,"tag":326,"props":3243,"children":3244},{"style":349},[3245],{"type":72,"value":410},{"type":67,"tag":326,"props":3247,"children":3248},{"class":328,"line":370},[3249],{"type":67,"tag":326,"props":3250,"children":3251},{"emptyLinePlaceholder":417},[3252],{"type":72,"value":420},{"type":67,"tag":326,"props":3254,"children":3255},{"class":328,"line":383},[3256,3260,3264,3269,3273,3277,3281,3285,3289,3293,3297,3301,3305,3309],{"type":67,"tag":326,"props":3257,"children":3258},{"style":343},[3259],{"type":72,"value":517},{"type":67,"tag":326,"props":3261,"children":3262},{"style":427},[3263],{"type":72,"value":1602},{"type":67,"tag":326,"props":3265,"children":3266},{"style":359},[3267],{"type":72,"value":3268}," logout ",{"type":67,"tag":326,"props":3270,"children":3271},{"style":349},[3272],{"type":72,"value":440},{"type":67,"tag":326,"props":3274,"children":3275},{"style":525},[3276],{"type":72,"value":1949},{"type":67,"tag":326,"props":3278,"children":3279},{"style":359},[3280],{"type":72,"value":533},{"type":67,"tag":326,"props":3282,"children":3283},{"style":349},[3284],{"type":72,"value":1624},{"type":67,"tag":326,"props":3286,"children":3287},{"style":570},[3288],{"type":72,"value":2050},{"type":67,"tag":326,"props":3290,"children":3291},{"style":349},[3292],{"type":72,"value":544},{"type":67,"tag":326,"props":3294,"children":3295},{"style":349},[3296],{"type":72,"value":399},{"type":67,"tag":326,"props":3298,"children":3299},{"style":402},[3300],{"type":72,"value":2473},{"type":67,"tag":326,"props":3302,"children":3303},{"style":349},[3304],{"type":72,"value":454},{"type":67,"tag":326,"props":3306,"children":3307},{"style":349},[3308],{"type":72,"value":1530},{"type":67,"tag":326,"props":3310,"children":3311},{"style":359},[3312],{"type":72,"value":1046},{"type":67,"tag":326,"props":3314,"children":3315},{"class":328,"line":413},[3316,3320,3324],{"type":67,"tag":326,"props":3317,"children":3318},{"style":349},[3319],{"type":72,"value":2083},{"type":67,"tag":326,"props":3321,"children":3322},{"style":525},[3323],{"type":72,"value":2088},{"type":67,"tag":326,"props":3325,"children":3326},{"style":359},[3327],{"type":72,"value":2093},{"type":67,"tag":326,"props":3329,"children":3330},{"class":328,"line":423},[3331,3335,3339,3343,3347,3351,3355,3359,3363],{"type":67,"tag":326,"props":3332,"children":3333},{"style":349},[3334],{"type":72,"value":2083},{"type":67,"tag":326,"props":3336,"children":3337},{"style":525},[3338],{"type":72,"value":2105},{"type":67,"tag":326,"props":3340,"children":3341},{"style":359},[3342],{"type":72,"value":533},{"type":67,"tag":326,"props":3344,"children":3345},{"style":427},[3346],{"type":72,"value":2114},{"type":67,"tag":326,"props":3348,"children":3349},{"style":349},[3350],{"type":72,"value":1680},{"type":67,"tag":326,"props":3352,"children":3353},{"style":536},[3354],{"type":72,"value":1882},{"type":67,"tag":326,"props":3356,"children":3357},{"style":349},[3358],{"type":72,"value":1690},{"type":67,"tag":326,"props":3360,"children":3361},{"style":427},[3362],{"type":72,"value":1695},{"type":67,"tag":326,"props":3364,"children":3365},{"style":349},[3366],{"type":72,"value":352},{"type":67,"tag":326,"props":3368,"children":3369},{"class":328,"line":462},[3370,3374,3378,3382,3386,3390,3395,3399,3404,3408,3412,3416,3420],{"type":67,"tag":326,"props":3371,"children":3372},{"style":343},[3373],{"type":72,"value":2946},{"type":67,"tag":326,"props":3375,"children":3376},{"style":359},[3377],{"type":72,"value":1759},{"type":67,"tag":326,"props":3379,"children":3380},{"style":349},[3381],{"type":72,"value":120},{"type":67,"tag":326,"props":3383,"children":3384},{"style":359},[3385],{"type":72,"value":1768},{"type":67,"tag":326,"props":3387,"children":3388},{"style":349},[3389],{"type":72,"value":120},{"type":67,"tag":326,"props":3391,"children":3392},{"style":525},[3393],{"type":72,"value":3394},"revoke",{"type":67,"tag":326,"props":3396,"children":3397},{"style":570},[3398],{"type":72,"value":533},{"type":67,"tag":326,"props":3400,"children":3401},{"style":359},[3402],{"type":72,"value":3403},"context",{"type":67,"tag":326,"props":3405,"children":3406},{"style":349},[3407],{"type":72,"value":120},{"type":67,"tag":326,"props":3409,"children":3410},{"style":359},[3411],{"type":72,"value":1817},{"type":67,"tag":326,"props":3413,"children":3414},{"style":349},[3415],{"type":72,"value":120},{"type":67,"tag":326,"props":3417,"children":3418},{"style":359},[3419],{"type":72,"value":2985},{"type":67,"tag":326,"props":3421,"children":3422},{"style":570},[3423],{"type":72,"value":1046},{"type":67,"tag":326,"props":3425,"children":3426},{"class":328,"line":503},[3427,3432],{"type":67,"tag":326,"props":3428,"children":3429},{"style":525},[3430],{"type":72,"value":3431},"    clearSessionCookie",{"type":67,"tag":326,"props":3433,"children":3434},{"style":570},[3435],{"type":72,"value":1724},{"type":67,"tag":326,"props":3437,"children":3438},{"class":328,"line":511},[3439,3443,3447,3451,3455,3459],{"type":67,"tag":326,"props":3440,"children":3441},{"style":343},[3442],{"type":72,"value":1865},{"type":67,"tag":326,"props":3444,"children":3445},{"style":349},[3446],{"type":72,"value":1520},{"type":67,"tag":326,"props":3448,"children":3449},{"style":570},[3450],{"type":72,"value":2839},{"type":67,"tag":326,"props":3452,"children":3453},{"style":349},[3454],{"type":72,"value":544},{"type":67,"tag":326,"props":3456,"children":3457},{"style":3107},[3458],{"type":72,"value":3110},{"type":67,"tag":326,"props":3460,"children":3461},{"style":349},[3462],{"type":72,"value":3115},{"type":67,"tag":326,"props":3464,"children":3465},{"class":328,"line":562},[3466,3470],{"type":67,"tag":326,"props":3467,"children":3468},{"style":349},[3469],{"type":72,"value":2234},{"type":67,"tag":326,"props":3471,"children":3472},{"style":359},[3473],{"type":72,"value":1046},{"type":67,"tag":194,"props":3475,"children":3477},{"id":3476},"oauth-state-pkce",[3478],{"type":72,"value":3479},"OAuth: state + PKCE",{"type":67,"tag":75,"props":3481,"children":3482},{},[3483,3485,3491],{"type":72,"value":3484},"For OAuth authorization-code flow, generate a one-time ",{"type":67,"tag":96,"props":3486,"children":3488},{"className":3487},[],[3489],{"type":72,"value":3490},"state",{"type":72,"value":3492}," (CSRF defense) and a PKCE verifier (defense against authorization-code interception). Store both in a short-lived signed cookie keyed to this exact login attempt.",{"type":67,"tag":315,"props":3494,"children":3496},{"className":317,"code":3495,"language":319,"meta":320,"style":320},"\u002F\u002F src\u002Fserver\u002Foauth.functions.ts\nimport { createServerFn } from '@tanstack\u002Freact-start'\nimport { redirect } from '@tanstack\u002Freact-router'\nimport {\n  getRequestHeader,\n  setResponseHeader,\n} from '@tanstack\u002Freact-start\u002Fserver'\nimport crypto from 'node:crypto'\n\nconst OAUTH_STATE_COOKIE = '__Host-oauth' \u002F\u002F expires fast; one-shot\n\nfunction base64url(buf: Buffer) {\n  return buf\n    .toString('base64')\n    .replace(\u002F=\u002Fg, '')\n    .replace(\u002F\\+\u002Fg, '-')\n    .replace(\u002F\\\u002F\u002Fg, '_')\n}\n\nexport const startOAuth = createServerFn({ method: 'GET' }).handler(\n  async () => {\n    const state = base64url(crypto.randomBytes(32))\n    const verifier = base64url(crypto.randomBytes(32))\n    const challenge = base64url(\n      crypto.createHash('sha256').update(verifier).digest(),\n    )\n\n    setResponseHeader(\n      'Set-Cookie',\n      `${OAUTH_STATE_COOKIE}=${signed({ state, verifier })}; HttpOnly; Secure; SameSite=Lax; Path=\u002F; Max-Age=600`,\n    )\n\n    throw redirect({\n      href:\n        `https:\u002F\u002Fprovider.example\u002Fauthorize` +\n        `?response_type=code` +\n        `&client_id=${process.env.OAUTH_CLIENT_ID}` +\n        `&redirect_uri=${encodeURIComponent(process.env.OAUTH_REDIRECT_URI!)}` +\n        `&state=${state}` +\n        `&code_challenge=${challenge}` +\n        `&code_challenge_method=S256`,\n    })\n  },\n)\n",[3497],{"type":67,"tag":96,"props":3498,"children":3499},{"__ignoreMap":320},[3500,3508,3543,3580,3591,3602,3613,3636,3666,3673,3707,3714,3752,3764,3798,3844,3897,3950,3957,3964,4036,4056,4107,4155,4179,4256,4264,4271,4283,4303,4378,4385,4392,4412,4425,4447,4467,4514,4573,4601,4630,4650,4663,4671],{"type":67,"tag":326,"props":3501,"children":3502},{"class":328,"line":329},[3503],{"type":67,"tag":326,"props":3504,"children":3505},{"style":333},[3506],{"type":72,"value":3507},"\u002F\u002F src\u002Fserver\u002Foauth.functions.ts\n",{"type":67,"tag":326,"props":3509,"children":3510},{"class":328,"line":339},[3511,3515,3519,3523,3527,3531,3535,3539],{"type":67,"tag":326,"props":3512,"children":3513},{"style":343},[3514],{"type":72,"value":346},{"type":67,"tag":326,"props":3516,"children":3517},{"style":349},[3518],{"type":72,"value":1520},{"type":67,"tag":326,"props":3520,"children":3521},{"style":359},[3522],{"type":72,"value":1949},{"type":67,"tag":326,"props":3524,"children":3525},{"style":349},[3526],{"type":72,"value":1530},{"type":67,"tag":326,"props":3528,"children":3529},{"style":343},[3530],{"type":72,"value":394},{"type":67,"tag":326,"props":3532,"children":3533},{"style":349},[3534],{"type":72,"value":399},{"type":67,"tag":326,"props":3536,"children":3537},{"style":402},[3538],{"type":72,"value":1543},{"type":67,"tag":326,"props":3540,"children":3541},{"style":349},[3542],{"type":72,"value":410},{"type":67,"tag":326,"props":3544,"children":3545},{"class":328,"line":355},[3546,3550,3554,3559,3563,3567,3571,3576],{"type":67,"tag":326,"props":3547,"children":3548},{"style":343},[3549],{"type":72,"value":346},{"type":67,"tag":326,"props":3551,"children":3552},{"style":349},[3553],{"type":72,"value":1520},{"type":67,"tag":326,"props":3555,"children":3556},{"style":359},[3557],{"type":72,"value":3558}," redirect",{"type":67,"tag":326,"props":3560,"children":3561},{"style":349},[3562],{"type":72,"value":1530},{"type":67,"tag":326,"props":3564,"children":3565},{"style":343},[3566],{"type":72,"value":394},{"type":67,"tag":326,"props":3568,"children":3569},{"style":349},[3570],{"type":72,"value":399},{"type":67,"tag":326,"props":3572,"children":3573},{"style":402},[3574],{"type":72,"value":3575},"@tanstack\u002Freact-router",{"type":67,"tag":326,"props":3577,"children":3578},{"style":349},[3579],{"type":72,"value":410},{"type":67,"tag":326,"props":3581,"children":3582},{"class":328,"line":370},[3583,3587],{"type":67,"tag":326,"props":3584,"children":3585},{"style":343},[3586],{"type":72,"value":346},{"type":67,"tag":326,"props":3588,"children":3589},{"style":349},[3590],{"type":72,"value":352},{"type":67,"tag":326,"props":3592,"children":3593},{"class":328,"line":383},[3594,3598],{"type":67,"tag":326,"props":3595,"children":3596},{"style":359},[3597],{"type":72,"value":362},{"type":67,"tag":326,"props":3599,"children":3600},{"style":349},[3601],{"type":72,"value":367},{"type":67,"tag":326,"props":3603,"children":3604},{"class":328,"line":413},[3605,3609],{"type":67,"tag":326,"props":3606,"children":3607},{"style":359},[3608],{"type":72,"value":376},{"type":67,"tag":326,"props":3610,"children":3611},{"style":349},[3612],{"type":72,"value":367},{"type":67,"tag":326,"props":3614,"children":3615},{"class":328,"line":423},[3616,3620,3624,3628,3632],{"type":67,"tag":326,"props":3617,"children":3618},{"style":349},[3619],{"type":72,"value":389},{"type":67,"tag":326,"props":3621,"children":3622},{"style":343},[3623],{"type":72,"value":394},{"type":67,"tag":326,"props":3625,"children":3626},{"style":349},[3627],{"type":72,"value":399},{"type":67,"tag":326,"props":3629,"children":3630},{"style":402},[3631],{"type":72,"value":405},{"type":67,"tag":326,"props":3633,"children":3634},{"style":349},[3635],{"type":72,"value":410},{"type":67,"tag":326,"props":3637,"children":3638},{"class":328,"line":462},[3639,3643,3648,3653,3657,3662],{"type":67,"tag":326,"props":3640,"children":3641},{"style":343},[3642],{"type":72,"value":346},{"type":67,"tag":326,"props":3644,"children":3645},{"style":359},[3646],{"type":72,"value":3647}," crypto ",{"type":67,"tag":326,"props":3649,"children":3650},{"style":343},[3651],{"type":72,"value":3652},"from",{"type":67,"tag":326,"props":3654,"children":3655},{"style":349},[3656],{"type":72,"value":399},{"type":67,"tag":326,"props":3658,"children":3659},{"style":402},[3660],{"type":72,"value":3661},"node:crypto",{"type":67,"tag":326,"props":3663,"children":3664},{"style":349},[3665],{"type":72,"value":410},{"type":67,"tag":326,"props":3667,"children":3668},{"class":328,"line":503},[3669],{"type":67,"tag":326,"props":3670,"children":3671},{"emptyLinePlaceholder":417},[3672],{"type":72,"value":420},{"type":67,"tag":326,"props":3674,"children":3675},{"class":328,"line":511},[3676,3680,3685,3689,3693,3698,3702],{"type":67,"tag":326,"props":3677,"children":3678},{"style":427},[3679],{"type":72,"value":430},{"type":67,"tag":326,"props":3681,"children":3682},{"style":359},[3683],{"type":72,"value":3684}," OAUTH_STATE_COOKIE ",{"type":67,"tag":326,"props":3686,"children":3687},{"style":349},[3688],{"type":72,"value":440},{"type":67,"tag":326,"props":3690,"children":3691},{"style":349},[3692],{"type":72,"value":399},{"type":67,"tag":326,"props":3694,"children":3695},{"style":402},[3696],{"type":72,"value":3697},"__Host-oauth",{"type":67,"tag":326,"props":3699,"children":3700},{"style":349},[3701],{"type":72,"value":454},{"type":67,"tag":326,"props":3703,"children":3704},{"style":333},[3705],{"type":72,"value":3706}," \u002F\u002F expires fast; one-shot\n",{"type":67,"tag":326,"props":3708,"children":3709},{"class":328,"line":562},[3710],{"type":67,"tag":326,"props":3711,"children":3712},{"emptyLinePlaceholder":417},[3713],{"type":72,"value":420},{"type":67,"tag":326,"props":3715,"children":3716},{"class":328,"line":576},[3717,3721,3726,3730,3735,3739,3744,3748],{"type":67,"tag":326,"props":3718,"children":3719},{"style":427},[3720],{"type":72,"value":1642},{"type":67,"tag":326,"props":3722,"children":3723},{"style":525},[3724],{"type":72,"value":3725}," base64url",{"type":67,"tag":326,"props":3727,"children":3728},{"style":349},[3729],{"type":72,"value":533},{"type":67,"tag":326,"props":3731,"children":3732},{"style":536},[3733],{"type":72,"value":3734},"buf",{"type":67,"tag":326,"props":3736,"children":3737},{"style":349},[3738],{"type":72,"value":544},{"type":67,"tag":326,"props":3740,"children":3741},{"style":547},[3742],{"type":72,"value":3743}," Buffer",{"type":67,"tag":326,"props":3745,"children":3746},{"style":349},[3747],{"type":72,"value":555},{"type":67,"tag":326,"props":3749,"children":3750},{"style":349},[3751],{"type":72,"value":352},{"type":67,"tag":326,"props":3753,"children":3754},{"class":328,"line":598},[3755,3759],{"type":67,"tag":326,"props":3756,"children":3757},{"style":343},[3758],{"type":72,"value":1372},{"type":67,"tag":326,"props":3760,"children":3761},{"style":359},[3762],{"type":72,"value":3763}," buf\n",{"type":67,"tag":326,"props":3765,"children":3766},{"class":328,"line":607},[3767,3772,3777,3781,3785,3790,3794],{"type":67,"tag":326,"props":3768,"children":3769},{"style":349},[3770],{"type":72,"value":3771},"    .",{"type":67,"tag":326,"props":3773,"children":3774},{"style":525},[3775],{"type":72,"value":3776},"toString",{"type":67,"tag":326,"props":3778,"children":3779},{"style":570},[3780],{"type":72,"value":533},{"type":67,"tag":326,"props":3782,"children":3783},{"style":349},[3784],{"type":72,"value":454},{"type":67,"tag":326,"props":3786,"children":3787},{"style":402},[3788],{"type":72,"value":3789},"base64",{"type":67,"tag":326,"props":3791,"children":3792},{"style":349},[3793],{"type":72,"value":454},{"type":67,"tag":326,"props":3795,"children":3796},{"style":570},[3797],{"type":72,"value":1046},{"type":67,"tag":326,"props":3799,"children":3800},{"class":328,"line":647},[3801,3805,3810,3814,3818,3822,3826,3831,3835,3840],{"type":67,"tag":326,"props":3802,"children":3803},{"style":349},[3804],{"type":72,"value":3771},{"type":67,"tag":326,"props":3806,"children":3807},{"style":525},[3808],{"type":72,"value":3809},"replace",{"type":67,"tag":326,"props":3811,"children":3812},{"style":570},[3813],{"type":72,"value":533},{"type":67,"tag":326,"props":3815,"children":3816},{"style":349},[3817],{"type":72,"value":1133},{"type":67,"tag":326,"props":3819,"children":3820},{"style":402},[3821],{"type":72,"value":440},{"type":67,"tag":326,"props":3823,"children":3824},{"style":349},[3825],{"type":72,"value":1133},{"type":67,"tag":326,"props":3827,"children":3828},{"style":479},[3829],{"type":72,"value":3830},"g",{"type":67,"tag":326,"props":3832,"children":3833},{"style":349},[3834],{"type":72,"value":667},{"type":67,"tag":326,"props":3836,"children":3837},{"style":349},[3838],{"type":72,"value":3839}," ''",{"type":67,"tag":326,"props":3841,"children":3842},{"style":570},[3843],{"type":72,"value":1046},{"type":67,"tag":326,"props":3845,"children":3846},{"class":328,"line":675},[3847,3851,3855,3859,3863,3868,3872,3876,3880,3884,3889,3893],{"type":67,"tag":326,"props":3848,"children":3849},{"style":349},[3850],{"type":72,"value":3771},{"type":67,"tag":326,"props":3852,"children":3853},{"style":525},[3854],{"type":72,"value":3809},{"type":67,"tag":326,"props":3856,"children":3857},{"style":570},[3858],{"type":72,"value":533},{"type":67,"tag":326,"props":3860,"children":3861},{"style":349},[3862],{"type":72,"value":1133},{"type":67,"tag":326,"props":3864,"children":3865},{"style":359},[3866],{"type":72,"value":3867},"\\+",{"type":67,"tag":326,"props":3869,"children":3870},{"style":349},[3871],{"type":72,"value":1133},{"type":67,"tag":326,"props":3873,"children":3874},{"style":479},[3875],{"type":72,"value":3830},{"type":67,"tag":326,"props":3877,"children":3878},{"style":349},[3879],{"type":72,"value":667},{"type":67,"tag":326,"props":3881,"children":3882},{"style":349},[3883],{"type":72,"value":399},{"type":67,"tag":326,"props":3885,"children":3886},{"style":402},[3887],{"type":72,"value":3888},"-",{"type":67,"tag":326,"props":3890,"children":3891},{"style":349},[3892],{"type":72,"value":454},{"type":67,"tag":326,"props":3894,"children":3895},{"style":570},[3896],{"type":72,"value":1046},{"type":67,"tag":326,"props":3898,"children":3899},{"class":328,"line":700},[3900,3904,3908,3912,3916,3921,3925,3929,3933,3937,3942,3946],{"type":67,"tag":326,"props":3901,"children":3902},{"style":349},[3903],{"type":72,"value":3771},{"type":67,"tag":326,"props":3905,"children":3906},{"style":525},[3907],{"type":72,"value":3809},{"type":67,"tag":326,"props":3909,"children":3910},{"style":570},[3911],{"type":72,"value":533},{"type":67,"tag":326,"props":3913,"children":3914},{"style":349},[3915],{"type":72,"value":1133},{"type":67,"tag":326,"props":3917,"children":3918},{"style":359},[3919],{"type":72,"value":3920},"\\\u002F",{"type":67,"tag":326,"props":3922,"children":3923},{"style":349},[3924],{"type":72,"value":1133},{"type":67,"tag":326,"props":3926,"children":3927},{"style":479},[3928],{"type":72,"value":3830},{"type":67,"tag":326,"props":3930,"children":3931},{"style":349},[3932],{"type":72,"value":667},{"type":67,"tag":326,"props":3934,"children":3935},{"style":349},[3936],{"type":72,"value":399},{"type":67,"tag":326,"props":3938,"children":3939},{"style":402},[3940],{"type":72,"value":3941},"_",{"type":67,"tag":326,"props":3943,"children":3944},{"style":349},[3945],{"type":72,"value":454},{"type":67,"tag":326,"props":3947,"children":3948},{"style":570},[3949],{"type":72,"value":1046},{"type":67,"tag":326,"props":3951,"children":3952},{"class":328,"line":726},[3953],{"type":67,"tag":326,"props":3954,"children":3955},{"style":349},[3956],{"type":72,"value":840},{"type":67,"tag":326,"props":3958,"children":3959},{"class":328,"line":752},[3960],{"type":67,"tag":326,"props":3961,"children":3962},{"emptyLinePlaceholder":417},[3963],{"type":72,"value":420},{"type":67,"tag":326,"props":3965,"children":3966},{"class":328,"line":782},[3967,3971,3975,3980,3984,3988,3992,3996,4000,4004,4008,4012,4016,4020,4024,4028,4032],{"type":67,"tag":326,"props":3968,"children":3969},{"style":343},[3970],{"type":72,"value":517},{"type":67,"tag":326,"props":3972,"children":3973},{"style":427},[3974],{"type":72,"value":1602},{"type":67,"tag":326,"props":3976,"children":3977},{"style":359},[3978],{"type":72,"value":3979}," startOAuth ",{"type":67,"tag":326,"props":3981,"children":3982},{"style":349},[3983],{"type":72,"value":440},{"type":67,"tag":326,"props":3985,"children":3986},{"style":525},[3987],{"type":72,"value":1949},{"type":67,"tag":326,"props":3989,"children":3990},{"style":359},[3991],{"type":72,"value":533},{"type":67,"tag":326,"props":3993,"children":3994},{"style":349},[3995],{"type":72,"value":1624},{"type":67,"tag":326,"props":3997,"children":3998},{"style":570},[3999],{"type":72,"value":2050},{"type":67,"tag":326,"props":4001,"children":4002},{"style":349},[4003],{"type":72,"value":544},{"type":67,"tag":326,"props":4005,"children":4006},{"style":349},[4007],{"type":72,"value":399},{"type":67,"tag":326,"props":4009,"children":4010},{"style":402},[4011],{"type":72,"value":2063},{"type":67,"tag":326,"props":4013,"children":4014},{"style":349},[4015],{"type":72,"value":454},{"type":67,"tag":326,"props":4017,"children":4018},{"style":349},[4019],{"type":72,"value":1530},{"type":67,"tag":326,"props":4021,"children":4022},{"style":359},[4023],{"type":72,"value":555},{"type":67,"tag":326,"props":4025,"children":4026},{"style":349},[4027],{"type":72,"value":120},{"type":67,"tag":326,"props":4029,"children":4030},{"style":525},[4031],{"type":72,"value":2105},{"type":67,"tag":326,"props":4033,"children":4034},{"style":359},[4035],{"type":72,"value":573},{"type":67,"tag":326,"props":4037,"children":4038},{"class":328,"line":825},[4039,4043,4048,4052],{"type":67,"tag":326,"props":4040,"children":4041},{"style":427},[4042],{"type":72,"value":1675},{"type":67,"tag":326,"props":4044,"children":4045},{"style":349},[4046],{"type":72,"value":4047}," ()",{"type":67,"tag":326,"props":4049,"children":4050},{"style":427},[4051],{"type":72,"value":1695},{"type":67,"tag":326,"props":4053,"children":4054},{"style":349},[4055],{"type":72,"value":352},{"type":67,"tag":326,"props":4057,"children":4058},{"class":328,"line":834},[4059,4063,4068,4072,4076,4080,4085,4089,4094,4098,4103],{"type":67,"tag":326,"props":4060,"children":4061},{"style":427},[4062],{"type":72,"value":1171},{"type":67,"tag":326,"props":4064,"children":4065},{"style":359},[4066],{"type":72,"value":4067}," state",{"type":67,"tag":326,"props":4069,"children":4070},{"style":349},[4071],{"type":72,"value":1019},{"type":67,"tag":326,"props":4073,"children":4074},{"style":525},[4075],{"type":72,"value":3725},{"type":67,"tag":326,"props":4077,"children":4078},{"style":570},[4079],{"type":72,"value":533},{"type":67,"tag":326,"props":4081,"children":4082},{"style":359},[4083],{"type":72,"value":4084},"crypto",{"type":67,"tag":326,"props":4086,"children":4087},{"style":349},[4088],{"type":72,"value":120},{"type":67,"tag":326,"props":4090,"children":4091},{"style":525},[4092],{"type":72,"value":4093},"randomBytes",{"type":67,"tag":326,"props":4095,"children":4096},{"style":570},[4097],{"type":72,"value":533},{"type":67,"tag":326,"props":4099,"children":4100},{"style":479},[4101],{"type":72,"value":4102},"32",{"type":67,"tag":326,"props":4104,"children":4105},{"style":570},[4106],{"type":72,"value":2597},{"type":67,"tag":326,"props":4108,"children":4109},{"class":328,"line":843},[4110,4114,4119,4123,4127,4131,4135,4139,4143,4147,4151],{"type":67,"tag":326,"props":4111,"children":4112},{"style":427},[4113],{"type":72,"value":1171},{"type":67,"tag":326,"props":4115,"children":4116},{"style":359},[4117],{"type":72,"value":4118}," verifier",{"type":67,"tag":326,"props":4120,"children":4121},{"style":349},[4122],{"type":72,"value":1019},{"type":67,"tag":326,"props":4124,"children":4125},{"style":525},[4126],{"type":72,"value":3725},{"type":67,"tag":326,"props":4128,"children":4129},{"style":570},[4130],{"type":72,"value":533},{"type":67,"tag":326,"props":4132,"children":4133},{"style":359},[4134],{"type":72,"value":4084},{"type":67,"tag":326,"props":4136,"children":4137},{"style":349},[4138],{"type":72,"value":120},{"type":67,"tag":326,"props":4140,"children":4141},{"style":525},[4142],{"type":72,"value":4093},{"type":67,"tag":326,"props":4144,"children":4145},{"style":570},[4146],{"type":72,"value":533},{"type":67,"tag":326,"props":4148,"children":4149},{"style":479},[4150],{"type":72,"value":4102},{"type":67,"tag":326,"props":4152,"children":4153},{"style":570},[4154],{"type":72,"value":2597},{"type":67,"tag":326,"props":4156,"children":4157},{"class":328,"line":851},[4158,4162,4167,4171,4175],{"type":67,"tag":326,"props":4159,"children":4160},{"style":427},[4161],{"type":72,"value":1171},{"type":67,"tag":326,"props":4163,"children":4164},{"style":359},[4165],{"type":72,"value":4166}," challenge",{"type":67,"tag":326,"props":4168,"children":4169},{"style":349},[4170],{"type":72,"value":1019},{"type":67,"tag":326,"props":4172,"children":4173},{"style":525},[4174],{"type":72,"value":3725},{"type":67,"tag":326,"props":4176,"children":4177},{"style":570},[4178],{"type":72,"value":573},{"type":67,"tag":326,"props":4180,"children":4181},{"class":328,"line":877},[4182,4187,4191,4196,4200,4204,4209,4213,4217,4221,4226,4230,4235,4239,4243,4248,4252],{"type":67,"tag":326,"props":4183,"children":4184},{"style":359},[4185],{"type":72,"value":4186},"      crypto",{"type":67,"tag":326,"props":4188,"children":4189},{"style":349},[4190],{"type":72,"value":120},{"type":67,"tag":326,"props":4192,"children":4193},{"style":525},[4194],{"type":72,"value":4195},"createHash",{"type":67,"tag":326,"props":4197,"children":4198},{"style":570},[4199],{"type":72,"value":533},{"type":67,"tag":326,"props":4201,"children":4202},{"style":349},[4203],{"type":72,"value":454},{"type":67,"tag":326,"props":4205,"children":4206},{"style":402},[4207],{"type":72,"value":4208},"sha256",{"type":67,"tag":326,"props":4210,"children":4211},{"style":349},[4212],{"type":72,"value":454},{"type":67,"tag":326,"props":4214,"children":4215},{"style":570},[4216],{"type":72,"value":555},{"type":67,"tag":326,"props":4218,"children":4219},{"style":349},[4220],{"type":72,"value":120},{"type":67,"tag":326,"props":4222,"children":4223},{"style":525},[4224],{"type":72,"value":4225},"update",{"type":67,"tag":326,"props":4227,"children":4228},{"style":570},[4229],{"type":72,"value":533},{"type":67,"tag":326,"props":4231,"children":4232},{"style":359},[4233],{"type":72,"value":4234},"verifier",{"type":67,"tag":326,"props":4236,"children":4237},{"style":570},[4238],{"type":72,"value":555},{"type":67,"tag":326,"props":4240,"children":4241},{"style":349},[4242],{"type":72,"value":120},{"type":67,"tag":326,"props":4244,"children":4245},{"style":525},[4246],{"type":72,"value":4247},"digest",{"type":67,"tag":326,"props":4249,"children":4250},{"style":570},[4251],{"type":72,"value":870},{"type":67,"tag":326,"props":4253,"children":4254},{"style":349},[4255],{"type":72,"value":367},{"type":67,"tag":326,"props":4257,"children":4258},{"class":328,"line":889},[4259],{"type":67,"tag":326,"props":4260,"children":4261},{"style":570},[4262],{"type":72,"value":4263},"    )\n",{"type":67,"tag":326,"props":4265,"children":4266},{"class":328,"line":909},[4267],{"type":67,"tag":326,"props":4268,"children":4269},{"emptyLinePlaceholder":417},[4270],{"type":72,"value":420},{"type":67,"tag":326,"props":4272,"children":4273},{"class":328,"line":939},[4274,4279],{"type":67,"tag":326,"props":4275,"children":4276},{"style":525},[4277],{"type":72,"value":4278},"    setResponseHeader",{"type":67,"tag":326,"props":4280,"children":4281},{"style":570},[4282],{"type":72,"value":573},{"type":67,"tag":326,"props":4284,"children":4285},{"class":328,"line":947},[4286,4291,4295,4299],{"type":67,"tag":326,"props":4287,"children":4288},{"style":349},[4289],{"type":72,"value":4290},"      '",{"type":67,"tag":326,"props":4292,"children":4293},{"style":402},[4294],{"type":72,"value":587},{"type":67,"tag":326,"props":4296,"children":4297},{"style":349},[4298],{"type":72,"value":454},{"type":67,"tag":326,"props":4300,"children":4301},{"style":349},[4302],{"type":72,"value":367},{"type":67,"tag":326,"props":4304,"children":4305},{"class":328,"line":955},[4306,4310,4315,4319,4323,4327,4332,4336,4340,4344,4348,4353,4357,4361,4365,4370,4374],{"type":67,"tag":326,"props":4307,"children":4308},{"style":349},[4309],{"type":72,"value":613},{"type":67,"tag":326,"props":4311,"children":4312},{"style":359},[4313],{"type":72,"value":4314},"OAUTH_STATE_COOKIE",{"type":67,"tag":326,"props":4316,"children":4317},{"style":349},[4318],{"type":72,"value":389},{"type":67,"tag":326,"props":4320,"children":4321},{"style":402},[4322],{"type":72,"value":440},{"type":67,"tag":326,"props":4324,"children":4325},{"style":349},[4326],{"type":72,"value":631},{"type":67,"tag":326,"props":4328,"children":4329},{"style":525},[4330],{"type":72,"value":4331},"signed",{"type":67,"tag":326,"props":4333,"children":4334},{"style":359},[4335],{"type":72,"value":533},{"type":67,"tag":326,"props":4337,"children":4338},{"style":349},[4339],{"type":72,"value":1624},{"type":67,"tag":326,"props":4341,"children":4342},{"style":359},[4343],{"type":72,"value":4067},{"type":67,"tag":326,"props":4345,"children":4346},{"style":349},[4347],{"type":72,"value":667},{"type":67,"tag":326,"props":4349,"children":4350},{"style":359},[4351],{"type":72,"value":4352}," verifier ",{"type":67,"tag":326,"props":4354,"children":4355},{"style":349},[4356],{"type":72,"value":389},{"type":67,"tag":326,"props":4358,"children":4359},{"style":359},[4360],{"type":72,"value":555},{"type":67,"tag":326,"props":4362,"children":4363},{"style":349},[4364],{"type":72,"value":389},{"type":67,"tag":326,"props":4366,"children":4367},{"style":402},[4368],{"type":72,"value":4369},"; HttpOnly; Secure; SameSite=Lax; Path=\u002F; Max-Age=600",{"type":67,"tag":326,"props":4371,"children":4372},{"style":349},[4373],{"type":72,"value":662},{"type":67,"tag":326,"props":4375,"children":4376},{"style":349},[4377],{"type":72,"value":367},{"type":67,"tag":326,"props":4379,"children":4380},{"class":328,"line":963},[4381],{"type":67,"tag":326,"props":4382,"children":4383},{"style":570},[4384],{"type":72,"value":4263},{"type":67,"tag":326,"props":4386,"children":4387},{"class":328,"line":1003},[4388],{"type":67,"tag":326,"props":4389,"children":4390},{"emptyLinePlaceholder":417},[4391],{"type":72,"value":420},{"type":67,"tag":326,"props":4393,"children":4394},{"class":328,"line":1049},[4395,4400,4404,4408],{"type":67,"tag":326,"props":4396,"children":4397},{"style":343},[4398],{"type":72,"value":4399},"    throw",{"type":67,"tag":326,"props":4401,"children":4402},{"style":525},[4403],{"type":72,"value":3558},{"type":67,"tag":326,"props":4405,"children":4406},{"style":570},[4407],{"type":72,"value":533},{"type":67,"tag":326,"props":4409,"children":4410},{"style":349},[4411],{"type":72,"value":1153},{"type":67,"tag":326,"props":4413,"children":4414},{"class":328,"line":1087},[4415,4420],{"type":67,"tag":326,"props":4416,"children":4417},{"style":570},[4418],{"type":72,"value":4419},"      href",{"type":67,"tag":326,"props":4421,"children":4422},{"style":349},[4423],{"type":72,"value":4424},":\n",{"type":67,"tag":326,"props":4426,"children":4427},{"class":328,"line":1156},[4428,4433,4438,4442],{"type":67,"tag":326,"props":4429,"children":4430},{"style":349},[4431],{"type":72,"value":4432},"        `",{"type":67,"tag":326,"props":4434,"children":4435},{"style":402},[4436],{"type":72,"value":4437},"https:\u002F\u002Fprovider.example\u002Fauthorize",{"type":67,"tag":326,"props":4439,"children":4440},{"style":349},[4441],{"type":72,"value":662},{"type":67,"tag":326,"props":4443,"children":4444},{"style":349},[4445],{"type":72,"value":4446}," +\n",{"type":67,"tag":326,"props":4448,"children":4449},{"class":328,"line":1165},[4450,4454,4459,4463],{"type":67,"tag":326,"props":4451,"children":4452},{"style":349},[4453],{"type":72,"value":4432},{"type":67,"tag":326,"props":4455,"children":4456},{"style":402},[4457],{"type":72,"value":4458},"?response_type=code",{"type":67,"tag":326,"props":4460,"children":4461},{"style":349},[4462],{"type":72,"value":662},{"type":67,"tag":326,"props":4464,"children":4465},{"style":349},[4466],{"type":72,"value":4446},{"type":67,"tag":326,"props":4468,"children":4469},{"class":328,"line":1216},[4470,4474,4479,4483,4488,4492,4497,4501,4506,4510],{"type":67,"tag":326,"props":4471,"children":4472},{"style":349},[4473],{"type":72,"value":4432},{"type":67,"tag":326,"props":4475,"children":4476},{"style":402},[4477],{"type":72,"value":4478},"&client_id=",{"type":67,"tag":326,"props":4480,"children":4481},{"style":349},[4482],{"type":72,"value":631},{"type":67,"tag":326,"props":4484,"children":4485},{"style":359},[4486],{"type":72,"value":4487},"process",{"type":67,"tag":326,"props":4489,"children":4490},{"style":349},[4491],{"type":72,"value":120},{"type":67,"tag":326,"props":4493,"children":4494},{"style":359},[4495],{"type":72,"value":4496},"env",{"type":67,"tag":326,"props":4498,"children":4499},{"style":349},[4500],{"type":72,"value":120},{"type":67,"tag":326,"props":4502,"children":4503},{"style":359},[4504],{"type":72,"value":4505},"OAUTH_CLIENT_ID",{"type":67,"tag":326,"props":4507,"children":4508},{"style":349},[4509],{"type":72,"value":640},{"type":67,"tag":326,"props":4511,"children":4512},{"style":349},[4513],{"type":72,"value":4446},{"type":67,"tag":326,"props":4515,"children":4516},{"class":328,"line":1258},[4517,4521,4526,4530,4535,4540,4544,4548,4552,4557,4561,4565,4569],{"type":67,"tag":326,"props":4518,"children":4519},{"style":349},[4520],{"type":72,"value":4432},{"type":67,"tag":326,"props":4522,"children":4523},{"style":402},[4524],{"type":72,"value":4525},"&redirect_uri=",{"type":67,"tag":326,"props":4527,"children":4528},{"style":349},[4529],{"type":72,"value":631},{"type":67,"tag":326,"props":4531,"children":4532},{"style":525},[4533],{"type":72,"value":4534},"encodeURIComponent",{"type":67,"tag":326,"props":4536,"children":4537},{"style":359},[4538],{"type":72,"value":4539},"(process",{"type":67,"tag":326,"props":4541,"children":4542},{"style":349},[4543],{"type":72,"value":120},{"type":67,"tag":326,"props":4545,"children":4546},{"style":359},[4547],{"type":72,"value":4496},{"type":67,"tag":326,"props":4549,"children":4550},{"style":349},[4551],{"type":72,"value":120},{"type":67,"tag":326,"props":4553,"children":4554},{"style":359},[4555],{"type":72,"value":4556},"OAUTH_REDIRECT_URI",{"type":67,"tag":326,"props":4558,"children":4559},{"style":349},[4560],{"type":72,"value":1064},{"type":67,"tag":326,"props":4562,"children":4563},{"style":359},[4564],{"type":72,"value":555},{"type":67,"tag":326,"props":4566,"children":4567},{"style":349},[4568],{"type":72,"value":640},{"type":67,"tag":326,"props":4570,"children":4571},{"style":349},[4572],{"type":72,"value":4446},{"type":67,"tag":326,"props":4574,"children":4575},{"class":328,"line":1357},[4576,4580,4585,4589,4593,4597],{"type":67,"tag":326,"props":4577,"children":4578},{"style":349},[4579],{"type":72,"value":4432},{"type":67,"tag":326,"props":4581,"children":4582},{"style":402},[4583],{"type":72,"value":4584},"&state=",{"type":67,"tag":326,"props":4586,"children":4587},{"style":349},[4588],{"type":72,"value":631},{"type":67,"tag":326,"props":4590,"children":4591},{"style":359},[4592],{"type":72,"value":3490},{"type":67,"tag":326,"props":4594,"children":4595},{"style":349},[4596],{"type":72,"value":640},{"type":67,"tag":326,"props":4598,"children":4599},{"style":349},[4600],{"type":72,"value":4446},{"type":67,"tag":326,"props":4602,"children":4603},{"class":328,"line":1366},[4604,4608,4613,4617,4622,4626],{"type":67,"tag":326,"props":4605,"children":4606},{"style":349},[4607],{"type":72,"value":4432},{"type":67,"tag":326,"props":4609,"children":4610},{"style":402},[4611],{"type":72,"value":4612},"&code_challenge=",{"type":67,"tag":326,"props":4614,"children":4615},{"style":349},[4616],{"type":72,"value":631},{"type":67,"tag":326,"props":4618,"children":4619},{"style":359},[4620],{"type":72,"value":4621},"challenge",{"type":67,"tag":326,"props":4623,"children":4624},{"style":349},[4625],{"type":72,"value":640},{"type":67,"tag":326,"props":4627,"children":4628},{"style":349},[4629],{"type":72,"value":4446},{"type":67,"tag":326,"props":4631,"children":4632},{"class":328,"line":1379},[4633,4637,4642,4646],{"type":67,"tag":326,"props":4634,"children":4635},{"style":349},[4636],{"type":72,"value":4432},{"type":67,"tag":326,"props":4638,"children":4639},{"style":402},[4640],{"type":72,"value":4641},"&code_challenge_method=S256",{"type":67,"tag":326,"props":4643,"children":4644},{"style":349},[4645],{"type":72,"value":662},{"type":67,"tag":326,"props":4647,"children":4648},{"style":349},[4649],{"type":72,"value":367},{"type":67,"tag":326,"props":4651,"children":4653},{"class":328,"line":4652},42,[4654,4659],{"type":67,"tag":326,"props":4655,"children":4656},{"style":349},[4657],{"type":72,"value":4658},"    }",{"type":67,"tag":326,"props":4660,"children":4661},{"style":570},[4662],{"type":72,"value":1046},{"type":67,"tag":326,"props":4664,"children":4666},{"class":328,"line":4665},43,[4667],{"type":67,"tag":326,"props":4668,"children":4669},{"style":349},[4670],{"type":72,"value":1914},{"type":67,"tag":326,"props":4672,"children":4674},{"class":328,"line":4673},44,[4675],{"type":67,"tag":326,"props":4676,"children":4677},{"style":359},[4678],{"type":72,"value":1046},{"type":67,"tag":75,"props":4680,"children":4681},{},[4682,4684,4689,4691,4697],{"type":72,"value":4683},"In the callback handler, ",{"type":67,"tag":81,"props":4685,"children":4686},{},[4687],{"type":72,"value":4688},"verify the cookie state matches the returned state",{"type":72,"value":4690}," and exchange the code with the verifier. If state is missing or doesn't match, abort — the request did not originate from your ",{"type":67,"tag":96,"props":4692,"children":4694},{"className":4693},[],[4695],{"type":72,"value":4696},"startOAuth",{"type":72,"value":120},{"type":67,"tag":194,"props":4699,"children":4701},{"id":4700},"password-reset-defeat-user-enumeration",[4702],{"type":72,"value":4703},"Password Reset: defeat user enumeration",{"type":67,"tag":75,"props":4705,"children":4706},{},[4707],{"type":72,"value":4708},"When a user requests a reset, do not let the response shape or timing reveal whether the email is registered.",{"type":67,"tag":315,"props":4710,"children":4712},{"className":317,"code":4711,"language":319,"meta":320,"style":320},"import { createServerFn } from '@tanstack\u002Freact-start'\nimport { z } from 'zod'\n\nexport const requestPasswordReset = createServerFn({ method: 'POST' })\n  .validator(z.object({ email: z.string().email() }))\n  .handler(async ({ data }) => {\n    const user = await db.users.findByEmail(data.email)\n    if (user) {\n      const token = await db.passwordResets.issue(user.id)\n      await sendResetEmail(user.email, token)\n    }\n    \u002F\u002F Always 200, always the same body, regardless of whether the user exists.\n    \u002F\u002F The user is told to check their inbox; no confirmation either way.\n    return { ok: true }\n  })\n",[4713],{"type":67,"tag":96,"props":4714,"children":4715},{"__ignoreMap":320},[4716,4751,4786,4793,4853,4928,4967,5026,5049,5111,5152,5160,5168,5176,5203],{"type":67,"tag":326,"props":4717,"children":4718},{"class":328,"line":329},[4719,4723,4727,4731,4735,4739,4743,4747],{"type":67,"tag":326,"props":4720,"children":4721},{"style":343},[4722],{"type":72,"value":346},{"type":67,"tag":326,"props":4724,"children":4725},{"style":349},[4726],{"type":72,"value":1520},{"type":67,"tag":326,"props":4728,"children":4729},{"style":359},[4730],{"type":72,"value":1949},{"type":67,"tag":326,"props":4732,"children":4733},{"style":349},[4734],{"type":72,"value":1530},{"type":67,"tag":326,"props":4736,"children":4737},{"style":343},[4738],{"type":72,"value":394},{"type":67,"tag":326,"props":4740,"children":4741},{"style":349},[4742],{"type":72,"value":399},{"type":67,"tag":326,"props":4744,"children":4745},{"style":402},[4746],{"type":72,"value":1543},{"type":67,"tag":326,"props":4748,"children":4749},{"style":349},[4750],{"type":72,"value":410},{"type":67,"tag":326,"props":4752,"children":4753},{"class":328,"line":339},[4754,4758,4762,4766,4770,4774,4778,4782],{"type":67,"tag":326,"props":4755,"children":4756},{"style":343},[4757],{"type":72,"value":346},{"type":67,"tag":326,"props":4759,"children":4760},{"style":349},[4761],{"type":72,"value":1520},{"type":67,"tag":326,"props":4763,"children":4764},{"style":359},[4765],{"type":72,"value":2361},{"type":67,"tag":326,"props":4767,"children":4768},{"style":349},[4769],{"type":72,"value":1530},{"type":67,"tag":326,"props":4771,"children":4772},{"style":343},[4773],{"type":72,"value":394},{"type":67,"tag":326,"props":4775,"children":4776},{"style":349},[4777],{"type":72,"value":399},{"type":67,"tag":326,"props":4779,"children":4780},{"style":402},[4781],{"type":72,"value":2378},{"type":67,"tag":326,"props":4783,"children":4784},{"style":349},[4785],{"type":72,"value":410},{"type":67,"tag":326,"props":4787,"children":4788},{"class":328,"line":355},[4789],{"type":67,"tag":326,"props":4790,"children":4791},{"emptyLinePlaceholder":417},[4792],{"type":72,"value":420},{"type":67,"tag":326,"props":4794,"children":4795},{"class":328,"line":370},[4796,4800,4804,4809,4813,4817,4821,4825,4829,4833,4837,4841,4845,4849],{"type":67,"tag":326,"props":4797,"children":4798},{"style":343},[4799],{"type":72,"value":517},{"type":67,"tag":326,"props":4801,"children":4802},{"style":427},[4803],{"type":72,"value":1602},{"type":67,"tag":326,"props":4805,"children":4806},{"style":359},[4807],{"type":72,"value":4808}," requestPasswordReset ",{"type":67,"tag":326,"props":4810,"children":4811},{"style":349},[4812],{"type":72,"value":440},{"type":67,"tag":326,"props":4814,"children":4815},{"style":525},[4816],{"type":72,"value":1949},{"type":67,"tag":326,"props":4818,"children":4819},{"style":359},[4820],{"type":72,"value":533},{"type":67,"tag":326,"props":4822,"children":4823},{"style":349},[4824],{"type":72,"value":1624},{"type":67,"tag":326,"props":4826,"children":4827},{"style":570},[4828],{"type":72,"value":2050},{"type":67,"tag":326,"props":4830,"children":4831},{"style":349},[4832],{"type":72,"value":544},{"type":67,"tag":326,"props":4834,"children":4835},{"style":349},[4836],{"type":72,"value":399},{"type":67,"tag":326,"props":4838,"children":4839},{"style":402},[4840],{"type":72,"value":2473},{"type":67,"tag":326,"props":4842,"children":4843},{"style":349},[4844],{"type":72,"value":454},{"type":67,"tag":326,"props":4846,"children":4847},{"style":349},[4848],{"type":72,"value":1530},{"type":67,"tag":326,"props":4850,"children":4851},{"style":359},[4852],{"type":72,"value":1046},{"type":67,"tag":326,"props":4854,"children":4855},{"class":328,"line":383},[4856,4860,4864,4868,4872,4876,4880,4884,4888,4892,4896,4900,4904,4908,4912,4916,4920,4924],{"type":67,"tag":326,"props":4857,"children":4858},{"style":349},[4859],{"type":72,"value":2083},{"type":67,"tag":326,"props":4861,"children":4862},{"style":525},[4863],{"type":72,"value":2497},{"type":67,"tag":326,"props":4865,"children":4866},{"style":359},[4867],{"type":72,"value":2502},{"type":67,"tag":326,"props":4869,"children":4870},{"style":349},[4871],{"type":72,"value":120},{"type":67,"tag":326,"props":4873,"children":4874},{"style":525},[4875],{"type":72,"value":2511},{"type":67,"tag":326,"props":4877,"children":4878},{"style":359},[4879],{"type":72,"value":533},{"type":67,"tag":326,"props":4881,"children":4882},{"style":349},[4883],{"type":72,"value":1624},{"type":67,"tag":326,"props":4885,"children":4886},{"style":570},[4887],{"type":72,"value":2524},{"type":67,"tag":326,"props":4889,"children":4890},{"style":349},[4891],{"type":72,"value":544},{"type":67,"tag":326,"props":4893,"children":4894},{"style":359},[4895],{"type":72,"value":2361},{"type":67,"tag":326,"props":4897,"children":4898},{"style":349},[4899],{"type":72,"value":120},{"type":67,"tag":326,"props":4901,"children":4902},{"style":525},[4903],{"type":72,"value":2541},{"type":67,"tag":326,"props":4905,"children":4906},{"style":359},[4907],{"type":72,"value":870},{"type":67,"tag":326,"props":4909,"children":4910},{"style":349},[4911],{"type":72,"value":120},{"type":67,"tag":326,"props":4913,"children":4914},{"style":525},[4915],{"type":72,"value":2554},{"type":67,"tag":326,"props":4917,"children":4918},{"style":359},[4919],{"type":72,"value":2588},{"type":67,"tag":326,"props":4921,"children":4922},{"style":349},[4923],{"type":72,"value":389},{"type":67,"tag":326,"props":4925,"children":4926},{"style":359},[4927],{"type":72,"value":2597},{"type":67,"tag":326,"props":4929,"children":4930},{"class":328,"line":413},[4931,4935,4939,4943,4947,4951,4955,4959,4963],{"type":67,"tag":326,"props":4932,"children":4933},{"style":349},[4934],{"type":72,"value":2083},{"type":67,"tag":326,"props":4936,"children":4937},{"style":525},[4938],{"type":72,"value":2105},{"type":67,"tag":326,"props":4940,"children":4941},{"style":359},[4942],{"type":72,"value":533},{"type":67,"tag":326,"props":4944,"children":4945},{"style":427},[4946],{"type":72,"value":2114},{"type":67,"tag":326,"props":4948,"children":4949},{"style":349},[4950],{"type":72,"value":1680},{"type":67,"tag":326,"props":4952,"children":4953},{"style":536},[4954],{"type":72,"value":2625},{"type":67,"tag":326,"props":4956,"children":4957},{"style":349},[4958],{"type":72,"value":1690},{"type":67,"tag":326,"props":4960,"children":4961},{"style":427},[4962],{"type":72,"value":1695},{"type":67,"tag":326,"props":4964,"children":4965},{"style":349},[4966],{"type":72,"value":352},{"type":67,"tag":326,"props":4968,"children":4969},{"class":328,"line":423},[4970,4974,4978,4982,4986,4990,4994,4998,5002,5006,5010,5014,5018,5022],{"type":67,"tag":326,"props":4971,"children":4972},{"style":427},[4973],{"type":72,"value":1171},{"type":67,"tag":326,"props":4975,"children":4976},{"style":359},[4977],{"type":72,"value":2649},{"type":67,"tag":326,"props":4979,"children":4980},{"style":349},[4981],{"type":72,"value":1019},{"type":67,"tag":326,"props":4983,"children":4984},{"style":343},[4985],{"type":72,"value":1754},{"type":67,"tag":326,"props":4987,"children":4988},{"style":359},[4989],{"type":72,"value":1759},{"type":67,"tag":326,"props":4991,"children":4992},{"style":349},[4993],{"type":72,"value":120},{"type":67,"tag":326,"props":4995,"children":4996},{"style":359},[4997],{"type":72,"value":2670},{"type":67,"tag":326,"props":4999,"children":5000},{"style":349},[5001],{"type":72,"value":120},{"type":67,"tag":326,"props":5003,"children":5004},{"style":525},[5005],{"type":72,"value":2679},{"type":67,"tag":326,"props":5007,"children":5008},{"style":570},[5009],{"type":72,"value":533},{"type":67,"tag":326,"props":5011,"children":5012},{"style":359},[5013],{"type":72,"value":2688},{"type":67,"tag":326,"props":5015,"children":5016},{"style":349},[5017],{"type":72,"value":120},{"type":67,"tag":326,"props":5019,"children":5020},{"style":359},[5021],{"type":72,"value":2554},{"type":67,"tag":326,"props":5023,"children":5024},{"style":570},[5025],{"type":72,"value":1046},{"type":67,"tag":326,"props":5027,"children":5028},{"class":328,"line":462},[5029,5033,5037,5041,5045],{"type":67,"tag":326,"props":5030,"children":5031},{"style":343},[5032],{"type":72,"value":1222},{"type":67,"tag":326,"props":5034,"children":5035},{"style":570},[5036],{"type":72,"value":94},{"type":67,"tag":326,"props":5038,"children":5039},{"style":359},[5040],{"type":72,"value":2976},{"type":67,"tag":326,"props":5042,"children":5043},{"style":570},[5044],{"type":72,"value":1074},{"type":67,"tag":326,"props":5046,"children":5047},{"style":349},[5048],{"type":72,"value":1153},{"type":67,"tag":326,"props":5050,"children":5051},{"class":328,"line":503},[5052,5057,5061,5065,5069,5073,5077,5082,5086,5091,5095,5099,5103,5107],{"type":67,"tag":326,"props":5053,"children":5054},{"style":427},[5055],{"type":72,"value":5056},"      const",{"type":67,"tag":326,"props":5058,"children":5059},{"style":359},[5060],{"type":72,"value":1711},{"type":67,"tag":326,"props":5062,"children":5063},{"style":349},[5064],{"type":72,"value":1019},{"type":67,"tag":326,"props":5066,"children":5067},{"style":343},[5068],{"type":72,"value":1754},{"type":67,"tag":326,"props":5070,"children":5071},{"style":359},[5072],{"type":72,"value":1759},{"type":67,"tag":326,"props":5074,"children":5075},{"style":349},[5076],{"type":72,"value":120},{"type":67,"tag":326,"props":5078,"children":5079},{"style":359},[5080],{"type":72,"value":5081},"passwordResets",{"type":67,"tag":326,"props":5083,"children":5084},{"style":349},[5085],{"type":72,"value":120},{"type":67,"tag":326,"props":5087,"children":5088},{"style":525},[5089],{"type":72,"value":5090},"issue",{"type":67,"tag":326,"props":5092,"children":5093},{"style":570},[5094],{"type":72,"value":533},{"type":67,"tag":326,"props":5096,"children":5097},{"style":359},[5098],{"type":72,"value":2976},{"type":67,"tag":326,"props":5100,"children":5101},{"style":349},[5102],{"type":72,"value":120},{"type":67,"tag":326,"props":5104,"children":5105},{"style":359},[5106],{"type":72,"value":2985},{"type":67,"tag":326,"props":5108,"children":5109},{"style":570},[5110],{"type":72,"value":1046},{"type":67,"tag":326,"props":5112,"children":5113},{"class":328,"line":511},[5114,5119,5124,5128,5132,5136,5140,5144,5148],{"type":67,"tag":326,"props":5115,"children":5116},{"style":343},[5117],{"type":72,"value":5118},"      await",{"type":67,"tag":326,"props":5120,"children":5121},{"style":525},[5122],{"type":72,"value":5123}," sendResetEmail",{"type":67,"tag":326,"props":5125,"children":5126},{"style":570},[5127],{"type":72,"value":533},{"type":67,"tag":326,"props":5129,"children":5130},{"style":359},[5131],{"type":72,"value":2976},{"type":67,"tag":326,"props":5133,"children":5134},{"style":349},[5135],{"type":72,"value":120},{"type":67,"tag":326,"props":5137,"children":5138},{"style":359},[5139],{"type":72,"value":2554},{"type":67,"tag":326,"props":5141,"children":5142},{"style":349},[5143],{"type":72,"value":667},{"type":67,"tag":326,"props":5145,"children":5146},{"style":359},[5147],{"type":72,"value":1711},{"type":67,"tag":326,"props":5149,"children":5150},{"style":570},[5151],{"type":72,"value":1046},{"type":67,"tag":326,"props":5153,"children":5154},{"class":328,"line":562},[5155],{"type":67,"tag":326,"props":5156,"children":5157},{"style":349},[5158],{"type":72,"value":5159},"    }\n",{"type":67,"tag":326,"props":5161,"children":5162},{"class":328,"line":576},[5163],{"type":67,"tag":326,"props":5164,"children":5165},{"style":333},[5166],{"type":72,"value":5167},"    \u002F\u002F Always 200, always the same body, regardless of whether the user exists.\n",{"type":67,"tag":326,"props":5169,"children":5170},{"class":328,"line":598},[5171],{"type":67,"tag":326,"props":5172,"children":5173},{"style":333},[5174],{"type":72,"value":5175},"    \u002F\u002F The user is told to check their inbox; no confirmation either way.\n",{"type":67,"tag":326,"props":5177,"children":5178},{"class":328,"line":607},[5179,5183,5187,5191,5195,5199],{"type":67,"tag":326,"props":5180,"children":5181},{"style":343},[5182],{"type":72,"value":1865},{"type":67,"tag":326,"props":5184,"children":5185},{"style":349},[5186],{"type":72,"value":1520},{"type":67,"tag":326,"props":5188,"children":5189},{"style":570},[5190],{"type":72,"value":2839},{"type":67,"tag":326,"props":5192,"children":5193},{"style":349},[5194],{"type":72,"value":544},{"type":67,"tag":326,"props":5196,"children":5197},{"style":3107},[5198],{"type":72,"value":3110},{"type":67,"tag":326,"props":5200,"children":5201},{"style":349},[5202],{"type":72,"value":3115},{"type":67,"tag":326,"props":5204,"children":5205},{"class":328,"line":647},[5206,5210],{"type":67,"tag":326,"props":5207,"children":5208},{"style":349},[5209],{"type":72,"value":2234},{"type":67,"tag":326,"props":5211,"children":5212},{"style":359},[5213],{"type":72,"value":1046},{"type":67,"tag":75,"props":5215,"children":5216},{},[5217],{"type":72,"value":5218},"Do NOT:",{"type":67,"tag":201,"props":5220,"children":5221},{},[5222,5227,5232],{"type":67,"tag":205,"props":5223,"children":5224},{},[5225],{"type":72,"value":5226},"Return 200 if exists, 404 if not.",{"type":67,"tag":205,"props":5228,"children":5229},{},[5230],{"type":72,"value":5231},"Use a different message (\"we sent you a link\" vs \"no account found\").",{"type":67,"tag":205,"props":5233,"children":5234},{},[5235],{"type":72,"value":5236},"Skip the work when the user doesn't exist (timing leak — measurable from the wire).",{"type":67,"tag":194,"props":5238,"children":5240},{"id":5239},"csrf-for-non-get-rpcs",[5241],{"type":72,"value":5242},"CSRF for non-GET RPCs",{"type":67,"tag":75,"props":5244,"children":5245},{},[5246,5251],{"type":67,"tag":96,"props":5247,"children":5249},{"className":5248},[],[5250],{"type":72,"value":710},{"type":72,"value":5252}," on the session cookie blocks most cross-site CSRF for POST\u002FPUT\u002FDELETE. Two cases need extra defense:",{"type":67,"tag":5254,"props":5255,"children":5256},"ol",{},[5257,5267],{"type":67,"tag":205,"props":5258,"children":5259},{},[5260,5265],{"type":67,"tag":81,"props":5261,"children":5262},{},[5263],{"type":72,"value":5264},"Top-level GET navigation that mutates",{"type":72,"value":5266}," — never do this. Always use POST\u002FPUT\u002FDELETE for mutations.",{"type":67,"tag":205,"props":5268,"children":5269},{},[5270,5275,5277,5282,5284,5290],{"type":67,"tag":81,"props":5271,"children":5272},{},[5273],{"type":72,"value":5274},"POST from a page on a sibling subdomain",{"type":72,"value":5276}," — ",{"type":67,"tag":96,"props":5278,"children":5280},{"className":5279},[],[5281],{"type":72,"value":710},{"type":72,"value":5283}," does NOT block this; verify the ",{"type":67,"tag":96,"props":5285,"children":5287},{"className":5286},[],[5288],{"type":72,"value":5289},"Origin",{"type":72,"value":5291}," header matches your app's origin in middleware.",{"type":67,"tag":315,"props":5293,"children":5295},{"className":317,"code":5294,"language":319,"meta":320,"style":320},"import { createMiddleware } from '@tanstack\u002Freact-start'\nimport { getRequest } from '@tanstack\u002Freact-start\u002Fserver'\n\nexport const csrfMiddleware = createMiddleware().server(async ({ next }) => {\n  const request = getRequest()\n  if (request.method !== 'GET' && request.method !== 'HEAD') {\n    const origin = request.headers.get('origin')\n    \u002F\u002F Compare the FULL origin (scheme + host + port) — host alone lets\n    \u002F\u002F http:\u002F\u002Fexample.com pass a check meant for https:\u002F\u002Fexample.com.\n    if (!origin || new URL(origin).origin !== process.env.APP_ORIGIN) {\n      throw new Error('Origin check failed')\n    }\n  }\n  return next()\n})\n",[5296],{"type":67,"tag":96,"props":5297,"children":5298},{"__ignoreMap":320},[5299,5334,5370,5377,5441,5465,5548,5607,5615,5623,5710,5747,5754,5761,5776],{"type":67,"tag":326,"props":5300,"children":5301},{"class":328,"line":329},[5302,5306,5310,5314,5318,5322,5326,5330],{"type":67,"tag":326,"props":5303,"children":5304},{"style":343},[5305],{"type":72,"value":346},{"type":67,"tag":326,"props":5307,"children":5308},{"style":349},[5309],{"type":72,"value":1520},{"type":67,"tag":326,"props":5311,"children":5312},{"style":359},[5313],{"type":72,"value":1525},{"type":67,"tag":326,"props":5315,"children":5316},{"style":349},[5317],{"type":72,"value":1530},{"type":67,"tag":326,"props":5319,"children":5320},{"style":343},[5321],{"type":72,"value":394},{"type":67,"tag":326,"props":5323,"children":5324},{"style":349},[5325],{"type":72,"value":399},{"type":67,"tag":326,"props":5327,"children":5328},{"style":402},[5329],{"type":72,"value":1543},{"type":67,"tag":326,"props":5331,"children":5332},{"style":349},[5333],{"type":72,"value":410},{"type":67,"tag":326,"props":5335,"children":5336},{"class":328,"line":339},[5337,5341,5345,5350,5354,5358,5362,5366],{"type":67,"tag":326,"props":5338,"children":5339},{"style":343},[5340],{"type":72,"value":346},{"type":67,"tag":326,"props":5342,"children":5343},{"style":349},[5344],{"type":72,"value":1520},{"type":67,"tag":326,"props":5346,"children":5347},{"style":359},[5348],{"type":72,"value":5349}," getRequest",{"type":67,"tag":326,"props":5351,"children":5352},{"style":349},[5353],{"type":72,"value":1530},{"type":67,"tag":326,"props":5355,"children":5356},{"style":343},[5357],{"type":72,"value":394},{"type":67,"tag":326,"props":5359,"children":5360},{"style":349},[5361],{"type":72,"value":399},{"type":67,"tag":326,"props":5363,"children":5364},{"style":402},[5365],{"type":72,"value":405},{"type":67,"tag":326,"props":5367,"children":5368},{"style":349},[5369],{"type":72,"value":410},{"type":67,"tag":326,"props":5371,"children":5372},{"class":328,"line":355},[5373],{"type":67,"tag":326,"props":5374,"children":5375},{"emptyLinePlaceholder":417},[5376],{"type":72,"value":420},{"type":67,"tag":326,"props":5378,"children":5379},{"class":328,"line":370},[5380,5384,5388,5393,5397,5401,5405,5409,5413,5417,5421,5425,5429,5433,5437],{"type":67,"tag":326,"props":5381,"children":5382},{"style":343},[5383],{"type":72,"value":517},{"type":67,"tag":326,"props":5385,"children":5386},{"style":427},[5387],{"type":72,"value":1602},{"type":67,"tag":326,"props":5389,"children":5390},{"style":359},[5391],{"type":72,"value":5392}," csrfMiddleware ",{"type":67,"tag":326,"props":5394,"children":5395},{"style":349},[5396],{"type":72,"value":440},{"type":67,"tag":326,"props":5398,"children":5399},{"style":525},[5400],{"type":72,"value":1525},{"type":67,"tag":326,"props":5402,"children":5403},{"style":359},[5404],{"type":72,"value":870},{"type":67,"tag":326,"props":5406,"children":5407},{"style":349},[5408],{"type":72,"value":120},{"type":67,"tag":326,"props":5410,"children":5411},{"style":525},[5412],{"type":72,"value":1663},{"type":67,"tag":326,"props":5414,"children":5415},{"style":359},[5416],{"type":72,"value":533},{"type":67,"tag":326,"props":5418,"children":5419},{"style":427},[5420],{"type":72,"value":2114},{"type":67,"tag":326,"props":5422,"children":5423},{"style":349},[5424],{"type":72,"value":1680},{"type":67,"tag":326,"props":5426,"children":5427},{"style":536},[5428],{"type":72,"value":1685},{"type":67,"tag":326,"props":5430,"children":5431},{"style":349},[5432],{"type":72,"value":1690},{"type":67,"tag":326,"props":5434,"children":5435},{"style":427},[5436],{"type":72,"value":1695},{"type":67,"tag":326,"props":5438,"children":5439},{"style":349},[5440],{"type":72,"value":352},{"type":67,"tag":326,"props":5442,"children":5443},{"class":328,"line":383},[5444,5448,5453,5457,5461],{"type":67,"tag":326,"props":5445,"children":5446},{"style":427},[5447],{"type":72,"value":1009},{"type":67,"tag":326,"props":5449,"children":5450},{"style":359},[5451],{"type":72,"value":5452}," request",{"type":67,"tag":326,"props":5454,"children":5455},{"style":349},[5456],{"type":72,"value":1019},{"type":67,"tag":326,"props":5458,"children":5459},{"style":525},[5460],{"type":72,"value":5349},{"type":67,"tag":326,"props":5462,"children":5463},{"style":570},[5464],{"type":72,"value":1724},{"type":67,"tag":326,"props":5466,"children":5467},{"class":328,"line":413},[5468,5472,5476,5481,5485,5490,5495,5499,5503,5507,5511,5515,5519,5523,5527,5531,5536,5540,5544],{"type":67,"tag":326,"props":5469,"children":5470},{"style":343},[5471],{"type":72,"value":1055},{"type":67,"tag":326,"props":5473,"children":5474},{"style":570},[5475],{"type":72,"value":94},{"type":67,"tag":326,"props":5477,"children":5478},{"style":359},[5479],{"type":72,"value":5480},"request",{"type":67,"tag":326,"props":5482,"children":5483},{"style":349},[5484],{"type":72,"value":120},{"type":67,"tag":326,"props":5486,"children":5487},{"style":359},[5488],{"type":72,"value":5489},"method",{"type":67,"tag":326,"props":5491,"children":5492},{"style":349},[5493],{"type":72,"value":5494}," !==",{"type":67,"tag":326,"props":5496,"children":5497},{"style":349},[5498],{"type":72,"value":399},{"type":67,"tag":326,"props":5500,"children":5501},{"style":402},[5502],{"type":72,"value":2063},{"type":67,"tag":326,"props":5504,"children":5505},{"style":349},[5506],{"type":72,"value":454},{"type":67,"tag":326,"props":5508,"children":5509},{"style":349},[5510],{"type":72,"value":2861},{"type":67,"tag":326,"props":5512,"children":5513},{"style":359},[5514],{"type":72,"value":5452},{"type":67,"tag":326,"props":5516,"children":5517},{"style":349},[5518],{"type":72,"value":120},{"type":67,"tag":326,"props":5520,"children":5521},{"style":359},[5522],{"type":72,"value":5489},{"type":67,"tag":326,"props":5524,"children":5525},{"style":349},[5526],{"type":72,"value":5494},{"type":67,"tag":326,"props":5528,"children":5529},{"style":349},[5530],{"type":72,"value":399},{"type":67,"tag":326,"props":5532,"children":5533},{"style":402},[5534],{"type":72,"value":5535},"HEAD",{"type":67,"tag":326,"props":5537,"children":5538},{"style":349},[5539],{"type":72,"value":454},{"type":67,"tag":326,"props":5541,"children":5542},{"style":570},[5543],{"type":72,"value":1074},{"type":67,"tag":326,"props":5545,"children":5546},{"style":349},[5547],{"type":72,"value":1153},{"type":67,"tag":326,"props":5549,"children":5550},{"class":328,"line":423},[5551,5555,5560,5564,5568,5572,5577,5581,5586,5590,5594,5599,5603],{"type":67,"tag":326,"props":5552,"children":5553},{"style":427},[5554],{"type":72,"value":1171},{"type":67,"tag":326,"props":5556,"children":5557},{"style":359},[5558],{"type":72,"value":5559}," origin",{"type":67,"tag":326,"props":5561,"children":5562},{"style":349},[5563],{"type":72,"value":1019},{"type":67,"tag":326,"props":5565,"children":5566},{"style":359},[5567],{"type":72,"value":5452},{"type":67,"tag":326,"props":5569,"children":5570},{"style":349},[5571],{"type":72,"value":120},{"type":67,"tag":326,"props":5573,"children":5574},{"style":359},[5575],{"type":72,"value":5576},"headers",{"type":67,"tag":326,"props":5578,"children":5579},{"style":349},[5580],{"type":72,"value":120},{"type":67,"tag":326,"props":5582,"children":5583},{"style":525},[5584],{"type":72,"value":5585},"get",{"type":67,"tag":326,"props":5587,"children":5588},{"style":570},[5589],{"type":72,"value":533},{"type":67,"tag":326,"props":5591,"children":5592},{"style":349},[5593],{"type":72,"value":454},{"type":67,"tag":326,"props":5595,"children":5596},{"style":402},[5597],{"type":72,"value":5598},"origin",{"type":67,"tag":326,"props":5600,"children":5601},{"style":349},[5602],{"type":72,"value":454},{"type":67,"tag":326,"props":5604,"children":5605},{"style":570},[5606],{"type":72,"value":1046},{"type":67,"tag":326,"props":5608,"children":5609},{"class":328,"line":462},[5610],{"type":67,"tag":326,"props":5611,"children":5612},{"style":333},[5613],{"type":72,"value":5614},"    \u002F\u002F Compare the FULL origin (scheme + host + port) — host alone lets\n",{"type":67,"tag":326,"props":5616,"children":5617},{"class":328,"line":503},[5618],{"type":67,"tag":326,"props":5619,"children":5620},{"style":333},[5621],{"type":72,"value":5622},"    \u002F\u002F http:\u002F\u002Fexample.com pass a check meant for https:\u002F\u002Fexample.com.\n",{"type":67,"tag":326,"props":5624,"children":5625},{"class":328,"line":511},[5626,5630,5634,5638,5642,5647,5651,5656,5660,5664,5668,5672,5676,5680,5685,5689,5693,5697,5702,5706],{"type":67,"tag":326,"props":5627,"children":5628},{"style":343},[5629],{"type":72,"value":1222},{"type":67,"tag":326,"props":5631,"children":5632},{"style":570},[5633],{"type":72,"value":94},{"type":67,"tag":326,"props":5635,"children":5636},{"style":349},[5637],{"type":72,"value":1064},{"type":67,"tag":326,"props":5639,"children":5640},{"style":359},[5641],{"type":72,"value":5598},{"type":67,"tag":326,"props":5643,"children":5644},{"style":349},[5645],{"type":72,"value":5646}," ||",{"type":67,"tag":326,"props":5648,"children":5649},{"style":349},[5650],{"type":72,"value":1831},{"type":67,"tag":326,"props":5652,"children":5653},{"style":525},[5654],{"type":72,"value":5655}," URL",{"type":67,"tag":326,"props":5657,"children":5658},{"style":570},[5659],{"type":72,"value":533},{"type":67,"tag":326,"props":5661,"children":5662},{"style":359},[5663],{"type":72,"value":5598},{"type":67,"tag":326,"props":5665,"children":5666},{"style":570},[5667],{"type":72,"value":555},{"type":67,"tag":326,"props":5669,"children":5670},{"style":349},[5671],{"type":72,"value":120},{"type":67,"tag":326,"props":5673,"children":5674},{"style":359},[5675],{"type":72,"value":5598},{"type":67,"tag":326,"props":5677,"children":5678},{"style":349},[5679],{"type":72,"value":5494},{"type":67,"tag":326,"props":5681,"children":5682},{"style":359},[5683],{"type":72,"value":5684}," process",{"type":67,"tag":326,"props":5686,"children":5687},{"style":349},[5688],{"type":72,"value":120},{"type":67,"tag":326,"props":5690,"children":5691},{"style":359},[5692],{"type":72,"value":4496},{"type":67,"tag":326,"props":5694,"children":5695},{"style":349},[5696],{"type":72,"value":120},{"type":67,"tag":326,"props":5698,"children":5699},{"style":359},[5700],{"type":72,"value":5701},"APP_ORIGIN",{"type":67,"tag":326,"props":5703,"children":5704},{"style":570},[5705],{"type":72,"value":1074},{"type":67,"tag":326,"props":5707,"children":5708},{"style":349},[5709],{"type":72,"value":1153},{"type":67,"tag":326,"props":5711,"children":5712},{"class":328,"line":562},[5713,5718,5722,5726,5730,5734,5739,5743],{"type":67,"tag":326,"props":5714,"children":5715},{"style":343},[5716],{"type":72,"value":5717},"      throw",{"type":67,"tag":326,"props":5719,"children":5720},{"style":349},[5721],{"type":72,"value":1831},{"type":67,"tag":326,"props":5723,"children":5724},{"style":525},[5725],{"type":72,"value":1836},{"type":67,"tag":326,"props":5727,"children":5728},{"style":570},[5729],{"type":72,"value":533},{"type":67,"tag":326,"props":5731,"children":5732},{"style":349},[5733],{"type":72,"value":454},{"type":67,"tag":326,"props":5735,"children":5736},{"style":402},[5737],{"type":72,"value":5738},"Origin check failed",{"type":67,"tag":326,"props":5740,"children":5741},{"style":349},[5742],{"type":72,"value":454},{"type":67,"tag":326,"props":5744,"children":5745},{"style":570},[5746],{"type":72,"value":1046},{"type":67,"tag":326,"props":5748,"children":5749},{"class":328,"line":576},[5750],{"type":67,"tag":326,"props":5751,"children":5752},{"style":349},[5753],{"type":72,"value":5159},{"type":67,"tag":326,"props":5755,"children":5756},{"class":328,"line":598},[5757],{"type":67,"tag":326,"props":5758,"children":5759},{"style":349},[5760],{"type":72,"value":1363},{"type":67,"tag":326,"props":5762,"children":5763},{"class":328,"line":607},[5764,5768,5772],{"type":67,"tag":326,"props":5765,"children":5766},{"style":343},[5767],{"type":72,"value":1372},{"type":67,"tag":326,"props":5769,"children":5770},{"style":525},[5771],{"type":72,"value":1685},{"type":67,"tag":326,"props":5773,"children":5774},{"style":570},[5775],{"type":72,"value":1724},{"type":67,"tag":326,"props":5777,"children":5778},{"class":328,"line":647},[5779,5783],{"type":67,"tag":326,"props":5780,"children":5781},{"style":349},[5782],{"type":72,"value":389},{"type":67,"tag":326,"props":5784,"children":5785},{"style":359},[5786],{"type":72,"value":1046},{"type":67,"tag":75,"props":5788,"children":5789},{},[5790,5792,5798],{"type":72,"value":5791},"Attach this to global request middleware in ",{"type":67,"tag":96,"props":5793,"children":5795},{"className":5794},[],[5796],{"type":72,"value":5797},"src\u002Fstart.ts",{"type":72,"value":5799}," so it covers every non-GET request, including server routes and SSR.",{"type":67,"tag":194,"props":5801,"children":5803},{"id":5802},"rate-limiting-auth-endpoints",[5804],{"type":72,"value":5805},"Rate Limiting Auth Endpoints",{"type":67,"tag":75,"props":5807,"children":5808},{},[5809],{"type":72,"value":5810},"A login endpoint without rate limiting is a credential-stuffing target. Limit per-IP (and ideally per-account) with a sliding window.",{"type":67,"tag":315,"props":5812,"children":5814},{"className":317,"code":5813,"language":319,"meta":320,"style":320},"import { createMiddleware } from '@tanstack\u002Freact-start'\nimport { getRequest } from '@tanstack\u002Freact-start\u002Fserver'\n\nfunction rateLimitMiddleware(opts: {\n  key: string\n  max: number\n  windowMs: number\n}) {\n  return createMiddleware().server(async ({ next }) => {\n    const request = getRequest()\n    const ip =\n      request.headers.get('cf-connecting-ip') ??\n      request.headers.get('x-forwarded-for')?.split(',')[0] ??\n      'unknown'\n    const bucketKey = `rl:${opts.key}:${ip}`\n    const allowed = await rateLimiter.consume(\n      bucketKey,\n      opts.max,\n      opts.windowMs,\n    )\n    if (!allowed) throw new Error('Too many requests')\n    return next()\n  })\n}\n\n\u002F\u002F On the login server function:\nexport const login = createServerFn({ method: 'POST' }).middleware([\n  rateLimitMiddleware({ key: 'login', max: 5, windowMs: 60_000 }),\n])\n\u002F\u002F ...\n",[5815],{"type":67,"tag":96,"props":5816,"children":5817},{"__ignoreMap":320},[5818,5853,5888,5895,5924,5941,5958,5974,5986,6037,6060,6077,6127,6213,6229,6294,6332,6344,6365,6385,6392,6449,6464,6475,6482,6489,6497,6569,6655,6663],{"type":67,"tag":326,"props":5819,"children":5820},{"class":328,"line":329},[5821,5825,5829,5833,5837,5841,5845,5849],{"type":67,"tag":326,"props":5822,"children":5823},{"style":343},[5824],{"type":72,"value":346},{"type":67,"tag":326,"props":5826,"children":5827},{"style":349},[5828],{"type":72,"value":1520},{"type":67,"tag":326,"props":5830,"children":5831},{"style":359},[5832],{"type":72,"value":1525},{"type":67,"tag":326,"props":5834,"children":5835},{"style":349},[5836],{"type":72,"value":1530},{"type":67,"tag":326,"props":5838,"children":5839},{"style":343},[5840],{"type":72,"value":394},{"type":67,"tag":326,"props":5842,"children":5843},{"style":349},[5844],{"type":72,"value":399},{"type":67,"tag":326,"props":5846,"children":5847},{"style":402},[5848],{"type":72,"value":1543},{"type":67,"tag":326,"props":5850,"children":5851},{"style":349},[5852],{"type":72,"value":410},{"type":67,"tag":326,"props":5854,"children":5855},{"class":328,"line":339},[5856,5860,5864,5868,5872,5876,5880,5884],{"type":67,"tag":326,"props":5857,"children":5858},{"style":343},[5859],{"type":72,"value":346},{"type":67,"tag":326,"props":5861,"children":5862},{"style":349},[5863],{"type":72,"value":1520},{"type":67,"tag":326,"props":5865,"children":5866},{"style":359},[5867],{"type":72,"value":5349},{"type":67,"tag":326,"props":5869,"children":5870},{"style":349},[5871],{"type":72,"value":1530},{"type":67,"tag":326,"props":5873,"children":5874},{"style":343},[5875],{"type":72,"value":394},{"type":67,"tag":326,"props":5877,"children":5878},{"style":349},[5879],{"type":72,"value":399},{"type":67,"tag":326,"props":5881,"children":5882},{"style":402},[5883],{"type":72,"value":405},{"type":67,"tag":326,"props":5885,"children":5886},{"style":349},[5887],{"type":72,"value":410},{"type":67,"tag":326,"props":5889,"children":5890},{"class":328,"line":355},[5891],{"type":67,"tag":326,"props":5892,"children":5893},{"emptyLinePlaceholder":417},[5894],{"type":72,"value":420},{"type":67,"tag":326,"props":5896,"children":5897},{"class":328,"line":370},[5898,5902,5907,5911,5916,5920],{"type":67,"tag":326,"props":5899,"children":5900},{"style":427},[5901],{"type":72,"value":1642},{"type":67,"tag":326,"props":5903,"children":5904},{"style":525},[5905],{"type":72,"value":5906}," rateLimitMiddleware",{"type":67,"tag":326,"props":5908,"children":5909},{"style":349},[5910],{"type":72,"value":533},{"type":67,"tag":326,"props":5912,"children":5913},{"style":536},[5914],{"type":72,"value":5915},"opts",{"type":67,"tag":326,"props":5917,"children":5918},{"style":349},[5919],{"type":72,"value":544},{"type":67,"tag":326,"props":5921,"children":5922},{"style":349},[5923],{"type":72,"value":352},{"type":67,"tag":326,"props":5925,"children":5926},{"class":328,"line":383},[5927,5932,5936],{"type":67,"tag":326,"props":5928,"children":5929},{"style":570},[5930],{"type":72,"value":5931},"  key",{"type":67,"tag":326,"props":5933,"children":5934},{"style":349},[5935],{"type":72,"value":544},{"type":67,"tag":326,"props":5937,"children":5938},{"style":547},[5939],{"type":72,"value":5940}," string\n",{"type":67,"tag":326,"props":5942,"children":5943},{"class":328,"line":413},[5944,5949,5953],{"type":67,"tag":326,"props":5945,"children":5946},{"style":570},[5947],{"type":72,"value":5948},"  max",{"type":67,"tag":326,"props":5950,"children":5951},{"style":349},[5952],{"type":72,"value":544},{"type":67,"tag":326,"props":5954,"children":5955},{"style":547},[5956],{"type":72,"value":5957}," number\n",{"type":67,"tag":326,"props":5959,"children":5960},{"class":328,"line":423},[5961,5966,5970],{"type":67,"tag":326,"props":5962,"children":5963},{"style":570},[5964],{"type":72,"value":5965},"  windowMs",{"type":67,"tag":326,"props":5967,"children":5968},{"style":349},[5969],{"type":72,"value":544},{"type":67,"tag":326,"props":5971,"children":5972},{"style":547},[5973],{"type":72,"value":5957},{"type":67,"tag":326,"props":5975,"children":5976},{"class":328,"line":462},[5977,5982],{"type":67,"tag":326,"props":5978,"children":5979},{"style":349},[5980],{"type":72,"value":5981},"})",{"type":67,"tag":326,"props":5983,"children":5984},{"style":349},[5985],{"type":72,"value":352},{"type":67,"tag":326,"props":5987,"children":5988},{"class":328,"line":503},[5989,5993,5997,6001,6005,6009,6013,6017,6021,6025,6029,6033],{"type":67,"tag":326,"props":5990,"children":5991},{"style":343},[5992],{"type":72,"value":1372},{"type":67,"tag":326,"props":5994,"children":5995},{"style":525},[5996],{"type":72,"value":1525},{"type":67,"tag":326,"props":5998,"children":5999},{"style":570},[6000],{"type":72,"value":870},{"type":67,"tag":326,"props":6002,"children":6003},{"style":349},[6004],{"type":72,"value":120},{"type":67,"tag":326,"props":6006,"children":6007},{"style":525},[6008],{"type":72,"value":1663},{"type":67,"tag":326,"props":6010,"children":6011},{"style":570},[6012],{"type":72,"value":533},{"type":67,"tag":326,"props":6014,"children":6015},{"style":427},[6016],{"type":72,"value":2114},{"type":67,"tag":326,"props":6018,"children":6019},{"style":349},[6020],{"type":72,"value":1680},{"type":67,"tag":326,"props":6022,"children":6023},{"style":536},[6024],{"type":72,"value":1685},{"type":67,"tag":326,"props":6026,"children":6027},{"style":349},[6028],{"type":72,"value":1690},{"type":67,"tag":326,"props":6030,"children":6031},{"style":427},[6032],{"type":72,"value":1695},{"type":67,"tag":326,"props":6034,"children":6035},{"style":349},[6036],{"type":72,"value":352},{"type":67,"tag":326,"props":6038,"children":6039},{"class":328,"line":511},[6040,6044,6048,6052,6056],{"type":67,"tag":326,"props":6041,"children":6042},{"style":427},[6043],{"type":72,"value":1171},{"type":67,"tag":326,"props":6045,"children":6046},{"style":359},[6047],{"type":72,"value":5452},{"type":67,"tag":326,"props":6049,"children":6050},{"style":349},[6051],{"type":72,"value":1019},{"type":67,"tag":326,"props":6053,"children":6054},{"style":525},[6055],{"type":72,"value":5349},{"type":67,"tag":326,"props":6057,"children":6058},{"style":570},[6059],{"type":72,"value":1724},{"type":67,"tag":326,"props":6061,"children":6062},{"class":328,"line":562},[6063,6067,6072],{"type":67,"tag":326,"props":6064,"children":6065},{"style":427},[6066],{"type":72,"value":1171},{"type":67,"tag":326,"props":6068,"children":6069},{"style":359},[6070],{"type":72,"value":6071}," ip",{"type":67,"tag":326,"props":6073,"children":6074},{"style":349},[6075],{"type":72,"value":6076}," =\n",{"type":67,"tag":326,"props":6078,"children":6079},{"class":328,"line":576},[6080,6085,6089,6093,6097,6101,6105,6109,6114,6118,6122],{"type":67,"tag":326,"props":6081,"children":6082},{"style":359},[6083],{"type":72,"value":6084},"      request",{"type":67,"tag":326,"props":6086,"children":6087},{"style":349},[6088],{"type":72,"value":120},{"type":67,"tag":326,"props":6090,"children":6091},{"style":359},[6092],{"type":72,"value":5576},{"type":67,"tag":326,"props":6094,"children":6095},{"style":349},[6096],{"type":72,"value":120},{"type":67,"tag":326,"props":6098,"children":6099},{"style":525},[6100],{"type":72,"value":5585},{"type":67,"tag":326,"props":6102,"children":6103},{"style":570},[6104],{"type":72,"value":533},{"type":67,"tag":326,"props":6106,"children":6107},{"style":349},[6108],{"type":72,"value":454},{"type":67,"tag":326,"props":6110,"children":6111},{"style":402},[6112],{"type":72,"value":6113},"cf-connecting-ip",{"type":67,"tag":326,"props":6115,"children":6116},{"style":349},[6117],{"type":72,"value":454},{"type":67,"tag":326,"props":6119,"children":6120},{"style":570},[6121],{"type":72,"value":1074},{"type":67,"tag":326,"props":6123,"children":6124},{"style":349},[6125],{"type":72,"value":6126},"??\n",{"type":67,"tag":326,"props":6128,"children":6129},{"class":328,"line":598},[6130,6134,6138,6142,6146,6150,6154,6158,6163,6167,6171,6175,6179,6183,6187,6191,6195,6200,6204,6209],{"type":67,"tag":326,"props":6131,"children":6132},{"style":359},[6133],{"type":72,"value":6084},{"type":67,"tag":326,"props":6135,"children":6136},{"style":349},[6137],{"type":72,"value":120},{"type":67,"tag":326,"props":6139,"children":6140},{"style":359},[6141],{"type":72,"value":5576},{"type":67,"tag":326,"props":6143,"children":6144},{"style":349},[6145],{"type":72,"value":120},{"type":67,"tag":326,"props":6147,"children":6148},{"style":525},[6149],{"type":72,"value":5585},{"type":67,"tag":326,"props":6151,"children":6152},{"style":570},[6153],{"type":72,"value":533},{"type":67,"tag":326,"props":6155,"children":6156},{"style":349},[6157],{"type":72,"value":454},{"type":67,"tag":326,"props":6159,"children":6160},{"style":402},[6161],{"type":72,"value":6162},"x-forwarded-for",{"type":67,"tag":326,"props":6164,"children":6165},{"style":349},[6166],{"type":72,"value":454},{"type":67,"tag":326,"props":6168,"children":6169},{"style":570},[6170],{"type":72,"value":555},{"type":67,"tag":326,"props":6172,"children":6173},{"style":349},[6174],{"type":72,"value":2757},{"type":67,"tag":326,"props":6176,"children":6177},{"style":525},[6178],{"type":72,"value":1124},{"type":67,"tag":326,"props":6180,"children":6181},{"style":570},[6182],{"type":72,"value":533},{"type":67,"tag":326,"props":6184,"children":6185},{"style":349},[6186],{"type":72,"value":454},{"type":67,"tag":326,"props":6188,"children":6189},{"style":402},[6190],{"type":72,"value":667},{"type":67,"tag":326,"props":6192,"children":6193},{"style":349},[6194],{"type":72,"value":454},{"type":67,"tag":326,"props":6196,"children":6197},{"style":570},[6198],{"type":72,"value":6199},")[",{"type":67,"tag":326,"props":6201,"children":6202},{"style":479},[6203],{"type":72,"value":1290},{"type":67,"tag":326,"props":6205,"children":6206},{"style":570},[6207],{"type":72,"value":6208},"] ",{"type":67,"tag":326,"props":6210,"children":6211},{"style":349},[6212],{"type":72,"value":6126},{"type":67,"tag":326,"props":6214,"children":6215},{"class":328,"line":607},[6216,6220,6225],{"type":67,"tag":326,"props":6217,"children":6218},{"style":349},[6219],{"type":72,"value":4290},{"type":67,"tag":326,"props":6221,"children":6222},{"style":402},[6223],{"type":72,"value":6224},"unknown",{"type":67,"tag":326,"props":6226,"children":6227},{"style":349},[6228],{"type":72,"value":410},{"type":67,"tag":326,"props":6230,"children":6231},{"class":328,"line":647},[6232,6236,6241,6245,6250,6255,6259,6263,6267,6272,6276,6280,6284,6289],{"type":67,"tag":326,"props":6233,"children":6234},{"style":427},[6235],{"type":72,"value":1171},{"type":67,"tag":326,"props":6237,"children":6238},{"style":359},[6239],{"type":72,"value":6240}," bucketKey",{"type":67,"tag":326,"props":6242,"children":6243},{"style":349},[6244],{"type":72,"value":1019},{"type":67,"tag":326,"props":6246,"children":6247},{"style":349},[6248],{"type":72,"value":6249}," `",{"type":67,"tag":326,"props":6251,"children":6252},{"style":402},[6253],{"type":72,"value":6254},"rl:",{"type":67,"tag":326,"props":6256,"children":6257},{"style":349},[6258],{"type":72,"value":631},{"type":67,"tag":326,"props":6260,"children":6261},{"style":359},[6262],{"type":72,"value":5915},{"type":67,"tag":326,"props":6264,"children":6265},{"style":349},[6266],{"type":72,"value":120},{"type":67,"tag":326,"props":6268,"children":6269},{"style":359},[6270],{"type":72,"value":6271},"key",{"type":67,"tag":326,"props":6273,"children":6274},{"style":349},[6275],{"type":72,"value":389},{"type":67,"tag":326,"props":6277,"children":6278},{"style":402},[6279],{"type":72,"value":544},{"type":67,"tag":326,"props":6281,"children":6282},{"style":349},[6283],{"type":72,"value":631},{"type":67,"tag":326,"props":6285,"children":6286},{"style":359},[6287],{"type":72,"value":6288},"ip",{"type":67,"tag":326,"props":6290,"children":6291},{"style":349},[6292],{"type":72,"value":6293},"}`\n",{"type":67,"tag":326,"props":6295,"children":6296},{"class":328,"line":675},[6297,6301,6306,6310,6314,6319,6323,6328],{"type":67,"tag":326,"props":6298,"children":6299},{"style":427},[6300],{"type":72,"value":1171},{"type":67,"tag":326,"props":6302,"children":6303},{"style":359},[6304],{"type":72,"value":6305}," allowed",{"type":67,"tag":326,"props":6307,"children":6308},{"style":349},[6309],{"type":72,"value":1019},{"type":67,"tag":326,"props":6311,"children":6312},{"style":343},[6313],{"type":72,"value":1754},{"type":67,"tag":326,"props":6315,"children":6316},{"style":359},[6317],{"type":72,"value":6318}," rateLimiter",{"type":67,"tag":326,"props":6320,"children":6321},{"style":349},[6322],{"type":72,"value":120},{"type":67,"tag":326,"props":6324,"children":6325},{"style":525},[6326],{"type":72,"value":6327},"consume",{"type":67,"tag":326,"props":6329,"children":6330},{"style":570},[6331],{"type":72,"value":573},{"type":67,"tag":326,"props":6333,"children":6334},{"class":328,"line":700},[6335,6340],{"type":67,"tag":326,"props":6336,"children":6337},{"style":359},[6338],{"type":72,"value":6339},"      bucketKey",{"type":67,"tag":326,"props":6341,"children":6342},{"style":349},[6343],{"type":72,"value":367},{"type":67,"tag":326,"props":6345,"children":6346},{"class":328,"line":726},[6347,6352,6356,6361],{"type":67,"tag":326,"props":6348,"children":6349},{"style":359},[6350],{"type":72,"value":6351},"      opts",{"type":67,"tag":326,"props":6353,"children":6354},{"style":349},[6355],{"type":72,"value":120},{"type":67,"tag":326,"props":6357,"children":6358},{"style":359},[6359],{"type":72,"value":6360},"max",{"type":67,"tag":326,"props":6362,"children":6363},{"style":349},[6364],{"type":72,"value":367},{"type":67,"tag":326,"props":6366,"children":6367},{"class":328,"line":752},[6368,6372,6376,6381],{"type":67,"tag":326,"props":6369,"children":6370},{"style":359},[6371],{"type":72,"value":6351},{"type":67,"tag":326,"props":6373,"children":6374},{"style":349},[6375],{"type":72,"value":120},{"type":67,"tag":326,"props":6377,"children":6378},{"style":359},[6379],{"type":72,"value":6380},"windowMs",{"type":67,"tag":326,"props":6382,"children":6383},{"style":349},[6384],{"type":72,"value":367},{"type":67,"tag":326,"props":6386,"children":6387},{"class":328,"line":782},[6388],{"type":67,"tag":326,"props":6389,"children":6390},{"style":570},[6391],{"type":72,"value":4263},{"type":67,"tag":326,"props":6393,"children":6394},{"class":328,"line":825},[6395,6399,6403,6407,6412,6416,6420,6424,6428,6432,6436,6441,6445],{"type":67,"tag":326,"props":6396,"children":6397},{"style":343},[6398],{"type":72,"value":1222},{"type":67,"tag":326,"props":6400,"children":6401},{"style":570},[6402],{"type":72,"value":94},{"type":67,"tag":326,"props":6404,"children":6405},{"style":349},[6406],{"type":72,"value":1064},{"type":67,"tag":326,"props":6408,"children":6409},{"style":359},[6410],{"type":72,"value":6411},"allowed",{"type":67,"tag":326,"props":6413,"children":6414},{"style":570},[6415],{"type":72,"value":1074},{"type":67,"tag":326,"props":6417,"children":6418},{"style":343},[6419],{"type":72,"value":1826},{"type":67,"tag":326,"props":6421,"children":6422},{"style":349},[6423],{"type":72,"value":1831},{"type":67,"tag":326,"props":6425,"children":6426},{"style":525},[6427],{"type":72,"value":1836},{"type":67,"tag":326,"props":6429,"children":6430},{"style":570},[6431],{"type":72,"value":533},{"type":67,"tag":326,"props":6433,"children":6434},{"style":349},[6435],{"type":72,"value":454},{"type":67,"tag":326,"props":6437,"children":6438},{"style":402},[6439],{"type":72,"value":6440},"Too many requests",{"type":67,"tag":326,"props":6442,"children":6443},{"style":349},[6444],{"type":72,"value":454},{"type":67,"tag":326,"props":6446,"children":6447},{"style":570},[6448],{"type":72,"value":1046},{"type":67,"tag":326,"props":6450,"children":6451},{"class":328,"line":834},[6452,6456,6460],{"type":67,"tag":326,"props":6453,"children":6454},{"style":343},[6455],{"type":72,"value":1865},{"type":67,"tag":326,"props":6457,"children":6458},{"style":525},[6459],{"type":72,"value":1685},{"type":67,"tag":326,"props":6461,"children":6462},{"style":570},[6463],{"type":72,"value":1724},{"type":67,"tag":326,"props":6465,"children":6466},{"class":328,"line":843},[6467,6471],{"type":67,"tag":326,"props":6468,"children":6469},{"style":349},[6470],{"type":72,"value":2234},{"type":67,"tag":326,"props":6472,"children":6473},{"style":570},[6474],{"type":72,"value":1046},{"type":67,"tag":326,"props":6476,"children":6477},{"class":328,"line":851},[6478],{"type":67,"tag":326,"props":6479,"children":6480},{"style":349},[6481],{"type":72,"value":840},{"type":67,"tag":326,"props":6483,"children":6484},{"class":328,"line":877},[6485],{"type":67,"tag":326,"props":6486,"children":6487},{"emptyLinePlaceholder":417},[6488],{"type":72,"value":420},{"type":67,"tag":326,"props":6490,"children":6491},{"class":328,"line":889},[6492],{"type":67,"tag":326,"props":6493,"children":6494},{"style":333},[6495],{"type":72,"value":6496},"\u002F\u002F On the login server function:\n",{"type":67,"tag":326,"props":6498,"children":6499},{"class":328,"line":909},[6500,6504,6508,6512,6516,6520,6524,6528,6532,6536,6540,6544,6548,6552,6556,6560,6564],{"type":67,"tag":326,"props":6501,"children":6502},{"style":343},[6503],{"type":72,"value":517},{"type":67,"tag":326,"props":6505,"children":6506},{"style":427},[6507],{"type":72,"value":1602},{"type":67,"tag":326,"props":6509,"children":6510},{"style":359},[6511],{"type":72,"value":2440},{"type":67,"tag":326,"props":6513,"children":6514},{"style":349},[6515],{"type":72,"value":440},{"type":67,"tag":326,"props":6517,"children":6518},{"style":525},[6519],{"type":72,"value":1949},{"type":67,"tag":326,"props":6521,"children":6522},{"style":359},[6523],{"type":72,"value":533},{"type":67,"tag":326,"props":6525,"children":6526},{"style":349},[6527],{"type":72,"value":1624},{"type":67,"tag":326,"props":6529,"children":6530},{"style":570},[6531],{"type":72,"value":2050},{"type":67,"tag":326,"props":6533,"children":6534},{"style":349},[6535],{"type":72,"value":544},{"type":67,"tag":326,"props":6537,"children":6538},{"style":349},[6539],{"type":72,"value":399},{"type":67,"tag":326,"props":6541,"children":6542},{"style":402},[6543],{"type":72,"value":2473},{"type":67,"tag":326,"props":6545,"children":6546},{"style":349},[6547],{"type":72,"value":454},{"type":67,"tag":326,"props":6549,"children":6550},{"style":349},[6551],{"type":72,"value":1530},{"type":67,"tag":326,"props":6553,"children":6554},{"style":359},[6555],{"type":72,"value":555},{"type":67,"tag":326,"props":6557,"children":6558},{"style":349},[6559],{"type":72,"value":120},{"type":67,"tag":326,"props":6561,"children":6562},{"style":525},[6563],{"type":72,"value":2088},{"type":67,"tag":326,"props":6565,"children":6566},{"style":359},[6567],{"type":72,"value":6568},"([\n",{"type":67,"tag":326,"props":6570,"children":6571},{"class":328,"line":939},[6572,6577,6581,6585,6590,6594,6598,6603,6607,6611,6616,6620,6625,6629,6634,6638,6643,6647,6651],{"type":67,"tag":326,"props":6573,"children":6574},{"style":525},[6575],{"type":72,"value":6576},"  rateLimitMiddleware",{"type":67,"tag":326,"props":6578,"children":6579},{"style":359},[6580],{"type":72,"value":533},{"type":67,"tag":326,"props":6582,"children":6583},{"style":349},[6584],{"type":72,"value":1624},{"type":67,"tag":326,"props":6586,"children":6587},{"style":570},[6588],{"type":72,"value":6589}," key",{"type":67,"tag":326,"props":6591,"children":6592},{"style":349},[6593],{"type":72,"value":544},{"type":67,"tag":326,"props":6595,"children":6596},{"style":349},[6597],{"type":72,"value":399},{"type":67,"tag":326,"props":6599,"children":6600},{"style":402},[6601],{"type":72,"value":6602},"login",{"type":67,"tag":326,"props":6604,"children":6605},{"style":349},[6606],{"type":72,"value":454},{"type":67,"tag":326,"props":6608,"children":6609},{"style":349},[6610],{"type":72,"value":667},{"type":67,"tag":326,"props":6612,"children":6613},{"style":570},[6614],{"type":72,"value":6615}," max",{"type":67,"tag":326,"props":6617,"children":6618},{"style":349},[6619],{"type":72,"value":544},{"type":67,"tag":326,"props":6621,"children":6622},{"style":479},[6623],{"type":72,"value":6624}," 5",{"type":67,"tag":326,"props":6626,"children":6627},{"style":349},[6628],{"type":72,"value":667},{"type":67,"tag":326,"props":6630,"children":6631},{"style":570},[6632],{"type":72,"value":6633}," windowMs",{"type":67,"tag":326,"props":6635,"children":6636},{"style":349},[6637],{"type":72,"value":544},{"type":67,"tag":326,"props":6639,"children":6640},{"style":479},[6641],{"type":72,"value":6642}," 60_000",{"type":67,"tag":326,"props":6644,"children":6645},{"style":349},[6646],{"type":72,"value":1530},{"type":67,"tag":326,"props":6648,"children":6649},{"style":359},[6650],{"type":72,"value":555},{"type":67,"tag":326,"props":6652,"children":6653},{"style":349},[6654],{"type":72,"value":367},{"type":67,"tag":326,"props":6656,"children":6657},{"class":328,"line":947},[6658],{"type":67,"tag":326,"props":6659,"children":6660},{"style":359},[6661],{"type":72,"value":6662},"])\n",{"type":67,"tag":326,"props":6664,"children":6665},{"class":328,"line":955},[6666],{"type":67,"tag":326,"props":6667,"children":6668},{"style":333},[6669],{"type":72,"value":6670},"\u002F\u002F ...\n",{"type":67,"tag":194,"props":6672,"children":6674},{"id":6673},"session-rotation-on-privilege-change",[6675],{"type":72,"value":6676},"Session Rotation on Privilege Change",{"type":67,"tag":75,"props":6678,"children":6679},{},[6680,6682,6687],{"type":72,"value":6681},"Whenever the user's privileges change — login, logout, role change, password change — ",{"type":67,"tag":81,"props":6683,"children":6684},{},[6685],{"type":72,"value":6686},"destroy the old session and issue a new one",{"type":72,"value":6688},". This neutralizes session-fixation attacks where an attacker plants their own session ID in the victim's browser before login.",{"type":67,"tag":315,"props":6690,"children":6692},{"className":317,"code":6691,"language":319,"meta":320,"style":320},"\u002F\u002F In the login handler (already shown above): destroy any pre-login session, then create a fresh one.\nawait db.sessions.revokeAllForUser(user.id)\nconst token = await db.sessions.create({ userId: user.id })\nsetSessionCookie(token)\n",[6693],{"type":67,"tag":96,"props":6694,"children":6695},{"__ignoreMap":320},[6696,6704,6746,6823],{"type":67,"tag":326,"props":6697,"children":6698},{"class":328,"line":329},[6699],{"type":67,"tag":326,"props":6700,"children":6701},{"style":333},[6702],{"type":72,"value":6703},"\u002F\u002F In the login handler (already shown above): destroy any pre-login session, then create a fresh one.\n",{"type":67,"tag":326,"props":6705,"children":6706},{"class":328,"line":339},[6707,6712,6716,6720,6724,6728,6732,6737,6741],{"type":67,"tag":326,"props":6708,"children":6709},{"style":343},[6710],{"type":72,"value":6711},"await",{"type":67,"tag":326,"props":6713,"children":6714},{"style":359},[6715],{"type":72,"value":1759},{"type":67,"tag":326,"props":6717,"children":6718},{"style":349},[6719],{"type":72,"value":120},{"type":67,"tag":326,"props":6721,"children":6722},{"style":359},[6723],{"type":72,"value":1768},{"type":67,"tag":326,"props":6725,"children":6726},{"style":349},[6727],{"type":72,"value":120},{"type":67,"tag":326,"props":6729,"children":6730},{"style":525},[6731],{"type":72,"value":2967},{"type":67,"tag":326,"props":6733,"children":6734},{"style":359},[6735],{"type":72,"value":6736},"(user",{"type":67,"tag":326,"props":6738,"children":6739},{"style":349},[6740],{"type":72,"value":120},{"type":67,"tag":326,"props":6742,"children":6743},{"style":359},[6744],{"type":72,"value":6745},"id)\n",{"type":67,"tag":326,"props":6747,"children":6748},{"class":328,"line":355},[6749,6753,6758,6762,6766,6770,6774,6778,6782,6786,6790,6794,6798,6802,6806,6810,6815,6819],{"type":67,"tag":326,"props":6750,"children":6751},{"style":427},[6752],{"type":72,"value":430},{"type":67,"tag":326,"props":6754,"children":6755},{"style":359},[6756],{"type":72,"value":6757}," token ",{"type":67,"tag":326,"props":6759,"children":6760},{"style":349},[6761],{"type":72,"value":440},{"type":67,"tag":326,"props":6763,"children":6764},{"style":343},[6765],{"type":72,"value":1754},{"type":67,"tag":326,"props":6767,"children":6768},{"style":359},[6769],{"type":72,"value":1759},{"type":67,"tag":326,"props":6771,"children":6772},{"style":349},[6773],{"type":72,"value":120},{"type":67,"tag":326,"props":6775,"children":6776},{"style":359},[6777],{"type":72,"value":1768},{"type":67,"tag":326,"props":6779,"children":6780},{"style":349},[6781],{"type":72,"value":120},{"type":67,"tag":326,"props":6783,"children":6784},{"style":525},[6785],{"type":72,"value":3029},{"type":67,"tag":326,"props":6787,"children":6788},{"style":359},[6789],{"type":72,"value":533},{"type":67,"tag":326,"props":6791,"children":6792},{"style":349},[6793],{"type":72,"value":1624},{"type":67,"tag":326,"props":6795,"children":6796},{"style":570},[6797],{"type":72,"value":2189},{"type":67,"tag":326,"props":6799,"children":6800},{"style":349},[6801],{"type":72,"value":544},{"type":67,"tag":326,"props":6803,"children":6804},{"style":359},[6805],{"type":72,"value":2649},{"type":67,"tag":326,"props":6807,"children":6808},{"style":349},[6809],{"type":72,"value":120},{"type":67,"tag":326,"props":6811,"children":6812},{"style":359},[6813],{"type":72,"value":6814},"id ",{"type":67,"tag":326,"props":6816,"children":6817},{"style":349},[6818],{"type":72,"value":389},{"type":67,"tag":326,"props":6820,"children":6821},{"style":359},[6822],{"type":72,"value":1046},{"type":67,"tag":326,"props":6824,"children":6825},{"class":328,"line":370},[6826,6831],{"type":67,"tag":326,"props":6827,"children":6828},{"style":525},[6829],{"type":72,"value":6830},"setSessionCookie",{"type":67,"tag":326,"props":6832,"children":6833},{"style":359},[6834],{"type":72,"value":6835},"(token)\n",{"type":67,"tag":315,"props":6837,"children":6839},{"className":317,"code":6838,"language":319,"meta":320,"style":320},"\u002F\u002F On password change \u002F role grant:\nawait db.sessions.revokeAllForUser(user.id) \u002F\u002F destroy existing\nconst token = await db.sessions.create({ userId: user.id }) \u002F\u002F issue fresh\nsetSessionCookie(token)\n",[6840],{"type":67,"tag":96,"props":6841,"children":6842},{"__ignoreMap":320},[6843,6851,6896,6976],{"type":67,"tag":326,"props":6844,"children":6845},{"class":328,"line":329},[6846],{"type":67,"tag":326,"props":6847,"children":6848},{"style":333},[6849],{"type":72,"value":6850},"\u002F\u002F On password change \u002F role grant:\n",{"type":67,"tag":326,"props":6852,"children":6853},{"class":328,"line":339},[6854,6858,6862,6866,6870,6874,6878,6882,6886,6891],{"type":67,"tag":326,"props":6855,"children":6856},{"style":343},[6857],{"type":72,"value":6711},{"type":67,"tag":326,"props":6859,"children":6860},{"style":359},[6861],{"type":72,"value":1759},{"type":67,"tag":326,"props":6863,"children":6864},{"style":349},[6865],{"type":72,"value":120},{"type":67,"tag":326,"props":6867,"children":6868},{"style":359},[6869],{"type":72,"value":1768},{"type":67,"tag":326,"props":6871,"children":6872},{"style":349},[6873],{"type":72,"value":120},{"type":67,"tag":326,"props":6875,"children":6876},{"style":525},[6877],{"type":72,"value":2967},{"type":67,"tag":326,"props":6879,"children":6880},{"style":359},[6881],{"type":72,"value":6736},{"type":67,"tag":326,"props":6883,"children":6884},{"style":349},[6885],{"type":72,"value":120},{"type":67,"tag":326,"props":6887,"children":6888},{"style":359},[6889],{"type":72,"value":6890},"id) ",{"type":67,"tag":326,"props":6892,"children":6893},{"style":333},[6894],{"type":72,"value":6895},"\u002F\u002F destroy existing\n",{"type":67,"tag":326,"props":6897,"children":6898},{"class":328,"line":355},[6899,6903,6907,6911,6915,6919,6923,6927,6931,6935,6939,6943,6947,6951,6955,6959,6963,6967,6971],{"type":67,"tag":326,"props":6900,"children":6901},{"style":427},[6902],{"type":72,"value":430},{"type":67,"tag":326,"props":6904,"children":6905},{"style":359},[6906],{"type":72,"value":6757},{"type":67,"tag":326,"props":6908,"children":6909},{"style":349},[6910],{"type":72,"value":440},{"type":67,"tag":326,"props":6912,"children":6913},{"style":343},[6914],{"type":72,"value":1754},{"type":67,"tag":326,"props":6916,"children":6917},{"style":359},[6918],{"type":72,"value":1759},{"type":67,"tag":326,"props":6920,"children":6921},{"style":349},[6922],{"type":72,"value":120},{"type":67,"tag":326,"props":6924,"children":6925},{"style":359},[6926],{"type":72,"value":1768},{"type":67,"tag":326,"props":6928,"children":6929},{"style":349},[6930],{"type":72,"value":120},{"type":67,"tag":326,"props":6932,"children":6933},{"style":525},[6934],{"type":72,"value":3029},{"type":67,"tag":326,"props":6936,"children":6937},{"style":359},[6938],{"type":72,"value":533},{"type":67,"tag":326,"props":6940,"children":6941},{"style":349},[6942],{"type":72,"value":1624},{"type":67,"tag":326,"props":6944,"children":6945},{"style":570},[6946],{"type":72,"value":2189},{"type":67,"tag":326,"props":6948,"children":6949},{"style":349},[6950],{"type":72,"value":544},{"type":67,"tag":326,"props":6952,"children":6953},{"style":359},[6954],{"type":72,"value":2649},{"type":67,"tag":326,"props":6956,"children":6957},{"style":349},[6958],{"type":72,"value":120},{"type":67,"tag":326,"props":6960,"children":6961},{"style":359},[6962],{"type":72,"value":6814},{"type":67,"tag":326,"props":6964,"children":6965},{"style":349},[6966],{"type":72,"value":389},{"type":67,"tag":326,"props":6968,"children":6969},{"style":359},[6970],{"type":72,"value":1074},{"type":67,"tag":326,"props":6972,"children":6973},{"style":333},[6974],{"type":72,"value":6975},"\u002F\u002F issue fresh\n",{"type":67,"tag":326,"props":6977,"children":6978},{"class":328,"line":370},[6979,6983],{"type":67,"tag":326,"props":6980,"children":6981},{"style":525},[6982],{"type":72,"value":6830},{"type":67,"tag":326,"props":6984,"children":6985},{"style":359},[6986],{"type":72,"value":6835},{"type":67,"tag":194,"props":6988,"children":6990},{"id":6989},"common-mistakes",[6991],{"type":72,"value":6992},"Common Mistakes",{"type":67,"tag":6994,"props":6995,"children":6997},"h3",{"id":6996},"critical-trusting-the-route-guard-for-server-function-auth",[6998],{"type":72,"value":6999},"CRITICAL: Trusting the route guard for server-function auth",{"type":67,"tag":315,"props":7001,"children":7003},{"className":317,"code":7002,"language":319,"meta":320,"style":320},"\u002F\u002F WRONG — the RPC is callable directly via POST regardless of the route\nexport const Route = createFileRoute('\u002F_authenticated\u002Forders')({\n  beforeLoad: ({ context }) => {\n    if (!context.auth.isAuthenticated) throw redirect({ to: '\u002Flogin' })\n  },\n})\nconst getMyOrders = createServerFn({ method: 'GET' }).handler(async () => {\n  return db.orders.findMany() \u002F\u002F ← anyone can hit the RPC and get all orders\n})\n\n\u002F\u002F CORRECT — auth enforced on the handler itself\nconst getMyOrders = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .handler(async ({ context }) => {\n    return db.orders.findMany({ where: { userId: context.session.userId } })\n  })\n",[7004],{"type":67,"tag":96,"props":7005,"children":7006},{"__ignoreMap":320},[7007,7015,7066,7098,7184,7191,7202,7285,7321,7332,7339,7347,7402,7417,7456,7543],{"type":67,"tag":326,"props":7008,"children":7009},{"class":328,"line":329},[7010],{"type":67,"tag":326,"props":7011,"children":7012},{"style":333},[7013],{"type":72,"value":7014},"\u002F\u002F WRONG — the RPC is callable directly via POST regardless of the route\n",{"type":67,"tag":326,"props":7016,"children":7017},{"class":328,"line":339},[7018,7022,7026,7031,7035,7040,7044,7048,7053,7057,7062],{"type":67,"tag":326,"props":7019,"children":7020},{"style":343},[7021],{"type":72,"value":517},{"type":67,"tag":326,"props":7023,"children":7024},{"style":427},[7025],{"type":72,"value":1602},{"type":67,"tag":326,"props":7027,"children":7028},{"style":359},[7029],{"type":72,"value":7030}," Route ",{"type":67,"tag":326,"props":7032,"children":7033},{"style":349},[7034],{"type":72,"value":440},{"type":67,"tag":326,"props":7036,"children":7037},{"style":525},[7038],{"type":72,"value":7039}," createFileRoute",{"type":67,"tag":326,"props":7041,"children":7042},{"style":359},[7043],{"type":72,"value":533},{"type":67,"tag":326,"props":7045,"children":7046},{"style":349},[7047],{"type":72,"value":454},{"type":67,"tag":326,"props":7049,"children":7050},{"style":402},[7051],{"type":72,"value":7052},"\u002F_authenticated\u002Forders",{"type":67,"tag":326,"props":7054,"children":7055},{"style":349},[7056],{"type":72,"value":454},{"type":67,"tag":326,"props":7058,"children":7059},{"style":359},[7060],{"type":72,"value":7061},")(",{"type":67,"tag":326,"props":7063,"children":7064},{"style":349},[7065],{"type":72,"value":1153},{"type":67,"tag":326,"props":7067,"children":7068},{"class":328,"line":355},[7069,7074,7078,7082,7086,7090,7094],{"type":67,"tag":326,"props":7070,"children":7071},{"style":525},[7072],{"type":72,"value":7073},"  beforeLoad",{"type":67,"tag":326,"props":7075,"children":7076},{"style":349},[7077],{"type":72,"value":544},{"type":67,"tag":326,"props":7079,"children":7080},{"style":349},[7081],{"type":72,"value":1680},{"type":67,"tag":326,"props":7083,"children":7084},{"style":536},[7085],{"type":72,"value":1882},{"type":67,"tag":326,"props":7087,"children":7088},{"style":349},[7089],{"type":72,"value":1690},{"type":67,"tag":326,"props":7091,"children":7092},{"style":427},[7093],{"type":72,"value":1695},{"type":67,"tag":326,"props":7095,"children":7096},{"style":349},[7097],{"type":72,"value":352},{"type":67,"tag":326,"props":7099,"children":7100},{"class":328,"line":370},[7101,7105,7109,7113,7117,7121,7125,7129,7134,7138,7142,7146,7150,7154,7159,7163,7167,7172,7176,7180],{"type":67,"tag":326,"props":7102,"children":7103},{"style":343},[7104],{"type":72,"value":1222},{"type":67,"tag":326,"props":7106,"children":7107},{"style":570},[7108],{"type":72,"value":94},{"type":67,"tag":326,"props":7110,"children":7111},{"style":349},[7112],{"type":72,"value":1064},{"type":67,"tag":326,"props":7114,"children":7115},{"style":359},[7116],{"type":72,"value":3403},{"type":67,"tag":326,"props":7118,"children":7119},{"style":349},[7120],{"type":72,"value":120},{"type":67,"tag":326,"props":7122,"children":7123},{"style":359},[7124],{"type":72,"value":18},{"type":67,"tag":326,"props":7126,"children":7127},{"style":349},[7128],{"type":72,"value":120},{"type":67,"tag":326,"props":7130,"children":7131},{"style":359},[7132],{"type":72,"value":7133},"isAuthenticated",{"type":67,"tag":326,"props":7135,"children":7136},{"style":570},[7137],{"type":72,"value":1074},{"type":67,"tag":326,"props":7139,"children":7140},{"style":343},[7141],{"type":72,"value":1826},{"type":67,"tag":326,"props":7143,"children":7144},{"style":525},[7145],{"type":72,"value":3558},{"type":67,"tag":326,"props":7147,"children":7148},{"style":570},[7149],{"type":72,"value":533},{"type":67,"tag":326,"props":7151,"children":7152},{"style":349},[7153],{"type":72,"value":1624},{"type":67,"tag":326,"props":7155,"children":7156},{"style":570},[7157],{"type":72,"value":7158}," to",{"type":67,"tag":326,"props":7160,"children":7161},{"style":349},[7162],{"type":72,"value":544},{"type":67,"tag":326,"props":7164,"children":7165},{"style":349},[7166],{"type":72,"value":399},{"type":67,"tag":326,"props":7168,"children":7169},{"style":402},[7170],{"type":72,"value":7171},"\u002Flogin",{"type":67,"tag":326,"props":7173,"children":7174},{"style":349},[7175],{"type":72,"value":454},{"type":67,"tag":326,"props":7177,"children":7178},{"style":349},[7179],{"type":72,"value":1530},{"type":67,"tag":326,"props":7181,"children":7182},{"style":570},[7183],{"type":72,"value":1046},{"type":67,"tag":326,"props":7185,"children":7186},{"class":328,"line":383},[7187],{"type":67,"tag":326,"props":7188,"children":7189},{"style":349},[7190],{"type":72,"value":1914},{"type":67,"tag":326,"props":7192,"children":7193},{"class":328,"line":413},[7194,7198],{"type":67,"tag":326,"props":7195,"children":7196},{"style":349},[7197],{"type":72,"value":389},{"type":67,"tag":326,"props":7199,"children":7200},{"style":359},[7201],{"type":72,"value":1046},{"type":67,"tag":326,"props":7203,"children":7204},{"class":328,"line":423},[7205,7209,7213,7217,7221,7225,7229,7233,7237,7241,7245,7249,7253,7257,7261,7265,7269,7273,7277,7281],{"type":67,"tag":326,"props":7206,"children":7207},{"style":427},[7208],{"type":72,"value":430},{"type":67,"tag":326,"props":7210,"children":7211},{"style":359},[7212],{"type":72,"value":2029},{"type":67,"tag":326,"props":7214,"children":7215},{"style":349},[7216],{"type":72,"value":440},{"type":67,"tag":326,"props":7218,"children":7219},{"style":525},[7220],{"type":72,"value":1949},{"type":67,"tag":326,"props":7222,"children":7223},{"style":359},[7224],{"type":72,"value":533},{"type":67,"tag":326,"props":7226,"children":7227},{"style":349},[7228],{"type":72,"value":1624},{"type":67,"tag":326,"props":7230,"children":7231},{"style":570},[7232],{"type":72,"value":2050},{"type":67,"tag":326,"props":7234,"children":7235},{"style":349},[7236],{"type":72,"value":544},{"type":67,"tag":326,"props":7238,"children":7239},{"style":349},[7240],{"type":72,"value":399},{"type":67,"tag":326,"props":7242,"children":7243},{"style":402},[7244],{"type":72,"value":2063},{"type":67,"tag":326,"props":7246,"children":7247},{"style":349},[7248],{"type":72,"value":454},{"type":67,"tag":326,"props":7250,"children":7251},{"style":349},[7252],{"type":72,"value":1530},{"type":67,"tag":326,"props":7254,"children":7255},{"style":359},[7256],{"type":72,"value":555},{"type":67,"tag":326,"props":7258,"children":7259},{"style":349},[7260],{"type":72,"value":120},{"type":67,"tag":326,"props":7262,"children":7263},{"style":525},[7264],{"type":72,"value":2105},{"type":67,"tag":326,"props":7266,"children":7267},{"style":359},[7268],{"type":72,"value":533},{"type":67,"tag":326,"props":7270,"children":7271},{"style":427},[7272],{"type":72,"value":2114},{"type":67,"tag":326,"props":7274,"children":7275},{"style":349},[7276],{"type":72,"value":4047},{"type":67,"tag":326,"props":7278,"children":7279},{"style":427},[7280],{"type":72,"value":1695},{"type":67,"tag":326,"props":7282,"children":7283},{"style":349},[7284],{"type":72,"value":352},{"type":67,"tag":326,"props":7286,"children":7287},{"class":328,"line":462},[7288,7292,7296,7300,7304,7308,7312,7316],{"type":67,"tag":326,"props":7289,"children":7290},{"style":343},[7291],{"type":72,"value":1372},{"type":67,"tag":326,"props":7293,"children":7294},{"style":359},[7295],{"type":72,"value":1759},{"type":67,"tag":326,"props":7297,"children":7298},{"style":349},[7299],{"type":72,"value":120},{"type":67,"tag":326,"props":7301,"children":7302},{"style":359},[7303],{"type":72,"value":2154},{"type":67,"tag":326,"props":7305,"children":7306},{"style":349},[7307],{"type":72,"value":120},{"type":67,"tag":326,"props":7309,"children":7310},{"style":525},[7311],{"type":72,"value":2163},{"type":67,"tag":326,"props":7313,"children":7314},{"style":570},[7315],{"type":72,"value":2588},{"type":67,"tag":326,"props":7317,"children":7318},{"style":333},[7319],{"type":72,"value":7320},"\u002F\u002F ← anyone can hit the RPC and get all orders\n",{"type":67,"tag":326,"props":7322,"children":7323},{"class":328,"line":503},[7324,7328],{"type":67,"tag":326,"props":7325,"children":7326},{"style":349},[7327],{"type":72,"value":389},{"type":67,"tag":326,"props":7329,"children":7330},{"style":359},[7331],{"type":72,"value":1046},{"type":67,"tag":326,"props":7333,"children":7334},{"class":328,"line":511},[7335],{"type":67,"tag":326,"props":7336,"children":7337},{"emptyLinePlaceholder":417},[7338],{"type":72,"value":420},{"type":67,"tag":326,"props":7340,"children":7341},{"class":328,"line":562},[7342],{"type":67,"tag":326,"props":7343,"children":7344},{"style":333},[7345],{"type":72,"value":7346},"\u002F\u002F CORRECT — auth enforced on the handler itself\n",{"type":67,"tag":326,"props":7348,"children":7349},{"class":328,"line":576},[7350,7354,7358,7362,7366,7370,7374,7378,7382,7386,7390,7394,7398],{"type":67,"tag":326,"props":7351,"children":7352},{"style":427},[7353],{"type":72,"value":430},{"type":67,"tag":326,"props":7355,"children":7356},{"style":359},[7357],{"type":72,"value":2029},{"type":67,"tag":326,"props":7359,"children":7360},{"style":349},[7361],{"type":72,"value":440},{"type":67,"tag":326,"props":7363,"children":7364},{"style":525},[7365],{"type":72,"value":1949},{"type":67,"tag":326,"props":7367,"children":7368},{"style":359},[7369],{"type":72,"value":533},{"type":67,"tag":326,"props":7371,"children":7372},{"style":349},[7373],{"type":72,"value":1624},{"type":67,"tag":326,"props":7375,"children":7376},{"style":570},[7377],{"type":72,"value":2050},{"type":67,"tag":326,"props":7379,"children":7380},{"style":349},[7381],{"type":72,"value":544},{"type":67,"tag":326,"props":7383,"children":7384},{"style":349},[7385],{"type":72,"value":399},{"type":67,"tag":326,"props":7387,"children":7388},{"style":402},[7389],{"type":72,"value":2063},{"type":67,"tag":326,"props":7391,"children":7392},{"style":349},[7393],{"type":72,"value":454},{"type":67,"tag":326,"props":7395,"children":7396},{"style":349},[7397],{"type":72,"value":1530},{"type":67,"tag":326,"props":7399,"children":7400},{"style":359},[7401],{"type":72,"value":1046},{"type":67,"tag":326,"props":7403,"children":7404},{"class":328,"line":598},[7405,7409,7413],{"type":67,"tag":326,"props":7406,"children":7407},{"style":349},[7408],{"type":72,"value":2083},{"type":67,"tag":326,"props":7410,"children":7411},{"style":525},[7412],{"type":72,"value":2088},{"type":67,"tag":326,"props":7414,"children":7415},{"style":359},[7416],{"type":72,"value":2093},{"type":67,"tag":326,"props":7418,"children":7419},{"class":328,"line":607},[7420,7424,7428,7432,7436,7440,7444,7448,7452],{"type":67,"tag":326,"props":7421,"children":7422},{"style":349},[7423],{"type":72,"value":2083},{"type":67,"tag":326,"props":7425,"children":7426},{"style":525},[7427],{"type":72,"value":2105},{"type":67,"tag":326,"props":7429,"children":7430},{"style":359},[7431],{"type":72,"value":533},{"type":67,"tag":326,"props":7433,"children":7434},{"style":427},[7435],{"type":72,"value":2114},{"type":67,"tag":326,"props":7437,"children":7438},{"style":349},[7439],{"type":72,"value":1680},{"type":67,"tag":326,"props":7441,"children":7442},{"style":536},[7443],{"type":72,"value":1882},{"type":67,"tag":326,"props":7445,"children":7446},{"style":349},[7447],{"type":72,"value":1690},{"type":67,"tag":326,"props":7449,"children":7450},{"style":427},[7451],{"type":72,"value":1695},{"type":67,"tag":326,"props":7453,"children":7454},{"style":349},[7455],{"type":72,"value":352},{"type":67,"tag":326,"props":7457,"children":7458},{"class":328,"line":647},[7459,7463,7467,7471,7475,7479,7483,7487,7491,7495,7499,7503,7507,7511,7515,7519,7523,7527,7531,7535,7539],{"type":67,"tag":326,"props":7460,"children":7461},{"style":343},[7462],{"type":72,"value":1865},{"type":67,"tag":326,"props":7464,"children":7465},{"style":359},[7466],{"type":72,"value":1759},{"type":67,"tag":326,"props":7468,"children":7469},{"style":349},[7470],{"type":72,"value":120},{"type":67,"tag":326,"props":7472,"children":7473},{"style":359},[7474],{"type":72,"value":2154},{"type":67,"tag":326,"props":7476,"children":7477},{"style":349},[7478],{"type":72,"value":120},{"type":67,"tag":326,"props":7480,"children":7481},{"style":525},[7482],{"type":72,"value":2163},{"type":67,"tag":326,"props":7484,"children":7485},{"style":570},[7486],{"type":72,"value":533},{"type":67,"tag":326,"props":7488,"children":7489},{"style":349},[7490],{"type":72,"value":1624},{"type":67,"tag":326,"props":7492,"children":7493},{"style":570},[7494],{"type":72,"value":2176},{"type":67,"tag":326,"props":7496,"children":7497},{"style":349},[7498],{"type":72,"value":544},{"type":67,"tag":326,"props":7500,"children":7501},{"style":349},[7502],{"type":72,"value":1520},{"type":67,"tag":326,"props":7504,"children":7505},{"style":570},[7506],{"type":72,"value":2189},{"type":67,"tag":326,"props":7508,"children":7509},{"style":349},[7510],{"type":72,"value":544},{"type":67,"tag":326,"props":7512,"children":7513},{"style":359},[7514],{"type":72,"value":1882},{"type":67,"tag":326,"props":7516,"children":7517},{"style":349},[7518],{"type":72,"value":120},{"type":67,"tag":326,"props":7520,"children":7521},{"style":359},[7522],{"type":72,"value":1817},{"type":67,"tag":326,"props":7524,"children":7525},{"style":349},[7526],{"type":72,"value":120},{"type":67,"tag":326,"props":7528,"children":7529},{"style":359},[7530],{"type":72,"value":2214},{"type":67,"tag":326,"props":7532,"children":7533},{"style":349},[7534],{"type":72,"value":1530},{"type":67,"tag":326,"props":7536,"children":7537},{"style":349},[7538],{"type":72,"value":1530},{"type":67,"tag":326,"props":7540,"children":7541},{"style":570},[7542],{"type":72,"value":1046},{"type":67,"tag":326,"props":7544,"children":7545},{"class":328,"line":675},[7546,7550],{"type":67,"tag":326,"props":7547,"children":7548},{"style":349},[7549],{"type":72,"value":2234},{"type":67,"tag":326,"props":7551,"children":7552},{"style":359},[7553],{"type":72,"value":1046},{"type":67,"tag":6994,"props":7555,"children":7557},{"id":7556},"critical-treating-shape-validation-as-authorization",[7558],{"type":72,"value":7559},"CRITICAL: Treating shape validation as authorization",{"type":67,"tag":75,"props":7561,"children":7562},{},[7563,7565,7569,7571,7576],{"type":72,"value":7564},"A parsed UUID is ",{"type":67,"tag":149,"props":7566,"children":7567},{},[7568],{"type":72,"value":168},{"type":72,"value":7570}," workspace, not an ",{"type":67,"tag":149,"props":7572,"children":7573},{},[7574],{"type":72,"value":7575},"authorized",{"type":72,"value":7577}," workspace.",{"type":67,"tag":315,"props":7579,"children":7581},{"className":317,"code":7580,"language":319,"meta":320,"style":320},"\u002F\u002F WRONG — UUID is well-formed but the user may not be a member\nconst getWorkspaceData = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .validator(z.object({ workspaceId: z.string().uuid() }))\n  .handler(async ({ context, data }) => {\n    return db.workspaces.findById(data.workspaceId) \u002F\u002F missing membership check!\n  })\n\n\u002F\u002F CORRECT — verify the session principal has access to that workspace\nconst getWorkspaceData = createServerFn({ method: 'GET' })\n  .middleware([authMiddleware])\n  .validator(z.object({ workspaceId: z.string().uuid() }))\n  .handler(async ({ context, data }) => {\n    const member = await db.memberships.find({\n      userId: context.session.userId,\n      workspaceId: data.workspaceId,\n    })\n    if (!member) throw new Error('Not a member of this workspace')\n    return db.workspaces.findById(data.workspaceId)\n  })\n",[7582],{"type":67,"tag":96,"props":7583,"children":7584},{"__ignoreMap":320},[7585,7593,7649,7664,7741,7788,7843,7854,7861,7869,7924,7939,8014,8061,8111,8147,8175,8186,8243,8290],{"type":67,"tag":326,"props":7586,"children":7587},{"class":328,"line":329},[7588],{"type":67,"tag":326,"props":7589,"children":7590},{"style":333},[7591],{"type":72,"value":7592},"\u002F\u002F WRONG — UUID is well-formed but the user may not be a member\n",{"type":67,"tag":326,"props":7594,"children":7595},{"class":328,"line":339},[7596,7600,7605,7609,7613,7617,7621,7625,7629,7633,7637,7641,7645],{"type":67,"tag":326,"props":7597,"children":7598},{"style":427},[7599],{"type":72,"value":430},{"type":67,"tag":326,"props":7601,"children":7602},{"style":359},[7603],{"type":72,"value":7604}," getWorkspaceData ",{"type":67,"tag":326,"props":7606,"children":7607},{"style":349},[7608],{"type":72,"value":440},{"type":67,"tag":326,"props":7610,"children":7611},{"style":525},[7612],{"type":72,"value":1949},{"type":67,"tag":326,"props":7614,"children":7615},{"style":359},[7616],{"type":72,"value":533},{"type":67,"tag":326,"props":7618,"children":7619},{"style":349},[7620],{"type":72,"value":1624},{"type":67,"tag":326,"props":7622,"children":7623},{"style":570},[7624],{"type":72,"value":2050},{"type":67,"tag":326,"props":7626,"children":7627},{"style":349},[7628],{"type":72,"value":544},{"type":67,"tag":326,"props":7630,"children":7631},{"style":349},[7632],{"type":72,"value":399},{"type":67,"tag":326,"props":7634,"children":7635},{"style":402},[7636],{"type":72,"value":2063},{"type":67,"tag":326,"props":7638,"children":7639},{"style":349},[7640],{"type":72,"value":454},{"type":67,"tag":326,"props":7642,"children":7643},{"style":349},[7644],{"type":72,"value":1530},{"type":67,"tag":326,"props":7646,"children":7647},{"style":359},[7648],{"type":72,"value":1046},{"type":67,"tag":326,"props":7650,"children":7651},{"class":328,"line":355},[7652,7656,7660],{"type":67,"tag":326,"props":7653,"children":7654},{"style":349},[7655],{"type":72,"value":2083},{"type":67,"tag":326,"props":7657,"children":7658},{"style":525},[7659],{"type":72,"value":2088},{"type":67,"tag":326,"props":7661,"children":7662},{"style":359},[7663],{"type":72,"value":2093},{"type":67,"tag":326,"props":7665,"children":7666},{"class":328,"line":370},[7667,7671,7675,7679,7683,7687,7691,7695,7700,7704,7708,7712,7716,7720,7724,7729,7733,7737],{"type":67,"tag":326,"props":7668,"children":7669},{"style":349},[7670],{"type":72,"value":2083},{"type":67,"tag":326,"props":7672,"children":7673},{"style":525},[7674],{"type":72,"value":2497},{"type":67,"tag":326,"props":7676,"children":7677},{"style":359},[7678],{"type":72,"value":2502},{"type":67,"tag":326,"props":7680,"children":7681},{"style":349},[7682],{"type":72,"value":120},{"type":67,"tag":326,"props":7684,"children":7685},{"style":525},[7686],{"type":72,"value":2511},{"type":67,"tag":326,"props":7688,"children":7689},{"style":359},[7690],{"type":72,"value":533},{"type":67,"tag":326,"props":7692,"children":7693},{"style":349},[7694],{"type":72,"value":1624},{"type":67,"tag":326,"props":7696,"children":7697},{"style":570},[7698],{"type":72,"value":7699}," workspaceId",{"type":67,"tag":326,"props":7701,"children":7702},{"style":349},[7703],{"type":72,"value":544},{"type":67,"tag":326,"props":7705,"children":7706},{"style":359},[7707],{"type":72,"value":2361},{"type":67,"tag":326,"props":7709,"children":7710},{"style":349},[7711],{"type":72,"value":120},{"type":67,"tag":326,"props":7713,"children":7714},{"style":525},[7715],{"type":72,"value":2541},{"type":67,"tag":326,"props":7717,"children":7718},{"style":359},[7719],{"type":72,"value":870},{"type":67,"tag":326,"props":7721,"children":7722},{"style":349},[7723],{"type":72,"value":120},{"type":67,"tag":326,"props":7725,"children":7726},{"style":525},[7727],{"type":72,"value":7728},"uuid",{"type":67,"tag":326,"props":7730,"children":7731},{"style":359},[7732],{"type":72,"value":2588},{"type":67,"tag":326,"props":7734,"children":7735},{"style":349},[7736],{"type":72,"value":389},{"type":67,"tag":326,"props":7738,"children":7739},{"style":359},[7740],{"type":72,"value":2597},{"type":67,"tag":326,"props":7742,"children":7743},{"class":328,"line":383},[7744,7748,7752,7756,7760,7764,7768,7772,7776,7780,7784],{"type":67,"tag":326,"props":7745,"children":7746},{"style":349},[7747],{"type":72,"value":2083},{"type":67,"tag":326,"props":7749,"children":7750},{"style":525},[7751],{"type":72,"value":2105},{"type":67,"tag":326,"props":7753,"children":7754},{"style":359},[7755],{"type":72,"value":533},{"type":67,"tag":326,"props":7757,"children":7758},{"style":427},[7759],{"type":72,"value":2114},{"type":67,"tag":326,"props":7761,"children":7762},{"style":349},[7763],{"type":72,"value":1680},{"type":67,"tag":326,"props":7765,"children":7766},{"style":536},[7767],{"type":72,"value":1882},{"type":67,"tag":326,"props":7769,"children":7770},{"style":349},[7771],{"type":72,"value":667},{"type":67,"tag":326,"props":7773,"children":7774},{"style":536},[7775],{"type":72,"value":2625},{"type":67,"tag":326,"props":7777,"children":7778},{"style":349},[7779],{"type":72,"value":1690},{"type":67,"tag":326,"props":7781,"children":7782},{"style":427},[7783],{"type":72,"value":1695},{"type":67,"tag":326,"props":7785,"children":7786},{"style":349},[7787],{"type":72,"value":352},{"type":67,"tag":326,"props":7789,"children":7790},{"class":328,"line":413},[7791,7795,7799,7803,7808,7812,7817,7821,7825,7829,7834,7838],{"type":67,"tag":326,"props":7792,"children":7793},{"style":343},[7794],{"type":72,"value":1865},{"type":67,"tag":326,"props":7796,"children":7797},{"style":359},[7798],{"type":72,"value":1759},{"type":67,"tag":326,"props":7800,"children":7801},{"style":349},[7802],{"type":72,"value":120},{"type":67,"tag":326,"props":7804,"children":7805},{"style":359},[7806],{"type":72,"value":7807},"workspaces",{"type":67,"tag":326,"props":7809,"children":7810},{"style":349},[7811],{"type":72,"value":120},{"type":67,"tag":326,"props":7813,"children":7814},{"style":525},[7815],{"type":72,"value":7816},"findById",{"type":67,"tag":326,"props":7818,"children":7819},{"style":570},[7820],{"type":72,"value":533},{"type":67,"tag":326,"props":7822,"children":7823},{"style":359},[7824],{"type":72,"value":2688},{"type":67,"tag":326,"props":7826,"children":7827},{"style":349},[7828],{"type":72,"value":120},{"type":67,"tag":326,"props":7830,"children":7831},{"style":359},[7832],{"type":72,"value":7833},"workspaceId",{"type":67,"tag":326,"props":7835,"children":7836},{"style":570},[7837],{"type":72,"value":1074},{"type":67,"tag":326,"props":7839,"children":7840},{"style":333},[7841],{"type":72,"value":7842},"\u002F\u002F missing membership check!\n",{"type":67,"tag":326,"props":7844,"children":7845},{"class":328,"line":423},[7846,7850],{"type":67,"tag":326,"props":7847,"children":7848},{"style":349},[7849],{"type":72,"value":2234},{"type":67,"tag":326,"props":7851,"children":7852},{"style":359},[7853],{"type":72,"value":1046},{"type":67,"tag":326,"props":7855,"children":7856},{"class":328,"line":462},[7857],{"type":67,"tag":326,"props":7858,"children":7859},{"emptyLinePlaceholder":417},[7860],{"type":72,"value":420},{"type":67,"tag":326,"props":7862,"children":7863},{"class":328,"line":503},[7864],{"type":67,"tag":326,"props":7865,"children":7866},{"style":333},[7867],{"type":72,"value":7868},"\u002F\u002F CORRECT — verify the session principal has access to that workspace\n",{"type":67,"tag":326,"props":7870,"children":7871},{"class":328,"line":511},[7872,7876,7880,7884,7888,7892,7896,7900,7904,7908,7912,7916,7920],{"type":67,"tag":326,"props":7873,"children":7874},{"style":427},[7875],{"type":72,"value":430},{"type":67,"tag":326,"props":7877,"children":7878},{"style":359},[7879],{"type":72,"value":7604},{"type":67,"tag":326,"props":7881,"children":7882},{"style":349},[7883],{"type":72,"value":440},{"type":67,"tag":326,"props":7885,"children":7886},{"style":525},[7887],{"type":72,"value":1949},{"type":67,"tag":326,"props":7889,"children":7890},{"style":359},[7891],{"type":72,"value":533},{"type":67,"tag":326,"props":7893,"children":7894},{"style":349},[7895],{"type":72,"value":1624},{"type":67,"tag":326,"props":7897,"children":7898},{"style":570},[7899],{"type":72,"value":2050},{"type":67,"tag":326,"props":7901,"children":7902},{"style":349},[7903],{"type":72,"value":544},{"type":67,"tag":326,"props":7905,"children":7906},{"style":349},[7907],{"type":72,"value":399},{"type":67,"tag":326,"props":7909,"children":7910},{"style":402},[7911],{"type":72,"value":2063},{"type":67,"tag":326,"props":7913,"children":7914},{"style":349},[7915],{"type":72,"value":454},{"type":67,"tag":326,"props":7917,"children":7918},{"style":349},[7919],{"type":72,"value":1530},{"type":67,"tag":326,"props":7921,"children":7922},{"style":359},[7923],{"type":72,"value":1046},{"type":67,"tag":326,"props":7925,"children":7926},{"class":328,"line":562},[7927,7931,7935],{"type":67,"tag":326,"props":7928,"children":7929},{"style":349},[7930],{"type":72,"value":2083},{"type":67,"tag":326,"props":7932,"children":7933},{"style":525},[7934],{"type":72,"value":2088},{"type":67,"tag":326,"props":7936,"children":7937},{"style":359},[7938],{"type":72,"value":2093},{"type":67,"tag":326,"props":7940,"children":7941},{"class":328,"line":576},[7942,7946,7950,7954,7958,7962,7966,7970,7974,7978,7982,7986,7990,7994,7998,8002,8006,8010],{"type":67,"tag":326,"props":7943,"children":7944},{"style":349},[7945],{"type":72,"value":2083},{"type":67,"tag":326,"props":7947,"children":7948},{"style":525},[7949],{"type":72,"value":2497},{"type":67,"tag":326,"props":7951,"children":7952},{"style":359},[7953],{"type":72,"value":2502},{"type":67,"tag":326,"props":7955,"children":7956},{"style":349},[7957],{"type":72,"value":120},{"type":67,"tag":326,"props":7959,"children":7960},{"style":525},[7961],{"type":72,"value":2511},{"type":67,"tag":326,"props":7963,"children":7964},{"style":359},[7965],{"type":72,"value":533},{"type":67,"tag":326,"props":7967,"children":7968},{"style":349},[7969],{"type":72,"value":1624},{"type":67,"tag":326,"props":7971,"children":7972},{"style":570},[7973],{"type":72,"value":7699},{"type":67,"tag":326,"props":7975,"children":7976},{"style":349},[7977],{"type":72,"value":544},{"type":67,"tag":326,"props":7979,"children":7980},{"style":359},[7981],{"type":72,"value":2361},{"type":67,"tag":326,"props":7983,"children":7984},{"style":349},[7985],{"type":72,"value":120},{"type":67,"tag":326,"props":7987,"children":7988},{"style":525},[7989],{"type":72,"value":2541},{"type":67,"tag":326,"props":7991,"children":7992},{"style":359},[7993],{"type":72,"value":870},{"type":67,"tag":326,"props":7995,"children":7996},{"style":349},[7997],{"type":72,"value":120},{"type":67,"tag":326,"props":7999,"children":8000},{"style":525},[8001],{"type":72,"value":7728},{"type":67,"tag":326,"props":8003,"children":8004},{"style":359},[8005],{"type":72,"value":2588},{"type":67,"tag":326,"props":8007,"children":8008},{"style":349},[8009],{"type":72,"value":389},{"type":67,"tag":326,"props":8011,"children":8012},{"style":359},[8013],{"type":72,"value":2597},{"type":67,"tag":326,"props":8015,"children":8016},{"class":328,"line":598},[8017,8021,8025,8029,8033,8037,8041,8045,8049,8053,8057],{"type":67,"tag":326,"props":8018,"children":8019},{"style":349},[8020],{"type":72,"value":2083},{"type":67,"tag":326,"props":8022,"children":8023},{"style":525},[8024],{"type":72,"value":2105},{"type":67,"tag":326,"props":8026,"children":8027},{"style":359},[8028],{"type":72,"value":533},{"type":67,"tag":326,"props":8030,"children":8031},{"style":427},[8032],{"type":72,"value":2114},{"type":67,"tag":326,"props":8034,"children":8035},{"style":349},[8036],{"type":72,"value":1680},{"type":67,"tag":326,"props":8038,"children":8039},{"style":536},[8040],{"type":72,"value":1882},{"type":67,"tag":326,"props":8042,"children":8043},{"style":349},[8044],{"type":72,"value":667},{"type":67,"tag":326,"props":8046,"children":8047},{"style":536},[8048],{"type":72,"value":2625},{"type":67,"tag":326,"props":8050,"children":8051},{"style":349},[8052],{"type":72,"value":1690},{"type":67,"tag":326,"props":8054,"children":8055},{"style":427},[8056],{"type":72,"value":1695},{"type":67,"tag":326,"props":8058,"children":8059},{"style":349},[8060],{"type":72,"value":352},{"type":67,"tag":326,"props":8062,"children":8063},{"class":328,"line":607},[8064,8068,8073,8077,8081,8085,8089,8094,8098,8103,8107],{"type":67,"tag":326,"props":8065,"children":8066},{"style":427},[8067],{"type":72,"value":1171},{"type":67,"tag":326,"props":8069,"children":8070},{"style":359},[8071],{"type":72,"value":8072}," member",{"type":67,"tag":326,"props":8074,"children":8075},{"style":349},[8076],{"type":72,"value":1019},{"type":67,"tag":326,"props":8078,"children":8079},{"style":343},[8080],{"type":72,"value":1754},{"type":67,"tag":326,"props":8082,"children":8083},{"style":359},[8084],{"type":72,"value":1759},{"type":67,"tag":326,"props":8086,"children":8087},{"style":349},[8088],{"type":72,"value":120},{"type":67,"tag":326,"props":8090,"children":8091},{"style":359},[8092],{"type":72,"value":8093},"memberships",{"type":67,"tag":326,"props":8095,"children":8096},{"style":349},[8097],{"type":72,"value":120},{"type":67,"tag":326,"props":8099,"children":8100},{"style":525},[8101],{"type":72,"value":8102},"find",{"type":67,"tag":326,"props":8104,"children":8105},{"style":570},[8106],{"type":72,"value":533},{"type":67,"tag":326,"props":8108,"children":8109},{"style":349},[8110],{"type":72,"value":1153},{"type":67,"tag":326,"props":8112,"children":8113},{"class":328,"line":647},[8114,8119,8123,8127,8131,8135,8139,8143],{"type":67,"tag":326,"props":8115,"children":8116},{"style":570},[8117],{"type":72,"value":8118},"      userId",{"type":67,"tag":326,"props":8120,"children":8121},{"style":349},[8122],{"type":72,"value":544},{"type":67,"tag":326,"props":8124,"children":8125},{"style":359},[8126],{"type":72,"value":1882},{"type":67,"tag":326,"props":8128,"children":8129},{"style":349},[8130],{"type":72,"value":120},{"type":67,"tag":326,"props":8132,"children":8133},{"style":359},[8134],{"type":72,"value":1817},{"type":67,"tag":326,"props":8136,"children":8137},{"style":349},[8138],{"type":72,"value":120},{"type":67,"tag":326,"props":8140,"children":8141},{"style":359},[8142],{"type":72,"value":2214},{"type":67,"tag":326,"props":8144,"children":8145},{"style":349},[8146],{"type":72,"value":367},{"type":67,"tag":326,"props":8148,"children":8149},{"class":328,"line":675},[8150,8155,8159,8163,8167,8171],{"type":67,"tag":326,"props":8151,"children":8152},{"style":570},[8153],{"type":72,"value":8154},"      workspaceId",{"type":67,"tag":326,"props":8156,"children":8157},{"style":349},[8158],{"type":72,"value":544},{"type":67,"tag":326,"props":8160,"children":8161},{"style":359},[8162],{"type":72,"value":2625},{"type":67,"tag":326,"props":8164,"children":8165},{"style":349},[8166],{"type":72,"value":120},{"type":67,"tag":326,"props":8168,"children":8169},{"style":359},[8170],{"type":72,"value":7833},{"type":67,"tag":326,"props":8172,"children":8173},{"style":349},[8174],{"type":72,"value":367},{"type":67,"tag":326,"props":8176,"children":8177},{"class":328,"line":700},[8178,8182],{"type":67,"tag":326,"props":8179,"children":8180},{"style":349},[8181],{"type":72,"value":4658},{"type":67,"tag":326,"props":8183,"children":8184},{"style":570},[8185],{"type":72,"value":1046},{"type":67,"tag":326,"props":8187,"children":8188},{"class":328,"line":726},[8189,8193,8197,8201,8206,8210,8214,8218,8222,8226,8230,8235,8239],{"type":67,"tag":326,"props":8190,"children":8191},{"style":343},[8192],{"type":72,"value":1222},{"type":67,"tag":326,"props":8194,"children":8195},{"style":570},[8196],{"type":72,"value":94},{"type":67,"tag":326,"props":8198,"children":8199},{"style":349},[8200],{"type":72,"value":1064},{"type":67,"tag":326,"props":8202,"children":8203},{"style":359},[8204],{"type":72,"value":8205},"member",{"type":67,"tag":326,"props":8207,"children":8208},{"style":570},[8209],{"type":72,"value":1074},{"type":67,"tag":326,"props":8211,"children":8212},{"style":343},[8213],{"type":72,"value":1826},{"type":67,"tag":326,"props":8215,"children":8216},{"style":349},[8217],{"type":72,"value":1831},{"type":67,"tag":326,"props":8219,"children":8220},{"style":525},[8221],{"type":72,"value":1836},{"type":67,"tag":326,"props":8223,"children":8224},{"style":570},[8225],{"type":72,"value":533},{"type":67,"tag":326,"props":8227,"children":8228},{"style":349},[8229],{"type":72,"value":454},{"type":67,"tag":326,"props":8231,"children":8232},{"style":402},[8233],{"type":72,"value":8234},"Not a member of this workspace",{"type":67,"tag":326,"props":8236,"children":8237},{"style":349},[8238],{"type":72,"value":454},{"type":67,"tag":326,"props":8240,"children":8241},{"style":570},[8242],{"type":72,"value":1046},{"type":67,"tag":326,"props":8244,"children":8245},{"class":328,"line":752},[8246,8250,8254,8258,8262,8266,8270,8274,8278,8282,8286],{"type":67,"tag":326,"props":8247,"children":8248},{"style":343},[8249],{"type":72,"value":1865},{"type":67,"tag":326,"props":8251,"children":8252},{"style":359},[8253],{"type":72,"value":1759},{"type":67,"tag":326,"props":8255,"children":8256},{"style":349},[8257],{"type":72,"value":120},{"type":67,"tag":326,"props":8259,"children":8260},{"style":359},[8261],{"type":72,"value":7807},{"type":67,"tag":326,"props":8263,"children":8264},{"style":349},[8265],{"type":72,"value":120},{"type":67,"tag":326,"props":8267,"children":8268},{"style":525},[8269],{"type":72,"value":7816},{"type":67,"tag":326,"props":8271,"children":8272},{"style":570},[8273],{"type":72,"value":533},{"type":67,"tag":326,"props":8275,"children":8276},{"style":359},[8277],{"type":72,"value":2688},{"type":67,"tag":326,"props":8279,"children":8280},{"style":349},[8281],{"type":72,"value":120},{"type":67,"tag":326,"props":8283,"children":8284},{"style":359},[8285],{"type":72,"value":7833},{"type":67,"tag":326,"props":8287,"children":8288},{"style":570},[8289],{"type":72,"value":1046},{"type":67,"tag":326,"props":8291,"children":8292},{"class":328,"line":782},[8293,8297],{"type":67,"tag":326,"props":8294,"children":8295},{"style":349},[8296],{"type":72,"value":2234},{"type":67,"tag":326,"props":8298,"children":8299},{"style":359},[8300],{"type":72,"value":1046},{"type":67,"tag":6994,"props":8302,"children":8304},{"id":8303},"high-returning-different-responses-based-on-email-existence",[8305],{"type":72,"value":8306},"HIGH: Returning different responses based on email existence",{"type":67,"tag":75,"props":8308,"children":8309},{},[8310,8312,8318],{"type":72,"value":8311},"Already covered above — ",{"type":67,"tag":96,"props":8313,"children":8315},{"className":8314},[],[8316],{"type":72,"value":8317},"requestPasswordReset",{"type":72,"value":8319}," must return the same body regardless of whether the email matches a user.",{"type":67,"tag":6994,"props":8321,"children":8323},{"id":8322},"high-reading-cookiesenv-at-module-scope",[8324],{"type":72,"value":8325},"HIGH: Reading cookies\u002Fenv at module scope",{"type":67,"tag":315,"props":8327,"children":8329},{"className":317,"code":8328,"language":319,"meta":320,"style":320},"\u002F\u002F WRONG — module-load time, before any request exists\nconst SESSION_SECRET = process.env.SESSION_SECRET\nexport function signSession(payload) {\n  return sign(payload, SESSION_SECRET)\n}\n\n\u002F\u002F CORRECT — read inside per-request callback\nexport function signSession(payload) {\n  return sign(payload, process.env.SESSION_SECRET)\n}\n",[8330],{"type":67,"tag":96,"props":8331,"children":8332},{"__ignoreMap":320},[8333,8341,8378,8411,8444,8451,8458,8466,8497,8545],{"type":67,"tag":326,"props":8334,"children":8335},{"class":328,"line":329},[8336],{"type":67,"tag":326,"props":8337,"children":8338},{"style":333},[8339],{"type":72,"value":8340},"\u002F\u002F WRONG — module-load time, before any request exists\n",{"type":67,"tag":326,"props":8342,"children":8343},{"class":328,"line":339},[8344,8348,8353,8357,8361,8365,8369,8373],{"type":67,"tag":326,"props":8345,"children":8346},{"style":427},[8347],{"type":72,"value":430},{"type":67,"tag":326,"props":8349,"children":8350},{"style":359},[8351],{"type":72,"value":8352}," SESSION_SECRET ",{"type":67,"tag":326,"props":8354,"children":8355},{"style":349},[8356],{"type":72,"value":440},{"type":67,"tag":326,"props":8358,"children":8359},{"style":359},[8360],{"type":72,"value":5684},{"type":67,"tag":326,"props":8362,"children":8363},{"style":349},[8364],{"type":72,"value":120},{"type":67,"tag":326,"props":8366,"children":8367},{"style":359},[8368],{"type":72,"value":4496},{"type":67,"tag":326,"props":8370,"children":8371},{"style":349},[8372],{"type":72,"value":120},{"type":67,"tag":326,"props":8374,"children":8375},{"style":359},[8376],{"type":72,"value":8377},"SESSION_SECRET\n",{"type":67,"tag":326,"props":8379,"children":8380},{"class":328,"line":355},[8381,8385,8389,8394,8398,8403,8407],{"type":67,"tag":326,"props":8382,"children":8383},{"style":343},[8384],{"type":72,"value":517},{"type":67,"tag":326,"props":8386,"children":8387},{"style":427},[8388],{"type":72,"value":522},{"type":67,"tag":326,"props":8390,"children":8391},{"style":525},[8392],{"type":72,"value":8393}," signSession",{"type":67,"tag":326,"props":8395,"children":8396},{"style":349},[8397],{"type":72,"value":533},{"type":67,"tag":326,"props":8399,"children":8400},{"style":536},[8401],{"type":72,"value":8402},"payload",{"type":67,"tag":326,"props":8404,"children":8405},{"style":349},[8406],{"type":72,"value":555},{"type":67,"tag":326,"props":8408,"children":8409},{"style":349},[8410],{"type":72,"value":352},{"type":67,"tag":326,"props":8412,"children":8413},{"class":328,"line":370},[8414,8418,8423,8427,8431,8435,8440],{"type":67,"tag":326,"props":8415,"children":8416},{"style":343},[8417],{"type":72,"value":1372},{"type":67,"tag":326,"props":8419,"children":8420},{"style":525},[8421],{"type":72,"value":8422}," sign",{"type":67,"tag":326,"props":8424,"children":8425},{"style":570},[8426],{"type":72,"value":533},{"type":67,"tag":326,"props":8428,"children":8429},{"style":359},[8430],{"type":72,"value":8402},{"type":67,"tag":326,"props":8432,"children":8433},{"style":349},[8434],{"type":72,"value":667},{"type":67,"tag":326,"props":8436,"children":8437},{"style":359},[8438],{"type":72,"value":8439}," SESSION_SECRET",{"type":67,"tag":326,"props":8441,"children":8442},{"style":570},[8443],{"type":72,"value":1046},{"type":67,"tag":326,"props":8445,"children":8446},{"class":328,"line":383},[8447],{"type":67,"tag":326,"props":8448,"children":8449},{"style":349},[8450],{"type":72,"value":840},{"type":67,"tag":326,"props":8452,"children":8453},{"class":328,"line":413},[8454],{"type":67,"tag":326,"props":8455,"children":8456},{"emptyLinePlaceholder":417},[8457],{"type":72,"value":420},{"type":67,"tag":326,"props":8459,"children":8460},{"class":328,"line":423},[8461],{"type":67,"tag":326,"props":8462,"children":8463},{"style":333},[8464],{"type":72,"value":8465},"\u002F\u002F CORRECT — read inside per-request callback\n",{"type":67,"tag":326,"props":8467,"children":8468},{"class":328,"line":462},[8469,8473,8477,8481,8485,8489,8493],{"type":67,"tag":326,"props":8470,"children":8471},{"style":343},[8472],{"type":72,"value":517},{"type":67,"tag":326,"props":8474,"children":8475},{"style":427},[8476],{"type":72,"value":522},{"type":67,"tag":326,"props":8478,"children":8479},{"style":525},[8480],{"type":72,"value":8393},{"type":67,"tag":326,"props":8482,"children":8483},{"style":349},[8484],{"type":72,"value":533},{"type":67,"tag":326,"props":8486,"children":8487},{"style":536},[8488],{"type":72,"value":8402},{"type":67,"tag":326,"props":8490,"children":8491},{"style":349},[8492],{"type":72,"value":555},{"type":67,"tag":326,"props":8494,"children":8495},{"style":349},[8496],{"type":72,"value":352},{"type":67,"tag":326,"props":8498,"children":8499},{"class":328,"line":503},[8500,8504,8508,8512,8516,8520,8524,8528,8532,8536,8541],{"type":67,"tag":326,"props":8501,"children":8502},{"style":343},[8503],{"type":72,"value":1372},{"type":67,"tag":326,"props":8505,"children":8506},{"style":525},[8507],{"type":72,"value":8422},{"type":67,"tag":326,"props":8509,"children":8510},{"style":570},[8511],{"type":72,"value":533},{"type":67,"tag":326,"props":8513,"children":8514},{"style":359},[8515],{"type":72,"value":8402},{"type":67,"tag":326,"props":8517,"children":8518},{"style":349},[8519],{"type":72,"value":667},{"type":67,"tag":326,"props":8521,"children":8522},{"style":359},[8523],{"type":72,"value":5684},{"type":67,"tag":326,"props":8525,"children":8526},{"style":349},[8527],{"type":72,"value":120},{"type":67,"tag":326,"props":8529,"children":8530},{"style":359},[8531],{"type":72,"value":4496},{"type":67,"tag":326,"props":8533,"children":8534},{"style":349},[8535],{"type":72,"value":120},{"type":67,"tag":326,"props":8537,"children":8538},{"style":359},[8539],{"type":72,"value":8540},"SESSION_SECRET",{"type":67,"tag":326,"props":8542,"children":8543},{"style":570},[8544],{"type":72,"value":1046},{"type":67,"tag":326,"props":8546,"children":8547},{"class":328,"line":511},[8548],{"type":67,"tag":326,"props":8549,"children":8550},{"style":349},[8551],{"type":72,"value":840},{"type":67,"tag":75,"props":8553,"children":8554},{},[8555,8557,8563,8565,8571],{"type":72,"value":8556},"On Cloudflare Workers and other edge runtimes, the module-level read evaluates to ",{"type":67,"tag":96,"props":8558,"children":8560},{"className":8559},[],[8561],{"type":72,"value":8562},"undefined",{"type":72,"value":8564}," even on the server because env is injected per-request. See ",{"type":67,"tag":113,"props":8566,"children":8568},{"href":8567},"..\u002Fexecution-model\u002FSKILL.md",[8569],{"type":72,"value":8570},"start-core\u002Fexecution-model",{"type":72,"value":120},{"type":67,"tag":6994,"props":8573,"children":8575},{"id":8574},"medium-long-lived-sessions-with-no-rotation",[8576],{"type":72,"value":8577},"MEDIUM: Long-lived sessions with no rotation",{"type":67,"tag":75,"props":8579,"children":8580},{},[8581],{"type":72,"value":8582},"A session token that never rotates is functionally a long-lived credential. Rotate on login, logout, password change, and role\u002Fpermission change.",{"type":67,"tag":194,"props":8584,"children":8586},{"id":8585},"cross-references",[8587],{"type":72,"value":8588},"Cross-References",{"type":67,"tag":201,"props":8590,"children":8591},{},[8592,8621,8631,8648],{"type":67,"tag":205,"props":8593,"children":8594},{},[8595,8599,8601,8606,8607,8612,8613,8619],{"type":67,"tag":113,"props":8596,"children":8597},{"href":115},[8598],{"type":72,"value":118},{"type":72,"value":8600}," — the routing side: ",{"type":67,"tag":96,"props":8602,"children":8604},{"className":8603},[],[8605],{"type":72,"value":101},{"type":72,"value":103},{"type":67,"tag":96,"props":8608,"children":8610},{"className":8609},[],[8611],{"type":72,"value":109},{"type":72,"value":242},{"type":67,"tag":96,"props":8614,"children":8616},{"className":8615},[],[8617],{"type":72,"value":8618},"redirect",{"type":72,"value":8620},", RBAC checks.",{"type":67,"tag":205,"props":8622,"children":8623},{},[8624,8629],{"type":67,"tag":113,"props":8625,"children":8627},{"href":8626},"..\u002Fserver-functions\u002FSKILL.md",[8628],{"type":72,"value":58},{"type":72,"value":8630}," — how to expose RPCs (and how the route guard does NOT cover them).",{"type":67,"tag":205,"props":8632,"children":8633},{},[8634,8639,8641,8646],{"type":67,"tag":113,"props":8635,"children":8637},{"href":8636},"..\u002Fmiddleware\u002FSKILL.md",[8638],{"type":72,"value":59},{"type":72,"value":8640}," — composing ",{"type":67,"tag":96,"props":8642,"children":8644},{"className":8643},[],[8645],{"type":72,"value":2280},{"type":72,"value":8647}," and others.",{"type":67,"tag":205,"props":8649,"children":8650},{},[8651,8655],{"type":67,"tag":113,"props":8652,"children":8653},{"href":8567},[8654],{"type":72,"value":8570},{"type":72,"value":8656}," — why module-level env\u002Fsecret reads are wrong.",{"type":67,"tag":8658,"props":8659,"children":8660},"style",{},[8661],{"type":72,"value":8662},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":8664,"total":955},[8665,8682,8689,8705,8718,8737,8748],{"slug":8666,"name":8666,"fn":8667,"description":8668,"org":8669,"tags":8670,"stars":23,"repoUrl":24,"updatedAt":8681},"auth-and-guards","implement route protection in TanStack Router","Route protection with beforeLoad, redirect()\u002Fthrow redirect(), isRedirect helper, authenticated layout routes (_authenticated), non-redirect auth (inline login), RBAC with roles and permissions, auth provider integration (Auth0, Clerk, Supabase), router context for auth state.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8671,8672,8675,8677,8678],{"name":17,"slug":18,"type":15},{"name":8673,"slug":8674,"type":15},"Frontend","frontend",{"name":8676,"slug":35,"type":15},"Routing",{"name":9,"slug":8,"type":15},{"name":8679,"slug":8680,"type":15},"TanStack Router","tanstack-router","2026-07-30T05:27:07.639032",{"slug":4,"name":4,"fn":5,"description":6,"org":8683,"tags":8684,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8685,8686,8687,8688],{"name":17,"slug":18,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":8690,"name":8690,"fn":8691,"description":8692,"org":8693,"tags":8694,"stars":23,"repoUrl":24,"updatedAt":8704},"code-splitting","configure code splitting in TanStack Router","Automatic code splitting (autoCodeSplitting), .lazy.tsx convention, createLazyFileRoute, createLazyRoute, lazyRouteComponent, getRouteApi for typed hooks in split files, codeSplitGroupings per-route override, splitBehavior programmatic config, critical vs non-critical properties.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8695,8698,8699,8702,8703],{"name":8696,"slug":8697,"type":15},"Engineering","engineering",{"name":8673,"slug":8674,"type":15},{"name":8700,"slug":8701,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},{"name":8679,"slug":8680,"type":15},"2026-07-30T05:27:11.494406",{"slug":8706,"name":8706,"fn":8707,"description":8708,"org":8709,"tags":8710,"stars":23,"repoUrl":24,"updatedAt":8717},"data-loading","manage data loading in TanStack Router","Route loader option, loaderDeps for cache keys, staleTime\u002FgcTime\u002F defaultPreloadStaleTime SWR caching, pendingComponent\u002FpendingMs\u002F pendingMinMs, errorComponent\u002FonError\u002FonCatch, beforeLoad, router context and createRootRouteWithContext DI pattern, router.invalidate, Await component, deferred data loading with unawaited promises.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8711,8714,8715,8716],{"name":8712,"slug":8713,"type":15},"Caching","caching",{"name":8700,"slug":8701,"type":15},{"name":9,"slug":8,"type":15},{"name":8679,"slug":8680,"type":15},"2026-07-30T05:26:54.487943",{"slug":8719,"name":8719,"fn":8720,"description":8721,"org":8722,"tags":8723,"stars":23,"repoUrl":24,"updatedAt":8736},"deployment","deploy TanStack Start applications","Deploy to Cloudflare Workers, Netlify, Vercel, Node.js\u002FDocker, Bun, Railway. Selective SSR (ssr option per route), SPA mode, static prerendering, ISR with Cache-Control headers, SEO and head management.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8724,8727,8729,8732,8733],{"name":8725,"slug":8726,"type":15},"Cloudflare","cloudflare",{"name":8728,"slug":8719,"type":15},"Deployment",{"name":8730,"slug":8731,"type":15},"Netlify","netlify",{"name":9,"slug":8,"type":15},{"name":8734,"slug":8735,"type":15},"Vercel","vercel","2026-07-30T05:26:50.509927",{"slug":8738,"name":8738,"fn":8739,"description":8740,"org":8741,"tags":8742,"stars":23,"repoUrl":24,"updatedAt":8747},"execution-model","manage isomorphic execution models","Isomorphic-by-default principle, environment boundary functions (createServerFn, createServerOnlyFn, createClientOnlyFn, createIsomorphicFn), ClientOnly component, useHydrated hook, import protection, dead code elimination, environment variable safety (VITE_ prefix, process.env).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8743,8746],{"name":8744,"slug":8745,"type":15},"Architecture","architecture",{"name":9,"slug":8,"type":15},"2026-07-30T05:27:04.558441",{"slug":2088,"name":2088,"fn":8749,"description":8750,"org":8751,"tags":8752,"stars":23,"repoUrl":24,"updatedAt":8760},"implement TanStack Router middleware","createMiddleware, request middleware (.server only), server function middleware (.client + .server), context passing via next({ context }), sendContext for client-server transfer, global middleware via createStart in src\u002Fstart.ts, middleware factories, method order enforcement, fetch override precedence.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8753,8756,8757,8759],{"name":8754,"slug":8755,"type":15},"Backend","backend",{"name":8673,"slug":8674,"type":15},{"name":8758,"slug":2088,"type":15},"Middleware",{"name":9,"slug":8,"type":15},"2026-07-30T05:26:58.546019",{"items":8762,"total":8900},[8763,8777,8789,8801,8814,8826,8836,8846,8859,8869,8880,8890],{"slug":8764,"name":8764,"fn":8765,"description":8766,"org":8767,"tags":8768,"stars":8774,"repoUrl":8775,"updatedAt":8776},"aggregation","perform data aggregation in TanStack Table","Aggregate TanStack Table columns independently of grouping, including grand totals, caller-selected row totals, multiple keyed aggregations, custom context-based definitions, grouped merges, manual values, and worker constraints.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8769,8772,8773],{"name":8770,"slug":8771,"type":15},"Data Analysis","data-analysis",{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},28175,"https:\u002F\u002Fgithub.com\u002FTanStack\u002Ftable","2026-07-30T05:25:59.429787",{"slug":8778,"name":8778,"fn":8779,"description":8780,"org":8781,"tags":8782,"stars":8774,"repoUrl":8775,"updatedAt":8788},"api-not-found","diagnose TanStack Table API errors","Diagnose missing TanStack Table v9 exports, options, state slices, and instance methods. Load before inventing an API when code sees a type error, undefined feature method, absent object key, adapter mismatch, or v8-shaped example.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8783,8786,8787],{"name":8784,"slug":8785,"type":15},"Debugging","debugging",{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},"2026-07-30T05:26:05.418735",{"slug":8790,"name":8790,"fn":8791,"description":8792,"org":8793,"tags":8794,"stars":8774,"repoUrl":8775,"updatedAt":8800},"cell-selection","select rectangular cell ranges in tables","Select rectangular cell ranges with cellSelectionFeature: two-corner range state keyed by row and column id, mousedown\u002Fmouseenter handlers, selection edges, render-order resolution under pinning, and autoResetCellSelection. Load when ranges widen unexpectedly after sorting or column reordering, when a drag re-renders the whole table, or when building copy-to-clipboard from a selection.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8795,8796,8797],{"name":8770,"slug":8771,"type":15},{"name":9,"slug":8,"type":15},{"name":8798,"slug":8799,"type":15},"UI Components","ui-components","2026-07-30T05:25:38.403427",{"slug":8802,"name":8802,"fn":8803,"description":8804,"org":8805,"tags":8806,"stars":8774,"repoUrl":8775,"updatedAt":8813},"client-vs-server","manage TanStack Table data pipelines","Choose client or server ownership for filtering, grouping, sorting, expanding, and pagination in TanStack Table v9. Load for manual* flags, mixed pipelines, server counts, or deciding which dataset each row-model stage receives.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8807,8810,8811,8812],{"name":8808,"slug":8809,"type":15},"Data Pipeline","data-pipeline",{"name":8673,"slug":8674,"type":15},{"name":8700,"slug":8701,"type":15},{"name":9,"slug":8,"type":15},"2026-07-30T05:25:45.400104",{"slug":8815,"name":8815,"fn":8816,"description":8817,"org":8818,"tags":8819,"stars":8774,"repoUrl":8775,"updatedAt":8825},"column-faceting","build faceted filter UIs","Build faceted filter UIs with columnFacetingFeature, facetedRowModel, facetedUniqueValues, and facetedMinMaxValues. Load for facet counts, numeric ranges, own-filter exclusion, or server-page facet completeness.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8820,8823,8824],{"name":8821,"slug":8822,"type":15},"Data Visualization","data-visualization",{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},"2026-07-30T05:25:41.397257",{"slug":8827,"name":8827,"fn":8828,"description":8829,"org":8830,"tags":8831,"stars":8774,"repoUrl":8775,"updatedAt":8835},"column-filtering","implement column filtering in TanStack Table","Filter columns with columnFilteringFeature, filteredRowModel, filterFns, filterMeta, nested-row direction, and manualFiltering. Load for accessor compatibility, controlled filter updaters, fuzzy metadata, or client\u002Fserver ownership.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8832,8833,8834],{"name":8770,"slug":8771,"type":15},{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},"2026-07-30T05:25:53.391632",{"slug":8837,"name":8837,"fn":8838,"description":8839,"org":8840,"tags":8841,"stars":8774,"repoUrl":8775,"updatedAt":8845},"column-ordering","manage TanStack Table column ordering","Control TanStack Table v9 leaf columnOrder with stable IDs while accounting for pinning regions, visibility, and groupedColumnMode precedence. Load for drag-and-drop columns or rendered order that differs from state.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8842,8843,8844],{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},{"name":8798,"slug":8799,"type":15},"2026-07-30T05:26:03.37801",{"slug":8847,"name":8847,"fn":8848,"description":8849,"org":8850,"tags":8851,"stars":8774,"repoUrl":8775,"updatedAt":8858},"column-pinning","configure column pinning in TanStack Table","Pin columns into logical start, center, and end regions with columnPinningFeature and renderer-owned sticky CSS. Load for RTL offsets, z-index, backgrounds, overflow, widths, gaps, or overlaps.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8852,8855,8856,8857],{"name":8853,"slug":8854,"type":15},"CSS","css",{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},{"name":8798,"slug":8799,"type":15},"2026-07-30T05:25:55.377366",{"slug":8860,"name":8860,"fn":8861,"description":8862,"org":8863,"tags":8864,"stars":8774,"repoUrl":8775,"updatedAt":8868},"column-resizing","implement column resizing in TanStack Table","Wire columnResizingFeature, header.getResizeHandler, resize mode and direction, pointer or touch events, and performant CSS-variable updates. Load when resize state changes but widths do not, or large tables resize slowly.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8865,8866,8867],{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},{"name":8798,"slug":8799,"type":15},"2026-07-30T05:25:51.400011",{"slug":8870,"name":8870,"fn":8871,"description":8872,"org":8873,"tags":8874,"stars":8774,"repoUrl":8775,"updatedAt":8879},"column-sizing","configure column sizing in TanStack Table","Use columnSizingFeature numeric size, minSize, maxSize, getSize, getStart, getAfter, and total-size APIs in table, grid, or flex CSS. Load for auto or percentage misconceptions and sizing\u002Fpinning layout mismatch.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8875,8876,8877,8878],{"name":8853,"slug":8854,"type":15},{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},{"name":8798,"slug":8799,"type":15},"2026-07-30T05:25:48.703799",{"slug":8881,"name":8881,"fn":8882,"description":8883,"org":8884,"tags":8885,"stars":8774,"repoUrl":8775,"updatedAt":8889},"column-visibility","manage column visibility in TanStack Table","Hide columns with columnVisibilityFeature while rendering visibility-aware header, column, and cell collections. Load when hidden columns remain in the DOM, false-versus-absent state is confused, or enableHiding is misunderstood.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8886,8887,8888],{"name":8673,"slug":8674,"type":15},{"name":9,"slug":8,"type":15},{"name":8798,"slug":8799,"type":15},"2026-07-30T05:25:47.367943",{"slug":8891,"name":8891,"fn":8892,"description":8893,"org":8894,"tags":8895,"stars":8774,"repoUrl":8775,"updatedAt":8899},"core","build data grids with TanStack Table","Use TanStack Table v9 as a headless data-grid state and row-processing engine. Load for first-table architecture, stable data and columns, row numbering with getDisplayIndex, semantic rendering, framework adapter choice, or deciding what Table owns versus the renderer.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[8896,8897,8898],{"name":8770,"slug":8771,"type":15},{"name":8673,"slug":8674,"type":15},{"name":8798,"slug":8799,"type":15},"2026-07-30T05:25:52.366295",125]