fix(auth): secure hydration and align password forms

2026-08-11 17:05:04 +05:30
parent 743275e6fa
commit b1086d14e9
17 changed files with 77 additions and 27 deletions
@@ -1,6 +1,6 @@
 {
  "name": "@wrnexus/cli",
-  "version": "0.8.12",
+  "version": "0.8.13",
  "type": "module",
  "main": "src/index.ts",
  "exports": {
@@ -452,11 +452,13 @@ body {
 `,
  "app/layouts/document.wrn": `// Global document layout. The framework renders this once around the selected
 // page layout and merges SEO metadata, styles, and scripts into <head>/<body>.
-// Request cookies, resolved theme, language, URL, and pathname are available
-// as SSR props, so document attributes do not need a client-side correction.
+// Resolved theme, language, URL, and pathname are available as safe SSR props,
+// so document attributes do not need a client-side correction. Request cookies
+// remain server-private and are never passed into document hydration.
 layout Document {
+  runtime = "server"
+
  props {
-    cookies = {}
    theme = "light"
    language = "en"
    url = ""
@@ -67,6 +67,10 @@ test("scaffoldApp includes the complete v0.8 configuration and starter structure
    scaffoldApp(root, "complete-app");
    const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
    const config = readFileSync(join(root, "wrnexus.config.ts"), "utf8");
+    const documentLayout = readFileSync(join(root, "app/layouts/document.wrn"), "utf8");
+
+    expect(documentLayout).toContain('runtime = "server"');
+    expect(documentLayout).not.toContain("cookies =");

    for (const packageName of [
      "@wrnexus/auth",