Skip to content

fix(directus-client): secure preview credential handling - #286

Merged
remihuigen merged 6 commits into
mainfrom
feat/client-improvements
Sep 6, 2026
Merged

fix(directus-client): secure preview credential handling#286
remihuigen merged 6 commits into
mainfrom
feat/client-improvements

Conversation

@remihuigen

@remihuigen remihuigen commented Sep 6, 2026

Copy link
Copy Markdown
Member

Summary

Make SSR authentication hydration resilient to transient refresh infrastructure failures while keeping resolution refresh-aware.

  • SSR still attempts a refresh when the access token is expired or inside the refresh safety window.
  • Successful refreshes rotate the session and hydrate the refreshed snapshot.
  • Terminal refresh failures clear the session and hydrate the application as unauthenticated.
  • Explicitly classified transient refresh failures fall back to the trusted sealed local snapshot without failing SSR.
  • Authenticated upstream requests and explicit refresh/session endpoints retain strict refresh-aware behavior.
  • Local snapshot reading remains expiry-tolerant and separate from currently usable credential resolution.

Make Directus preview and request credential handling explicit and safe.

  • Session credentials now take precedence over preview tokens, followed by proxy credentials and anonymous access.
  • Preview/version selection remains independent from credential selection, so preview URLs cannot replace an authenticated user identity.
  • Preview query handling is disabled by default and requires explicit opt-in with client.preview.enabled: true.
  • Existing preview-only, proxy-fallback, and version-preview behavior remains available when enabled.
  • Updated tests, consumer documentation, skills, and Changesets for both behavior changes.

Validation

  • corepack pnpm format
  • corepack pnpm lint:fix
  • corepack pnpm typecheck
  • corepack pnpm test — 122 files, 697 tests
  • corepack pnpm build
  • corepack pnpm validate:packages
  • corepack pnpm validate:docs

Stacked on #280

Closes #265
Closes #271
Closes #274

@github-actions

github-actions Bot commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

🦋 Changeset detected

Latest commit: 4abe7a1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@onderwijsin/nuxt-directus-client Minor
@onderwijsin/nuxt-directus-config Minor
@onderwijsin/nuxt-directus-sitemaps Patch
@onderwijsin/nuxt-directus-prerenderer Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@remihuigen remihuigen changed the title fix(directus-client): make SSR auth hydration resilient to transient refresh failures refactor(directus-client): make SSR auth hydration resilient to transient refresh failures Sep 6, 2026
@remihuigen remihuigen changed the title refactor(directus-client): make SSR auth hydration resilient to transient refresh failures fix(directus-client): secure preview credential handling Sep 6, 2026
@remihuigen
remihuigen force-pushed the feat/client-improvements branch from ac1df9b to 99120b7 Compare September 6, 2026 20:47
@remihuigen
remihuigen added this pull request to the merge queue Sep 6, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Sep 6, 2026
Base automatically changed from feat/coordinator to main September 6, 2026 20:58
@remihuigen
remihuigen force-pushed the feat/client-improvements branch from 99120b7 to 4abe7a1 Compare September 6, 2026 21:04
@remihuigen
remihuigen added this pull request to the merge queue Sep 6, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 6, 2026
@remihuigen
remihuigen added this pull request to the merge queue Sep 6, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 6, 2026
@remihuigen
remihuigen added this pull request to the merge queue Sep 6, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 6, 2026
@remihuigen
remihuigen added this pull request to the merge queue Sep 6, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 6, 2026
@remihuigen
remihuigen added this pull request to the merge queue Sep 6, 2026
Merged via the queue into main with commit 1f5e6f5 Sep 6, 2026
14 checks passed
@remihuigen
remihuigen deleted the feat/client-improvements branch September 6, 2026 21:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant