@blaaiz/docs-core 0.1.1 → 0.3.0

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="#status"><img alt="status" src="https://img.shields.io/badge/status-foundation-blue"></a>
+  <a href="#status"><img alt="status" src="https://img.shields.io/badge/status-published-blue"></a>
   <a href="./LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-green"></a>
 </p>
 
@@ -39,11 +39,11 @@ config and content private. Each site is config plus content:
 
 ```
 your-docs/
-  docs.config.ts          # theme, auth mode, API allow-list
-  docs.json               # navigation
-  guides/**/*.mdx         # prose
-  api-reference/**/*.json # OpenAPI files
-  package.json            # installs @blaaiz/docs-core
+  docs.config.ts                  # theme, auth mode, API allow-list
+  content/docs.json               # navigation
+  content/docs/**/*.mdx           # prose
+  content/api-reference/**/*.json # OpenAPI files
+  package.json                    # installs @blaaiz/docs-core
 ```
 
 ## Start a site

package/dist/{chunk-3ZX4WIE3.js → chunk-ICDBGTIJ.js}

@@ -2526,6 +2526,92 @@ function createSignOut(options = {}) {
   };
 }
 
+// src/core/auth/site-auth.ts
+var notConfigured = () => new Response("This sign-in method is not configured for this site.", { status: 501 });
+var PUBLIC_SITE = {
+  enabled: false,
+  signInPath: "/signin",
+  secretEnabled: false,
+  googleEnabled: false,
+  emailSignIn: () => Promise.resolve(notConfigured()),
+  secretSignIn: () => Promise.resolve(notConfigured()),
+  google: {
+    start: () => notConfigured(),
+    callback: () => Promise.resolve(notConfigured())
+  }
+};
+function createSiteAuth(auth, options = {}) {
+  if (auth === "public") {
+    return {
+      ...PUBLIC_SITE,
+      gate: () => Promise.resolve(null),
+      signOut: createSignOut()
+    };
+  }
+  return workspaceSiteAuth(auth, options);
+}
+function workspaceSiteAuth(auth, options) {
+  const env = options.env ?? ((name) => process.env[name]);
+  const signInPath = auth.signInPath ?? "/signin";
+  const secure = auth.secureCookies ?? true;
+  const ttlSeconds = auth.sessionTtlSeconds;
+  const sessionSecretEnv = auth.sessionSecretEnv ?? "DOCS_SESSION_SECRET";
+  const secret = env(sessionSecretEnv) ?? "";
+  if (secret === "") {
+    throw new DocsConfigError(
+      `auth.mode is 'workspace': set the ${sessionSecretEnv} environment variable to a long random value (for example: openssl rand -hex 32).`
+    );
+  }
+  const shared = {
+    secret,
+    allowedDomains: auth.allowedDomains,
+    secureCookies: secure,
+    signInPath,
+    ...ttlSeconds === void 0 ? {} : { ttlSeconds }
+  };
+  const emailEnabled = auth.providers.email === true;
+  const accessSecret = auth.providers.secret ? env(auth.providers.secret.secretEnv ?? "DOCS_ACCESS_SECRET") ?? "" : "";
+  const secretEnabled = accessSecret !== "";
+  const googleConfig = auth.providers.google;
+  const clientId = googleConfig ? env(googleConfig.clientIdEnv ?? "GOOGLE_CLIENT_ID") : void 0;
+  const clientSecret = googleConfig ? env(googleConfig.clientSecretEnv ?? "GOOGLE_CLIENT_SECRET") : void 0;
+  const googleEnabled = Boolean(googleConfig && clientId && clientSecret);
+  const emailSignIn = emailEnabled ? createEmailSignIn(shared) : null;
+  const secretSignIn = secretEnabled ? createSecretSignIn({ ...shared, accessSecret }) : null;
+  const googleFor = (request) => {
+    if (!googleEnabled || !googleConfig || !clientId || !clientSecret) {
+      return null;
+    }
+    const origin = new URL(request.url).origin;
+    const redirectPath = googleConfig.redirectPath ?? "/api/auth/google/callback";
+    return createGoogleAuth({
+      ...shared,
+      clientId,
+      clientSecret,
+      redirectUri: `${origin}${redirectPath}`
+    });
+  };
+  return {
+    enabled: true,
+    signInPath,
+    secretEnabled,
+    googleEnabled,
+    gate: createAuthGate({
+      secret,
+      allowedDomains: auth.allowedDomains,
+      signInPath,
+      publicPaths: [...options.publicPaths ?? ["/api/proxy"]]
+    }),
+    emailSignIn: (request) => emailSignIn?.(request) ?? Promise.resolve(notConfigured()),
+    secretSignIn: (request) => secretSignIn?.(request) ?? Promise.resolve(notConfigured()),
+    google: {
+      start: (request) => googleFor(request)?.start(request) ?? notConfigured(),
+      callback: (request) => googleFor(request)?.callback(request) ?? Promise.resolve(notConfigured())
+    },
+    signOut: createSignOut({ secureCookies: secure, redirectTo: signInPath })
+  };
+}
+
 // src/core/proxy.ts
 var DEFAULT_RATE_LIMIT_PER_MINUTE2 = 60;
 var ProxyTargetError = class extends Error {
@@ -2979,6 +3065,6 @@ function mergeOpenApiDocuments(inputs, options) {
   };
 }
 
-export { AI_PROVIDER_MODELS, AI_PROVIDER_NAMES, AiConfigError, DocsConfigError, InvalidNavigationError, OpenApiMergeError, ProxyTargetError, SESSION_COOKIE, assertAllowedTarget, buildMetadata, buildRobots, buildSearchIndex, buildSessionCookie, buildSitemap, buildThemeCss, clearSessionCookie, createAskAiRoute, createAuthGate, createEmailSignIn, createGoogleAuth, createMarkdownRoute, createSecretSignIn, createSignOut, createTryItProxy, createTryItProxyRoute, defineDocsConfig, isAllowedEmail, mdxToMarkdown, mergeOpenApiDocuments, openApiOperationToMarkdown, parseNavigation, planDocsTree, readCookie, resolveAiConfig, searchIndex, signSession, unwrapProxyTarget, validateDocsConfig, verifySession };
-//# sourceMappingURL=chunk-3ZX4WIE3.js.map
-//# sourceMappingURL=chunk-3ZX4WIE3.js.map
+export { AI_PROVIDER_MODELS, AI_PROVIDER_NAMES, AiConfigError, DocsConfigError, InvalidNavigationError, OpenApiMergeError, ProxyTargetError, SESSION_COOKIE, assertAllowedTarget, buildMetadata, buildRobots, buildSearchIndex, buildSessionCookie, buildSitemap, buildThemeCss, clearSessionCookie, createAskAiRoute, createAuthGate, createEmailSignIn, createGoogleAuth, createMarkdownRoute, createSecretSignIn, createSignOut, createSiteAuth, createTryItProxy, createTryItProxyRoute, defineDocsConfig, isAllowedEmail, mdxToMarkdown, mergeOpenApiDocuments, openApiOperationToMarkdown, parseNavigation, planDocsTree, readCookie, resolveAiConfig, searchIndex, signSession, unwrapProxyTarget, validateDocsConfig, verifySession };
+//# sourceMappingURL=chunk-ICDBGTIJ.js.map
+//# sourceMappingURL=chunk-ICDBGTIJ.js.map