@graph8/sdk 0.373.0 → 0.374.0

package/templates/auth/middleware.ts.tmpl

@@ -0,0 +1,14 @@
+/**
+ * HTTP Basic auth for the WHOLE app (pages and /api/g8), written by `npx @graph8/sdk create --auth basic`.
+ * The browser asks once for a user and password from G8_BASIC_AUTH and then sends them with every request,
+ * including the screens' calls to /api/g8 (whose `authorize` checks them again). See g8.auth.ts.
+ */
+
+import { appAuth } from "@/g8.auth";
+
+export async function middleware(request: Request): Promise<Response | undefined> {
+  const denied = await appAuth.authorize(request);
+  return denied ?? undefined;
+}
+
+export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"] };

package/templates/next-app/README.md.tmpl

@@ -29,6 +29,11 @@ graph8 data until you finish the checklist below.
 
 ## Go live
 
+The graph8 API key lives only on the server: the browser calls this app's `/api/g8` route, which adds the key.
+Anyone who can call that route can use the key, so before you deploy, set `authorize` in it to your app's login
+(or pick a ready-made preset: `npx @graph8/sdk create <stack> <dir> --auth password|basic|jwt|session`; to add one
+to this app, see "Sign-in presets" in `components/g8/_foundation/README.md`).
+
 - [ ] Set `authorize` in `app/api/g8/[...path]/route.ts`: check your own session and return 401/403 for anyone
       else. Without it a production build answers every `/api/g8` call with 500.
 - [ ] Set `G8_API_KEY` in your host's environment (never `NEXT_PUBLIC_*`); the pasted local key is not used in