@louise-toolkit/astro 0.1.1 → 0.2.0

package/README.md

@@ -39,6 +39,14 @@ import { createLouiseMiddleware } from "@louise-toolkit/astro";
 export const onRequest = createLouiseMiddleware({/* ... */});
 ```
 
+Pass `apiGate: true` to deny the editor API by default: every request under
+`/api/louise` must come from a signed-in editor before any route runs, with
+writes and WebSocket upgrades origin-checked. This is the same gate as
+`composeWorker({ gate })` (ADR 0012), for routes mounted as Astro API routes.
+Middleware runs before Astro knows which route file answers, so a public route
+is declared by path: the toolkit's form and vitals routes are exempt at their
+default paths, and `apiGate: { isPublic: (path) => … }` adds your own.
+
 **Actions** — the editor write path as Astro Actions, so a save is a typed call
 rather than a hand-rolled endpoint. `louiseSaveAction`, `louiseSaveDraftAction`
 and `louiseSettingsAction` wrap the same primitives the framework exposes, which

package/dist/index.d.ts

@@ -2,4 +2,5 @@ export { type ActionErrorCtor, type EditorActionContext, type EditorActionDeps,
 export { type CatalogLoaderConfig, defineCatalogLoader } from "./catalog.js";
 export { collectionToAstroSchema, louiseLoader, type LouiseLoaderConfig, type LouiseRow, } from "./content-loader.js";
 export { formToAstroSchema } from "./form-schema.js";
+export { type ResumeReadSession, resumeReadSession } from "./resume.js";
 export { createLouiseMiddleware, type LouiseMiddlewareConfig, type LouiseMiddlewareRateLimit, } from "./middleware.js";

package/dist/index.js

@@ -8,4 +8,5 @@ export { louiseSaveAction, louiseSaveDraftAction, louiseSettingsAction, } from "
 export { defineCatalogLoader } from "./catalog.js";
 export { collectionToAstroSchema, louiseLoader, } from "./content-loader.js";
 export { formToAstroSchema } from "./form-schema.js";
+export { resumeReadSession } from "./resume.js";
 export { createLouiseMiddleware, } from "./middleware.js";

package/dist/middleware.d.ts

@@ -13,6 +13,20 @@ export interface LouiseMiddlewareRateLimit {
      */
     kv: RateLimitBackend | (() => RateLimitBackend | undefined);
 }
+export interface LouiseMiddlewareApiGate {
+    /** Path the gate protects. Default `/api/louise`, on a segment boundary. */
+    prefix?: string;
+    /**
+     * Paths under the prefix an anonymous request may still reach, on top of the
+     * toolkit's own public routes at their default mounts (forms and vitals — see
+     * `isLouisePublicPath`).
+     *
+     * A path, not a mark on the route, because middleware runs before it knows
+     * which route file will answer: a route can't declare itself public here the
+     * way `publicRoute` does for `composeWorker`.
+     */
+    isPublic?: (pathname: string) => boolean;
+}
 export interface LouiseMiddlewareConfig<TEditor = unknown> {
     /**
      * Resolve the editor session for a request — the site wraps its own auth,
@@ -35,6 +49,12 @@ export interface LouiseMiddlewareConfig<TEditor = unknown> {
     /** Apply {@link louiseSecurityHeaders} (HSTS, nosniff, referrer, …) to the
      *  response. Default `true`. */
     securityHeaders?: boolean;
+    /**
+     * Hosts to keep out of search indexes — sent as `X-Robots-Tag: noindex`.
+     * E.g. `(host) => isNoindexHost(host, { prefixes: ["preview."] })`. Set here
+     * rather than in a page, because a streamed page's headers are already gone.
+     */
+    noindex?: (hostname: string) => boolean;
     /**
      * Extra per-request work after editor resolution, before `next()` — e.g.
      * resolve a second session (a shop customer) onto `locals`. Runs inside the
@@ -80,6 +100,19 @@ export interface LouiseMiddlewareConfig<TEditor = unknown> {
      * rendered from it stay correct.
      */
     rewrite?: (context: APIContext) => string | undefined | Promise<string | undefined>;
+    /**
+     * Deny-by-default gate for the editor API (ADR 0012), for routes mounted as
+     * framework API routes (`runEditorRoute`) rather than `composeWorker` routes.
+     * `true` — or an object to change the prefix or add public paths — and every
+     * request under `/api/louise` must resolve to an editor, with writes and
+     * WebSocket upgrades origin-checked, before any route runs. Gated responses
+     * get `Cache-Control: no-store` unless the route set its own. Omit to skip.
+     *
+     * Behind `composeWorker({ gate })` this is a second check on requests the
+     * worker already let through, and costs nothing extra: the editor is
+     * resolved on every request regardless.
+     */
+    apiGate?: boolean | LouiseMiddlewareApiGate;
     /** Edit-mode cookie name. Default {@link LOUISE_EDIT_COOKIE} (`"louise_edit"`).
      *  Change it and the `withEdgeCache` bypass predicate must be told too, or an
      *  editor gets served the cached public page. */

package/dist/middleware.js

@@ -19,7 +19,7 @@
 // This subpath is the ONE place Louise touches Astro's types — `astro` is an
 // optional peer, pulled in only by sites that import `louise-toolkit/astro`.
 import { allowCspDataFonts, louiseSecurityHeaders, matchRateRule, rateLimit, rewriteCspStyleSrc, } from "louise-toolkit/security";
-import { LOUISE_EDIT_COOKIE } from "louise-toolkit/worker";
+import { isLouisePublicPath, LOUISE_API_PREFIX, LOUISE_EDIT_COOKIE, louiseApiGate, underPrefix, } from "louise-toolkit/worker";
 /**
  * Build the shared Louise Astro middleware: rate-limit → resolve the editor
  * session + sticky `?louise` edit mode → `next()` → content-freshness cache headers
@@ -31,6 +31,8 @@ export function createLouiseMiddleware(config) {
     // The default comes from the same constant `isEditRequest` reads, so the
     // cookie this sets and the predicate that looks for it cannot drift apart.
     const editCookie = config.editCookie ?? LOUISE_EDIT_COOKIE;
+    const apiGate = config.apiGate === true ? {} : config.apiGate || undefined;
+    const apiPrefix = apiGate?.prefix ?? LOUISE_API_PREFIX;
     return async (context, next) => {
         // Rate-limit the public, unauthenticated POST surfaces before any other
         // work. Keyed by client IP via a KV counter; `rateLimit` fails open on a KV
@@ -90,6 +92,23 @@ export function createLouiseMiddleware(config) {
             // SESSION_SECRET) → public rendering. Auth degrading is fine; what it
             // must NOT do is cancel anything else.
         }
+        // The API gate, before extend: it needs only the editor, and a refused
+        // request shouldn't pay for the site's extra work. A `resolveEditor` that
+        // threw left `locals.editor` null above, so where pages degrade to public
+        // the API fails closed — refused, not served anonymously.
+        const pathname = context.url.pathname;
+        const gatedApi = apiGate !== undefined &&
+            underPrefix(pathname, apiPrefix) &&
+            !isLouisePublicPath(pathname) &&
+            !apiGate.isPublic?.(pathname);
+        if (gatedApi) {
+            const denied = await louiseApiGate(context.request, undefined, {
+                resolveEditor: () => locals.editor,
+                prefix: apiPrefix,
+            });
+            if (denied)
+                return finish(context, denied);
+        }
         // extend gets its OWN catch, deliberately separate from auth's. When these
         // shared one, `resolveEditor` throwing (a sentinel SESSION_SECRET — the
         // dormant-until-provisioned state every module is supposed to survive)
@@ -118,6 +137,16 @@ export function createLouiseMiddleware(config) {
         // for host dispatch is another tenant's page.
         const rewrite = await config.rewrite?.(context);
         const response = rewrite === undefined ? await next() : await next(rewrite);
+        // An editor's JSON must not land in a shared cache. A route that chose its
+        // own policy keeps it.
+        if (gatedApi && !response.headers.has("cache-control")) {
+            response.headers.set("Cache-Control", "no-store");
+        }
+        return finish(context, response);
+    };
+    /** The response-side work every answer gets, a gate refusal included. */
+    function finish(context, response) {
+        const locals = context.locals;
         // content freshness: cached HTML would hide editor edits. Edit-mode pages are
         // per-editor and must be live (`no-store`); public HTML `no-cache` so edits
         // appear without a manual purge. Only HTML — hashed `/_astro/*` assets keep
@@ -131,9 +160,13 @@ export function createLouiseMiddleware(config) {
         // every edit surface), so guarantee the CSP permits data: fonts — no-op
         // without a CSP header or when already allowed. Saves consumers a font-src edit.
         allowCspDataFonts(response);
+        const noindex = config.noindex?.(context.url.hostname) ?? false;
         if (config.securityHeaders !== false) {
-            louiseSecurityHeaders(response, { hostname: context.url.hostname });
+            louiseSecurityHeaders(response, { hostname: context.url.hostname, noindex });
+        }
+        else if (noindex) {
+            response.headers.set("X-Robots-Tag", "noindex");
         }
         return response;
-    };
+    }
 }

package/dist/resume.d.ts

@@ -0,0 +1,20 @@
+import type { AstroCookies } from "astro";
+import { type D1Client } from "louise-toolkit/db";
+export interface ResumeReadSession {
+    /** Pass to `resumeDraft` (or any read that must see the editor's writes). */
+    client: D1Client;
+    /** Persist the bookmark the reads advanced to. Call once, after them. */
+    commit: () => void;
+}
+/**
+ * Open a D1 session anchored at the editor's persisted bookmark, for the
+ * edit-mode resume read. On a database without read replication — or a
+ * runtime without the Sessions API — `client` is the raw binding and nothing
+ * changes, so this is safe to wire before replication is on.
+ *
+ * Edit mode only: a view-mode render should stay session-free and cookie-free,
+ * so public pages remain cacheable.
+ */
+export declare function resumeReadSession(DB: D1Database, cookies: AstroCookies, options?: {
+    maxAgeSeconds?: number;
+}): ResumeReadSession;

package/dist/resume.js

@@ -0,0 +1,36 @@
+// Copyright (c) 2026 BowenLabs. Louise Toolkit is MIT licensed.
+//
+// The edit-mode resume read's D1 session, over Astro's cookie API. The draft
+// WRITE (auto-save) persists its D1 bookmark in the `louise_d1_bookmark` cookie;
+// the page load that follows must read at or past that bookmark, or behind read
+// replication the draft just saved can be missing ("my edit vanished").
+import { D1_BOOKMARK_COOKIE, D1_BOOKMARK_MAX_AGE, d1Bookmark, openD1Session, } from "louise-toolkit/db";
+/**
+ * Open a D1 session anchored at the editor's persisted bookmark, for the
+ * edit-mode resume read. On a database without read replication — or a
+ * runtime without the Sessions API — `client` is the raw binding and nothing
+ * changes, so this is safe to wire before replication is on.
+ *
+ * Edit mode only: a view-mode render should stay session-free and cookie-free,
+ * so public pages remain cacheable.
+ */
+export function resumeReadSession(DB, cookies, options = {}) {
+    const bookmark = cookies.get(D1_BOOKMARK_COOKIE)?.value ?? null;
+    const client = openD1Session(DB, bookmark ?? "first-unconstrained");
+    return {
+        client,
+        commit() {
+            const next = d1Bookmark(client);
+            if (next && next !== bookmark) {
+                // The same attributes `serializeD1BookmarkCookie` writes on the save path.
+                cookies.set(D1_BOOKMARK_COOKIE, next, {
+                    path: "/",
+                    httpOnly: true,
+                    sameSite: "lax",
+                    secure: true,
+                    maxAge: options.maxAgeSeconds ?? D1_BOOKMARK_MAX_AGE,
+                });
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@louise-toolkit/astro",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Astro adapter for louise-toolkit: middleware, Actions, content-layer loaders, and the forms schema bridge.",
   "keywords": [
     "astro",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "0.28.0"
+    "louise-toolkit": "0.30.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260829.1",