@louise-toolkit/astro 0.1.2 → 0.2.1

package/README.md

@@ -39,6 +39,14 @@ import { createLouiseMiddleware } from "@louise-toolkit/astro";
 export const onRequest = createLouiseMiddleware({/* ... */});
 ```
 
+Pass `apiGate: true` to deny the editor API by default: every request under
+`/api/louise` must come from a signed-in editor before any route runs, with
+writes and WebSocket upgrades origin-checked. This is the same gate as
+`composeWorker({ gate })` (ADR 0012), for routes mounted as Astro API routes.
+Middleware runs before Astro knows which route file answers, so a public route
+is declared by path: the toolkit's form and vitals routes are exempt at their
+default paths, and `apiGate: { isPublic: (path) => … }` adds your own.
+
 **Actions** — the editor write path as Astro Actions, so a save is a typed call
 rather than a hand-rolled endpoint. `louiseSaveAction`, `louiseSaveDraftAction`
 and `louiseSettingsAction` wrap the same primitives the framework exposes, which

package/dist/middleware.d.ts

@@ -13,6 +13,20 @@ export interface LouiseMiddlewareRateLimit {
      */
     kv: RateLimitBackend | (() => RateLimitBackend | undefined);
 }
+export interface LouiseMiddlewareApiGate {
+    /** Path the gate protects. Default `/api/louise`, on a segment boundary. */
+    prefix?: string;
+    /**
+     * Paths under the prefix an anonymous request may still reach, on top of the
+     * toolkit's own public routes at their default mounts (forms and vitals — see
+     * `isLouisePublicPath`).
+     *
+     * A path, not a mark on the route, because middleware runs before it knows
+     * which route file will answer: a route can't declare itself public here the
+     * way `publicRoute` does for `composeWorker`.
+     */
+    isPublic?: (pathname: string) => boolean;
+}
 export interface LouiseMiddlewareConfig<TEditor = unknown> {
     /**
      * Resolve the editor session for a request — the site wraps its own auth,
@@ -86,6 +100,19 @@ export interface LouiseMiddlewareConfig<TEditor = unknown> {
      * rendered from it stay correct.
      */
     rewrite?: (context: APIContext) => string | undefined | Promise<string | undefined>;
+    /**
+     * Deny-by-default gate for the editor API (ADR 0012), for routes mounted as
+     * framework API routes (`runEditorRoute`) rather than `composeWorker` routes.
+     * `true` — or an object to change the prefix or add public paths — and every
+     * request under `/api/louise` must resolve to an editor, with writes and
+     * WebSocket upgrades origin-checked, before any route runs. Gated responses
+     * get `Cache-Control: no-store` unless the route set its own. Omit to skip.
+     *
+     * Behind `composeWorker({ gate })` this is a second check on requests the
+     * worker already let through, and costs nothing extra: the editor is
+     * resolved on every request regardless.
+     */
+    apiGate?: boolean | LouiseMiddlewareApiGate;
     /** Edit-mode cookie name. Default {@link LOUISE_EDIT_COOKIE} (`"louise_edit"`).
      *  Change it and the `withEdgeCache` bypass predicate must be told too, or an
      *  editor gets served the cached public page. */

package/dist/middleware.js

@@ -19,7 +19,7 @@
 // This subpath is the ONE place Louise touches Astro's types — `astro` is an
 // optional peer, pulled in only by sites that import `louise-toolkit/astro`.
 import { allowCspDataFonts, louiseSecurityHeaders, matchRateRule, rateLimit, rewriteCspStyleSrc, } from "louise-toolkit/security";
-import { LOUISE_EDIT_COOKIE } from "louise-toolkit/worker";
+import { isLouisePublicPath, LOUISE_API_PREFIX, LOUISE_EDIT_COOKIE, louiseApiGate, underPrefix, } from "louise-toolkit/worker";
 /**
  * Build the shared Louise Astro middleware: rate-limit → resolve the editor
  * session + sticky `?louise` edit mode → `next()` → content-freshness cache headers
@@ -31,6 +31,8 @@ export function createLouiseMiddleware(config) {
     // The default comes from the same constant `isEditRequest` reads, so the
     // cookie this sets and the predicate that looks for it cannot drift apart.
     const editCookie = config.editCookie ?? LOUISE_EDIT_COOKIE;
+    const apiGate = config.apiGate === true ? {} : config.apiGate || undefined;
+    const apiPrefix = apiGate?.prefix ?? LOUISE_API_PREFIX;
     return async (context, next) => {
         // Rate-limit the public, unauthenticated POST surfaces before any other
         // work. Keyed by client IP via a KV counter; `rateLimit` fails open on a KV
@@ -90,6 +92,23 @@ export function createLouiseMiddleware(config) {
             // SESSION_SECRET) → public rendering. Auth degrading is fine; what it
             // must NOT do is cancel anything else.
         }
+        // The API gate, before extend: it needs only the editor, and a refused
+        // request shouldn't pay for the site's extra work. A `resolveEditor` that
+        // threw left `locals.editor` null above, so where pages degrade to public
+        // the API fails closed — refused, not served anonymously.
+        const pathname = context.url.pathname;
+        const gatedApi = apiGate !== undefined &&
+            underPrefix(pathname, apiPrefix) &&
+            !isLouisePublicPath(pathname) &&
+            !apiGate.isPublic?.(pathname);
+        if (gatedApi) {
+            const denied = await louiseApiGate(context.request, undefined, {
+                resolveEditor: () => locals.editor,
+                prefix: apiPrefix,
+            });
+            if (denied)
+                return finish(context, denied);
+        }
         // extend gets its OWN catch, deliberately separate from auth's. When these
         // shared one, `resolveEditor` throwing (a sentinel SESSION_SECRET — the
         // dormant-until-provisioned state every module is supposed to survive)
@@ -118,6 +137,16 @@ export function createLouiseMiddleware(config) {
         // for host dispatch is another tenant's page.
         const rewrite = await config.rewrite?.(context);
         const response = rewrite === undefined ? await next() : await next(rewrite);
+        // An editor's JSON must not land in a shared cache. A route that chose its
+        // own policy keeps it.
+        if (gatedApi && !response.headers.has("cache-control")) {
+            response.headers.set("Cache-Control", "no-store");
+        }
+        return finish(context, response);
+    };
+    /** The response-side work every answer gets, a gate refusal included. */
+    function finish(context, response) {
+        const locals = context.locals;
         // content freshness: cached HTML would hide editor edits. Edit-mode pages are
         // per-editor and must be live (`no-store`); public HTML `no-cache` so edits
         // appear without a manual purge. Only HTML — hashed `/_astro/*` assets keep
@@ -139,5 +168,5 @@ export function createLouiseMiddleware(config) {
             response.headers.set("X-Robots-Tag", "noindex");
         }
         return response;
-    };
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@louise-toolkit/astro",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "Astro adapter for louise-toolkit: middleware, Actions, content-layer loaders, and the forms schema bridge.",
   "keywords": [
     "astro",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "0.29.0"
+    "louise-toolkit": "0.30.1"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260829.1",