@stacksjs/defaults 0.75.94 → 0.75.96

package/ai/skills/stacks-dashboard/SKILL.md

@@ -311,6 +311,48 @@ review and must not be silently recorded.
 - `/kanban` - model-backed board management
 - `/ci`, `/buddy` - CI and Buddy workflows
 
+## Who may reach a dashboard surface
+
+Two axes, declared in different places.
+
+**Route groups** are gated in `config/dashboard.ts`, keyed by the group's path
+prefix:
+
+```ts
+access: {
+  '/api/commerce': ['admin', 'superadmin'],
+  '/dashboard/commerce': ['admin', 'superadmin'],
+  '/cms': ['admin', 'editor'],
+}
+```
+
+Each entry appends `role:<the list>` after that group's `auth`, so any one of
+the named roles admits. Every group ships `auth` and nothing more, so an
+omitted group stays reachable by any signed-in user; naming it is the only way
+to tighten it, since `defaults/routes/dashboard.ts` is framework-owned
+(stacksjs/stacks#2883). Keyed by prefix, so gating `/api/commerce` does not
+gate `/dashboard/commerce`: name both when you mean both. The prefixes are a
+typed union, so a typo is a compile error rather than a gate that is quietly
+absent.
+
+**A model's own generated API** is gated on the model, not here: either
+`dashboard: { roles: ['admin'] }`, which gates the sidebar row and every
+generated route together, or `useApi.middleware` for per-ability control. See
+`stacks-models`.
+
+**The sidebar** filters itself. A row carrying roles (from a model's
+`dashboard.roles` or a `nav` item's `roles`) is hidden client-side from viewers
+holding none of them, permissively for unauthenticated viewers so the local dev
+dashboard stays usable (#1843). That is presentation: it hides the link, not
+the endpoint, so it is never the gate on its own.
+
+**SSR pages** take the same middleware names as an API route, because the page
+servers build their registry from `app/Middleware.ts`:
+
+```stx
+definePageMeta({ middleware: ['auth', 'role:admin'] })
+```
+
 ## Dashboard Components (250+)
 
 ### Layout Components

package/ai/skills/stacks-models/SKILL.md

@@ -132,6 +132,79 @@ shape, authorization boundary, or aggregation differs from generic CRUD. Do
 not expose a sensitive model through unguarded generated routes just because a
 separate dashboard endpoint is protected.
 
+#### Who may reach the generated routes
+
+Omit `middleware` and reads AND writes get `auth`: an undeclared read route is
+how a customer list leaks (#2224). Four declaration forms, narrowest last:
+
+```ts
+middleware: ['auth']                       // every ability
+middleware: []                             // every ability public; warns at boot
+middleware: { read: [], write: ['auth'] }  // public catalog, guarded writes
+middleware: { write: ['auth'], destroy: ['auth', 'role:admin'] }  // per ability
+```
+
+`read` covers `index` and `show`; `write` covers `store`, `update` and
+`destroy`; an ability name overrides its side; and `destroy` covers bulk-delete
+with the single delete. Use the per-ability form for the "fewer actions" half of
+a tiered role - "may file an order, may not void one" is `store` versus
+`destroy`, which the read/write split cannot express. Declaring one ability
+leaves the other four on `auth`, so narrowing one route never widens another.
+
+A model is also gated by the roles it declares for the dashboard:
+
+```ts
+dashboard: { roles: ['admin'] }   // hides the sidebar row AND gates every generated route
+```
+
+That one declaration covers both surfaces (#2883). It appends `role:admin` to
+the resolved middleware of each ability, unless that ability names a `role:`
+itself (explicit wins) or was explicitly emptied (a deliberately public surface
+is reported at boot, not quietly closed). `dashboard: { roles: [...], enforce:
+false }` keeps the row hidden and the API as the middleware leaves it, for a row
+hidden only to reduce clutter.
+
+Row-level scoping is separate and already on: a model scopes rows by an
+`ownership` config or a `team_id` column, and `security.api.rowScoping` defaults
+to `'deny'`, which withholds store/update/destroy from a model that scopes
+neither (#2375). A role says who may call the route; ownership says which rows
+are theirs. A tiered app usually needs both.
+
+#### Per-row rules: a policy
+
+Middleware answers "may this caller use this endpoint". A policy answers "may
+this caller do this to THIS row", which is the part a role cannot express. The
+generated routes consult one when the model has one (#2883):
+
+| Route | Ability | Subject |
+|---|---|---|
+| `index` | `viewAny` | none |
+| `show` | `view` | the row |
+| `store` | `create` | none |
+| `update` | `update` | the existing row |
+| `destroy`, bulk-delete | `delete` | the row, one call each |
+
+```ts
+// app/Policies/OrderPolicy.ts
+export default class OrderPolicy {
+  viewAny(user) { return user !== null }
+  view(user, order) { return order.customer_id === user?.id }
+  delete(user, order) { return order.status === 'draft' && order.customer_id === user?.id }
+}
+```
+
+Register it in `app/Gates.ts` under `policies`, or name it `<Model>Policy` under
+`app/Policies/` and it is discovered by convention. A model with no policy is
+unaffected, so adding one is opt-in per model. A refusal is a 403 carrying the
+policy's own message; an ability the policy does not implement is a refusal too,
+so a partial policy does not leave the rest open.
+
+`Gate.inspectFor(model, ability, user, row)` is the same check from your own
+code, keyed by model NAME rather than by instance - which is what a dashboard
+action holding a query-builder row needs. It answers null for "no policy
+registered", which is deliberately distinct from a denial; `Gate.allowsFor`
+is the boolean form that reads null as allowed.
+
 Generated store and update routes accept both spellings of every fillable
 attribute and each foreign key implied by `belongsTo`. Declaring Product as a
 belongs-to relation therefore accepts `productId` or `product_id` without

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.94",
+  "version": "0.75.96",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.94",
+  "version": "0.75.96",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,8 +55,8 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "^0.75.94",
-    "@stacksjs/sanitizer": "^0.2.395",
+    "@stacksjs/mobile": "^0.75.96",
+    "@stacksjs/sanitizer": "^0.2.406",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ts-qr-codes": "^0.1.8"

package/resources/components/NativeAccountButton.stx

@@ -12,7 +12,7 @@ interface NativeAccountButtonProps {
   label?: string
 }
 
-const { href, label = 'Account' } = defineProps<NativeAccountButtonProps>()
+defineProps<NativeAccountButtonProps>()
 </script>
 
 <script client>
@@ -21,6 +21,11 @@ import { haptics } from '@stacksjs/mobile'
 // The account at the top right of a tab's screen, as iOS apps put it: the
 // tab bar keeps its tabs for the places the app is used from. Reactive, so it
 // follows the signed-in person and the count as they change.
+// Every prop through useReactiveProp, under names of its own: read as plain
+// {{ label }}, a host's client signal of the same name (a pull-to-refresh's
+// "Refreshing") was shown instead of the button's own.
+const accountHref = useReactiveProp<string>('href', '')
+const accountLabel = useReactiveProp<string>('label', 'Account')
 const accountName = useReactiveProp<string>('name', '')
 const accountImage = useReactiveProp<string>('image', '')
 const accountBadge = useReactiveProp<string | number>('badge', '')
@@ -42,8 +47,8 @@ function tapAccount(): void {
 }
 </script>
 
-<a href="{{ href }}" class="native-account-button" draggable="false" data-stx-link data-stx-prefetch="eager" @click="tapAccount()">
-  <span class="native-account-label">{{ label }}<span :if="accountCount()">, {{ accountCount() }}</span></span>
+<a :href="accountHref()" class="native-account-button" draggable="false" data-stx-link data-stx-prefetch="eager" @click="tapAccount()">
+  <span class="native-account-label">{{ accountLabel() }}<span :if="accountCount()">, {{ accountCount() }}</span></span>
   <span aria-hidden="true" class="native-account-face" :style="accountPhoto()">
     <span :if="!accountImage() && accountInitials()">{{ accountInitials() }}</span>
     <i :if="!accountImage() && !accountInitials()" class="i-lucide-circle-user-round native-account-glyph"></i>

package/resources/components/NativeComponents.test.ts

@@ -1,6 +1,7 @@
-import { describe, expect, it } from 'bun:test'
+import { describe, expect, it, spyOn } from 'bun:test'
 import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
+import { processDirectives } from '@stacksjs/stx'
 
 const read = (name: string) => readFileSync(join(import.meta.dir, `${name}.stx`), 'utf8')
 
@@ -113,6 +114,30 @@ describe('Native components', () => {
     expect(control).toContain("emit('change', value)")
   })
 
+  it('renders its segments in the browser, from whatever the options prop holds', async () => {
+    // `options` is both the prop and the derived list the segments loop over.
+    // stx once took the prop's value in the render context for server data and
+    // turned the `:for` into a server `@foreach(options())`, which rendered an
+    // empty track (the workout player's rest picker).
+    const warn = spyOn(console, 'warn')
+    try {
+      const html = await processDirectives(
+        `<NativeSegmentedControl label="Rest" :options="[{ label: '30s', value: 30 }, { label: '60s', value: 60 }]" />`,
+        {},
+        join(import.meta.dir, 'page.stx'),
+        { componentsDir: import.meta.dir, partialsDir: import.meta.dir } as Parameters<typeof processDirectives>[3],
+        new Set<string>(),
+      )
+      expect(html).toContain('class="native-segmented"')
+      expect(html).toContain(':for="(option, index) in options()"')
+      expect(html).not.toContain('Foreach Error')
+      expect(warn.mock.calls.some(call => String(call[0]).includes('is not iterable server-side'))).toBe(false)
+    }
+    finally {
+      warn.mockRestore()
+    }
+  })
+
   it('steps the tab bar away for a screen that is a task of its own', () => {
     const shell = read('NativeAppShell')
     expect(shell).toContain('.native-app-shell:has([data-native-hide-tab-bar]) .native-app-tab-slot { display: none; }')

package/routes/dashboard.ts

@@ -16,7 +16,47 @@
  */
 
 import { isLocalDeployment } from '@stacksjs/env'
-import { route } from '@stacksjs/router'
+import { projectPath } from '@stacksjs/path'
+import { dashboardGroupMiddleware, describeUnknownDashboardGroups, resolveDashboardAccess, route } from '@stacksjs/router'
+import { log } from '@stacksjs/logging/runtime'
+
+/**
+ * Which roles may reach each group below, from `config/dashboard.ts`
+ * (stacksjs/stacks#2883).
+ *
+ * Every group here shipped `middleware: 'auth'` and nothing more, so any
+ * signed-in user could reach `/api/commerce`, `/cms` or `/models` whatever the
+ * sidebar showed them - and an app could not tighten it, because this file is
+ * framework-owned and nothing attached middleware to a path.
+ *
+ * Read by path rather than through `@stacksjs/config`, matching how the ORM
+ * route generator reads `config/security.ts`: registration runs at import time,
+ * which is before `overridesReady` resolves, so the config package would hand
+ * back framework defaults here. A missing or malformed file resolves to no
+ * gating at all, which is exactly how this file behaved before.
+ */
+const dashboardAccess = await (async () => {
+  try {
+    const configured = (await import(projectPath('config/dashboard.ts'))).default?.access
+    return resolveDashboardAccess(configured)
+  }
+  catch {
+    return resolveDashboardAccess(undefined)
+  }
+})()
+
+{
+  // A typo'd prefix gates nothing, and would read as a gate that is quietly
+  // absent. Named once, not per group.
+  const report = describeUnknownDashboardGroups(dashboardAccess.unknown)
+  if (report)
+    log.warn(report)
+}
+
+/** One group's middleware: its `auth` base, plus any role the app declared. */
+function guarded(prefix: string, base?: Parameters<typeof dashboardGroupMiddleware>[2]) {
+  return dashboardGroupMiddleware(prefix, dashboardAccess, base)
+}
 
 // ============================================================================
 // Email
@@ -138,9 +178,10 @@ route.get('/robots.txt', 'Actions/RobotsAction')
 // a public AI endpoint (e.g. a homepage chat widget), it can register the
 // route in `routes/api.ts` without the middleware — user routes load before
 // framework routes, so the unauthenticated copy wins.
-route.group({ middleware: 'auth' }, () => {
-  route.post('/ai/ask', 'Actions/AI/AskAction')
-  route.post('/ai/summary', 'Actions/AI/SummaryAction')
+// Prefixed so `access` can name it; `/ai/ask` and `/ai/summary` as before.
+route.group({ prefix: '/ai', middleware: guarded('/ai') }, () => {
+  route.post('/ask', 'Actions/AI/AskAction')
+  route.post('/summary', 'Actions/AI/SummaryAction')
 })
 
 // ============================================================================
@@ -152,7 +193,7 @@ route.group({ middleware: 'auth' }, () => {
 // Always auth-gated.
 // ============================================================================
 
-route.group({ prefix: '/voide', middleware: 'auth' }, () => {
+route.group({ prefix: '/voide', middleware: guarded('/voide') }, () => {
   route.get('/state', 'Actions/Buddy/BuddyStateAction')
   route.post('/repo', 'Actions/Buddy/BuddyRepoOpenAction')
   route.post('/repo/validate', 'Actions/Buddy/BuddyRepoValidateAction')
@@ -180,7 +221,7 @@ route.group({ prefix: '/voide', middleware: 'auth' }, () => {
 // the newsletter signup lives at /api/email/subscribe — those stay open.
 // ============================================================================
 
-route.group({ prefix: '/dashboard', middleware: 'auth' }, () => {
+route.group({ prefix: '/dashboard', middleware: guarded('/dashboard') }, () => {
   route.get('/home', 'Actions/Dashboard/DashboardHomeAction')
   route.get('/stats', 'Actions/Dashboard/DashboardStatsAction')
   route.get('/activity', 'Actions/Dashboard/DashboardActivityAction')
@@ -201,7 +242,7 @@ route.group({ prefix: '/dashboard', middleware: 'auth' }, () => {
 // action must STILL scope to the authenticated user (derive the customer from
 // `await request.user()`, never trust the `{id}` path param) to prevent an
 // authenticated user from reaching another user's billing.
-route.group({ prefix: '/payments', middleware: 'auth' }, () => {
+route.group({ prefix: '/payments', middleware: guarded('/payments') }, () => {
   route.get('/fetch-customer/{id}', 'Actions/Payment/FetchPaymentCustomerAction')
   route.get('/fetch-transaction-history/{id}', 'Actions/Payment/FetchTransactionHistoryAction')
   route.get('/fetch-user-subscriptions/{id}', 'Actions/Payment/FetchUserSubscriptionsAction')
@@ -232,11 +273,11 @@ route.group({ prefix: '/payments', middleware: 'auth' }, () => {
 // Auth-gated to match every other operational dashboard group — these expose
 // internal job/queue and websocket state and were the only siblings missing
 // `auth`, leaking infra telemetry to anonymous callers.
-route.group({ prefix: '/queues', middleware: 'auth' }, () => {
+route.group({ prefix: '/queues', middleware: guarded('/queues') }, () => {
   route.get('/', 'Actions/Queue/FetchQueuesAction')
 })
 
-route.group({ prefix: '/realtime', middleware: 'auth' }, () => {
+route.group({ prefix: '/realtime', middleware: guarded('/realtime') }, () => {
   route.get('/websockets', 'Actions/Realtime/FetchWebsocketsAction')
   route.get('/stats', 'Actions/Dashboard/Realtime/RealtimeStatsAction')
 })
@@ -245,7 +286,7 @@ route.group({ prefix: '/realtime', middleware: 'auth' }, () => {
 // Query Dashboard
 // ============================================================================
 
-route.group({ prefix: '/api/queries', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/queries', middleware: guarded('/api/queries') }, () => {
   route.get('/dashboard', 'Actions/Dashboard/Queries/QueryIndexAction')
   route.get('/stats', 'Controllers/QueryController@getStats')
   route.get('/recent', 'Controllers/QueryController@getRecentQueries')
@@ -260,7 +301,7 @@ route.group({ prefix: '/api/queries', middleware: 'auth' }, () => {
 // Monitoring / Error Tracking
 // ============================================================================
 
-route.group({ prefix: '/api/monitoring', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/monitoring', middleware: guarded('/api/monitoring') }, () => {
   route.get('/errors', 'Actions/Monitoring/ErrorIndexAction')
   route.get('/errors/stats', 'Actions/Monitoring/ErrorStatsAction')
   route.get('/errors/timeline', 'Actions/Monitoring/ErrorTimelineAction')
@@ -280,7 +321,7 @@ route.group({ prefix: '/api/monitoring', middleware: 'auth' }, () => {
 // is no longer a DB/CMS mirror. /cms below remains the authoring API.
 // ============================================================================
 
-route.group({ prefix: '/cms', middleware: 'auth' }, () => {
+route.group({ prefix: '/cms', middleware: guarded('/cms') }, () => {
   route.get('/dashboard', 'Actions/Dashboard/Content/ContentDashboardAction')
   route.get('/posts', 'Actions/Cms/PostIndexAction')
   route.get('/posts/{id}', 'Actions/Cms/PostShowAction')
@@ -334,7 +375,7 @@ route.group({ prefix: '/cms', middleware: 'auth' }, () => {
 // underlying actions, since user routes load before framework routes.
 // ============================================================================
 
-route.group({ prefix: '/api/commerce', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/commerce', middleware: guarded('/api/commerce') }, () => {
   route.get('/dashboard', 'Actions/Dashboard/Commerce/CommerceDashboardAction')
   route.get('/pos', 'Actions/Dashboard/Commerce/PosIndexAction')
   route.get('/products', 'Actions/Commerce/Product/ProductIndexAction')
@@ -509,7 +550,7 @@ route.group({ prefix: '/api/commerce', middleware: 'auth' }, () => {
 // Analytics
 // ============================================================================
 
-route.group({ prefix: '/api/analytics', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/analytics', middleware: guarded('/api/analytics') }, () => {
   route.get('/sales', 'Actions/Dashboard/Analytics/SalesAnalyticsAction')
   route.get('/web', 'Actions/Dashboard/Analytics/WebAnalyticsAction')
   route.get('/blog', 'Actions/Dashboard/Analytics/BlogAnalyticsAction')
@@ -527,13 +568,13 @@ route.group({ prefix: '/api/analytics', middleware: 'auth' }, () => {
 // Jobs & Queue
 // ============================================================================
 
-route.group({ prefix: '/jobs', middleware: 'auth' }, () => {
+route.group({ prefix: '/jobs', middleware: guarded('/jobs') }, () => {
   route.get('/', 'Actions/Dashboard/Jobs/JobIndexAction')
   route.get('/stats', 'Actions/Dashboard/Jobs/JobStatsAction')
   route.post('/{id}/retry', 'Actions/Dashboard/Jobs/JobRetryAction')
 })
 
-route.group({ prefix: '/queue', middleware: 'auth' }, () => {
+route.group({ prefix: '/queue', middleware: guarded('/queue') }, () => {
   route.get('/stats', 'Actions/Dashboard/Queue/QueueStatsAction')
   route.get('/workers', 'Actions/Dashboard/Queue/QueueWorkersAction')
   route.post('/retry-failed', 'Actions/Dashboard/Queue/QueueRetryFailedAction')
@@ -543,7 +584,7 @@ route.group({ prefix: '/queue', middleware: 'auth' }, () => {
 // Releases
 // ============================================================================
 
-route.group({ prefix: '/releases', middleware: 'auth' }, () => {
+route.group({ prefix: '/releases', middleware: guarded('/releases') }, () => {
   route.get('/', 'Actions/Dashboard/Releases/ReleaseIndexAction')
   route.get('/stats', 'Actions/Dashboard/Releases/ReleaseIndexAction')
 })
@@ -552,7 +593,7 @@ route.group({ prefix: '/releases', middleware: 'auth' }, () => {
 // Settings
 // ============================================================================
 
-route.group({ prefix: '/api/settings', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/settings', middleware: guarded('/api/settings') }, () => {
   route.get('/mail', 'Actions/Dashboard/Settings/MailSettingsGetAction')
   route.put('/mail', 'Actions/Dashboard/Settings/MailSettingsUpdateAction')
 })
@@ -561,7 +602,7 @@ route.group({ prefix: '/api/settings', middleware: 'auth' }, () => {
 // Data Management
 // ============================================================================
 
-route.group({ prefix: '/api/data', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/data', middleware: guarded('/api/data') }, () => {
   route.get('/subscribers', 'Actions/Dashboard/Data/SubscriberIndexAction')
   route.get('/teams', 'Actions/Dashboard/Data/TeamIndexAction')
   route.get('/users', 'Actions/Dashboard/Data/UserIndexAction')
@@ -572,7 +613,7 @@ route.group({ prefix: '/api/data', middleware: 'auth' }, () => {
 // Infrastructure
 // ============================================================================
 
-route.group({ prefix: '/infrastructure', middleware: 'auth' }, () => {
+route.group({ prefix: '/infrastructure', middleware: guarded('/infrastructure') }, () => {
   route.get('/servers', 'Actions/Dashboard/Infrastructure/ServerIndexAction')
   route.get('/dns', 'Actions/Dashboard/Infrastructure/DnsIndexAction')
   route.get('/environment', 'Actions/Dashboard/Infrastructure/EnvironmentIndexAction')
@@ -589,7 +630,7 @@ route.get('/api/serverless', 'Actions/Dashboard/Cloud/ServerlessIndexAction').mi
 // Dashboard Views — Commerce
 // ============================================================================
 
-route.group({ prefix: '/dashboard/commerce', middleware: 'auth' }, () => {
+route.group({ prefix: '/dashboard/commerce', middleware: guarded('/dashboard/commerce') }, () => {
   route.get('/customers', 'Actions/Dashboard/Commerce/CommerceCustomersAction')
   route.get('/orders', 'Actions/Dashboard/Commerce/CommerceOrdersAction')
   route.get('/products', 'Actions/Dashboard/Commerce/CommerceProductsAction')
@@ -605,7 +646,7 @@ route.group({ prefix: '/dashboard/commerce', middleware: 'auth' }, () => {
 // Dashboard Views — CMS Content
 // ============================================================================
 
-route.group({ prefix: '/dashboard/cms', middleware: 'auth' }, () => {
+route.group({ prefix: '/dashboard/cms', middleware: guarded('/dashboard/cms') }, () => {
   route.get('/posts', 'Actions/Dashboard/Content/PostIndexAction')
   route.get('/pages', 'Actions/Dashboard/Content/PageIndexAction')
   route.get('/categories', 'Actions/Dashboard/Content/CategoryIndexAction')
@@ -618,7 +659,7 @@ route.group({ prefix: '/dashboard/cms', middleware: 'auth' }, () => {
 // Marketing
 // ============================================================================
 
-route.group({ prefix: '/api/marketing', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/marketing', middleware: guarded('/api/marketing') }, () => {
   route.get('/campaigns', 'Actions/Dashboard/Marketing/CampaignIndexAction')
   route.get('/lists', 'Actions/Dashboard/Marketing/ListIndexAction')
   route.get('/social-posts', 'Actions/Dashboard/Marketing/SocialPostIndexAction')
@@ -628,7 +669,7 @@ route.group({ prefix: '/api/marketing', middleware: 'auth' }, () => {
 // Notifications
 // ============================================================================
 
-route.group({ prefix: '/api/notifications', middleware: 'auth' }, () => {
+route.group({ prefix: '/api/notifications', middleware: guarded('/api/notifications') }, () => {
   route.get('/dashboard', 'Actions/Dashboard/Notifications/NotificationDeliveryOverviewAction')
   route.get('/email', 'Actions/Dashboard/Notifications/NotificationDeliveryIndexAction')
   route.get('/sms', 'Actions/Dashboard/Notifications/NotificationDeliveryIndexAction')
@@ -639,7 +680,7 @@ route.group({ prefix: '/api/notifications', middleware: 'auth' }, () => {
 // Library & Packages
 // ============================================================================
 
-route.group({ prefix: '/library', middleware: 'auth' }, () => {
+route.group({ prefix: '/library', middleware: guarded('/library') }, () => {
   route.get('/dependencies', 'Actions/Dashboard/Library/DependencyIndexAction')
   route.get('/packages', 'Actions/Dashboard/Library/PackageIndexAction')
   route.get('/functions', 'Actions/Dashboard/Library/GetFunctions')
@@ -658,7 +699,7 @@ route.group({ prefix: '/library', middleware: 'auth' }, () => {
 // Deployments
 // ============================================================================
 
-route.group({ prefix: '/deployments', middleware: 'auth' }, () => {
+route.group({ prefix: '/deployments', middleware: guarded('/deployments') }, () => {
   route.get('/', 'Actions/Dashboard/Deployments/GetDeployments')
   route.get('/count', 'Actions/Dashboard/Deployments/GetDeploymentCount')
   route.get('/recent', 'Actions/Dashboard/Deployments/GetRecentDeployments')
@@ -674,7 +715,7 @@ route.group({ prefix: '/deployments', middleware: 'auth' }, () => {
 // Models
 // ============================================================================
 
-route.group({ prefix: '/models', middleware: 'auth' }, () => {
+route.group({ prefix: '/models', middleware: guarded('/models') }, () => {
   route.get('/', 'Actions/Dashboard/Models/GetModels')
   route.get('/user-count', 'Actions/Dashboard/Models/GetUserCount')
   route.get('/subscriber-count', 'Actions/Dashboard/Models/GetSubscriberCount')