@stopnetic/js 0.0.5-pilot → 0.1.0

package/examples/frontend/vue/App.vue

@@ -1,17 +1,17 @@
-<script setup>
-import { RouterLink, RouterView } from 'vue-router';
-import { accessState } from './router.js';
-</script>
-
-<template>
-  <template v-if="accessState === 'allowed'">
-    <header><nav>
-      <RouterLink to="/">Home</RouterLink> <RouterLink to="/members">Members</RouterLink>
-      <RouterLink to="/slow">Slow</RouterLink> <RouterLink to="/blocked">Blocked</RouterLink>
-      <RouterLink to="/offline">Offline</RouterLink>
-    </nav></header>
-    <RouterView/>
-    <footer>Example site</footer>
-  </template>
-  <p v-else-if="accessState === 'denied'" role="alert">Access unavailable.</p>
-</template>
+<script setup>
+import { RouterLink, RouterView } from 'vue-router';
+import { accessState } from './router.js';
+</script>
+
+<template>
+  <template v-if="accessState === 'allowed'">
+    <header><nav>
+      <RouterLink to="/">Home</RouterLink> <RouterLink to="/members">Members</RouterLink>
+      <RouterLink to="/slow">Slow</RouterLink> <RouterLink to="/blocked">Blocked</RouterLink>
+      <RouterLink to="/offline">Offline</RouterLink>
+    </nav></header>
+    <RouterView/>
+    <footer>Example site</footer>
+  </template>
+  <p v-else-if="accessState === 'denied'" role="alert">Access unavailable.</p>
+</template>

package/examples/frontend/vue/Members.vue

@@ -1,14 +1,14 @@
-<script setup>
-import { onMounted, onUnmounted, ref } from 'vue';
-import { loadPrivateData } from '../load-private-data.js';
-const data = ref('Loading data...');
-const controller = new AbortController();
-onMounted(() => {
-  loadPrivateData(controller.signal)
-    .then(value => { if (!controller.signal.aborted) data.value = JSON.stringify(value); })
-    .catch(() => { if (!controller.signal.aborted) data.value = 'API access unavailable.'; });
-});
-onUnmounted(() => controller.abort());
-</script>
-
-<template><main><h1>Members</h1><p>{{ data }}</p></main></template>
+<script setup>
+import { onMounted, onUnmounted, ref } from 'vue';
+import { loadPrivateData } from '../load-private-data.js';
+const data = ref('Loading data...');
+const controller = new AbortController();
+onMounted(() => {
+  loadPrivateData(controller.signal)
+    .then(value => { if (!controller.signal.aborted) data.value = JSON.stringify(value); })
+    .catch(() => { if (!controller.signal.aborted) data.value = 'API access unavailable.'; });
+});
+onUnmounted(() => controller.abort());
+</script>
+
+<template><main><h1>Members</h1><p>{{ data }}</p></main></template>

package/examples/frontend/vue/main.js

@@ -1,4 +1,4 @@
-import { createApp } from 'vue';
-import App from './App.vue';
-import { router } from './router.js';
-createApp(App).use(router).mount('#app');
+import { createApp } from 'vue';
+import App from './App.vue';
+import { router } from './router.js';
+createApp(App).use(router).mount('#app');

package/examples/frontend/vue/router.js

@@ -1,40 +1,40 @@
-import { h, ref } from 'vue';
-import { createRouter, createWebHistory } from 'vue-router';
-import { checkAccess } from '@stopnetic/js/browser';
-import Members from './Members.vue';
-
-export const accessState = ref('checking');
-const page = title => ({ render: () => h('main', h('h1', title)) });
-export const router = createRouter({
-  history: createWebHistory(),
-  routes: [
-    { path: '/', component: page('Home') },
-    { path: '/members', component: Members },
-    { path: '/slow', component: page('Slow') },
-    { path: '/blocked', component: page('Blocked') },
-    { path: '/offline', component: page('Offline') },
-  ],
-});
-
-let current;
-let approvedPath = '';
-router.beforeEach(async to => {
-  current?.abort();
-  const controller = new AbortController();
-  current = controller;
-  approvedPath = '';
-  accessState.value = 'checking';
-  try {
-    const result = await checkAccess(to.fullPath.split('#')[0], { signal: controller.signal });
-    if (controller.signal.aborted) return false;
-    if (result.allowed) { approvedPath = to.fullPath; return true; }
-    if (result.reason === 'verification_required' && result.verificationUrl) {
-      location.assign(result.verificationUrl);
-    }
-    accessState.value = 'denied';
-  } catch { if (!controller.signal.aborted) accessState.value = 'denied'; }
-  return false;
-});
-router.afterEach((to, _from, failure) => {
-  if (!failure && approvedPath === to.fullPath) accessState.value = 'allowed';
-});
+import { h, ref } from 'vue';
+import { createRouter, createWebHistory } from 'vue-router';
+import { checkAccess } from '@stopnetic/js/browser';
+import Members from './Members.vue';
+
+export const accessState = ref('checking');
+const page = title => ({ render: () => h('main', h('h1', title)) });
+export const router = createRouter({
+  history: createWebHistory(),
+  routes: [
+    { path: '/', component: page('Home') },
+    { path: '/members', component: Members },
+    { path: '/slow', component: page('Slow') },
+    { path: '/blocked', component: page('Blocked') },
+    { path: '/offline', component: page('Offline') },
+  ],
+});
+
+let current;
+let approvedPath = '';
+router.beforeEach(async to => {
+  current?.abort();
+  const controller = new AbortController();
+  current = controller;
+  approvedPath = '';
+  accessState.value = 'checking';
+  try {
+    const result = await checkAccess(to.fullPath.split('#')[0], { signal: controller.signal });
+    if (controller.signal.aborted) return false;
+    if (result.allowed) { approvedPath = to.fullPath; return true; }
+    if (result.reason === 'verification_required' && result.verificationUrl) {
+      location.assign(result.verificationUrl);
+    }
+    accessState.value = 'denied';
+  } catch { if (!controller.signal.aborted) accessState.value = 'denied'; }
+  return false;
+});
+router.afterEach((to, _from, failure) => {
+  if (!failure && approvedPath === to.fullPath) accessState.value = 'allowed';
+});

package/examples/ssr/angular/app.routes.server.ts

@@ -0,0 +1,5 @@
+import { RenderMode, ServerRoute } from '@angular/ssr';
+export const serverRoutes: ServerRoute[] = [
+  // Demo only: merge with existing hybrid modes rather than replacing them.
+  { path: '**', renderMode: RenderMode.Server },
+];

package/examples/ssr/angular/server.ts

@@ -0,0 +1,12 @@
+// Merge into your existing Node SSR entry; retain host settings and context.
+import { AngularAppEngine, createRequestHandler } from '@angular/ssr';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+const engine = new AngularAppEngine();
+let guarded: ReturnType<typeof createStopneticAppHandler> | undefined;
+async function handle(request: Request): Promise<Response> {
+  guarded ??= createStopneticAppHandler(async checked =>
+    await engine.handle(checked) ?? new Response(null, { status: 404 }));
+  return guarded(request);
+}
+export const reqHandler = createRequestHandler(handle);

package/examples/ssr/astro/middleware.js

@@ -0,0 +1,11 @@
+// src/middleware.js. Keep the existing Node deployment adapter.
+import { defineMiddleware } from 'astro:middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let guarded;
+export const onRequest = defineMiddleware(async (context, next) => {
+  // Public prerender builds only; protected pages must export prerender=false.
+  if (context.isPrerendered) return next();
+  guarded ??= createStopneticAppHandler((_request, run) => run());
+  return guarded(context.request, () => next());
+});

package/examples/ssr/astro/page.astro

@@ -0,0 +1,4 @@
+---
+// Merge this flag into a protected page, preserving its existing content.
+export const prerender = false;
+---

package/examples/ssr/node/fetch.mjs

@@ -0,0 +1,9 @@
+// Wrap your existing Node Request -> Response renderer; retain all context.
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+export function protectSSR(renderApplication) {
+  let guarded;
+  return (request, ...context) => {
+    guarded ??= createStopneticAppHandler(renderApplication);
+    return guarded(request, ...context);
+  };
+}

package/examples/ssr/node/install.mjs

@@ -0,0 +1,9 @@
+// Call before parsers, static files, APIs and your existing Node SSR renderer.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}

package/examples/ssr/nuxt/middleware.mjs

@@ -0,0 +1,10 @@
+// server/middleware/00-stopnetic.mjs. Nuxt 3/4, Nitro 2, H3 1, NODE only.
+// Use server middleware, not app/middleware or defineNuxtRouteMiddleware.
+import { fromNodeMiddleware } from 'h3';
+import { createStopneticServer } from '@stopnetic/js/server';
+
+let server;
+export default fromNodeMiddleware((req, res, next) => {
+  server ??= createStopneticServer();
+  return server.access(req, res, () => server.guard(req, res, next));
+});

package/examples/ssr/react/install.mjs

@@ -0,0 +1,10 @@
+// Existing custom React SSR server: call before assets, APIs and React rendering.
+// Keep renderToPipeableStream/renderToReadableStream and hydration unchanged.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticReactSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}

package/examples/ssr/react-router/install.mjs

@@ -0,0 +1,22 @@
+// Call installStopneticReactRouter(app) before parsers, assets and the existing
+// @react-router/express createRequestHandler. Keep that handler/context intact.
+import { createStopneticServer } from '@stopnetic/js/server';
+
+export function installStopneticReactRouter(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => {
+      // React Router 7 single-fetch data URLs must use the page's policy.
+      // The renderer still receives the original request and unread body.
+      const url = new URL(req.originalUrl || req.url, 'https://example.invalid');
+      let checked = req;
+      if (url.pathname.endsWith('.data')) {
+        url.pathname = url.pathname === '/_root.data' ? '/' : url.pathname.slice(0, -5);
+        checked = Object.create(req);
+        checked.originalUrl = url.pathname + url.search;
+      }
+      return server.guard(checked, res, next);
+    });
+  });
+}

package/examples/ssr/solidstart/middleware-v1.js

@@ -0,0 +1,19 @@
+// SolidStart 1: register using defineConfig({ middleware: './src/middleware.js' }).
+// Keep the existing entry-server.tsx renderer. This is NOT SolidStart 2 config.
+import { createMiddleware } from '@solidjs/start/middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let check;
+export default createMiddleware({
+  onRequest: async event => {
+    check ??= createStopneticAppHandler((_request, state) => {
+      state.allowed = true;
+      return new Response(null, { status: 204 });
+    });
+    const state = { allowed: false };
+    const response = await check(event.request, state);
+    if (!state.allowed) return response;
+    event.response.headers.set('cache-control', 'private, no-store');
+    // undefined continues to SolidStart; preserve its rendering and API handling.
+  },
+});

package/examples/ssr/solidstart/middleware-v2.js

@@ -0,0 +1,25 @@
+// SolidStart 2: register this module using solidStart({ middleware: ... }).
+import { createMiddleware } from '@solidjs/start/middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let check;
+export default createMiddleware([
+  async (event, next) => {
+    check ??= createStopneticAppHandler((_request, state) => {
+      state.allowed = true;
+      return new Response(null, { status: 204 });
+    });
+    // Per-request state: a verification 204 must NEVER be mistaken for permission.
+    const state = { allowed: false };
+    const response = await check(event.req, state);
+    if (!state.allowed) return response;
+    event.res.headers.set('cache-control', 'private, no-store');
+    const result = await next(); // Preserve H3/SolidStart context and raw results.
+    if (!(result instanceof Response)) return result;
+    const headers = new Headers(result.headers);
+    headers.set('cache-control', 'private, no-store');
+    return new Response(result.body, {
+      status: result.status, statusText: result.statusText, headers,
+    });
+  },
+]);

package/examples/ssr/sveltekit/hooks.server.js

@@ -0,0 +1,16 @@
+import { building } from '$app/environment';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let guarded;
+// When merging existing hooks, run this first and put them in the continuation.
+export async function handle({ event, resolve }) {
+  // Build-time public prerendering only. Protected routes must have prerender=false.
+  if (building) return resolve(event);
+  guarded ??= createStopneticAppHandler((_request, run) => run());
+  // SvelteKit exposes the canonical page URL on data requests. Check that page
+  // rather than allowing an unmatched /members/__data.json alias through.
+  const checked = event.isDataRequest
+    ? new Request(event.url, { method: event.request.method, headers: event.request.headers })
+    : event.request;
+  return guarded(checked, () => resolve(event));
+}

package/examples/ssr/sveltekit/page.server.js

@@ -0,0 +1,3 @@
+// Merge into the PROTECTED route's +page.server.js, retaining loads/actions.
+export const prerender = false;
+export const ssr = true;

package/examples/ssr/vue/install.mjs

@@ -0,0 +1,10 @@
+// Existing custom Vue SSR server: call before assets, APIs and Vue rendering.
+// Keep createSSRApp/renderToString and client hydration unchanged.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticVueSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}

package/package.json

@@ -1,45 +1,68 @@
 {
   "name": "@stopnetic/js",
-  "version": "0.0.5-pilot",
+  "version": "0.1.0",
   "description": "Server-side Stopnetic guard for JavaScript websites, Node.js and Express-compatible servers.",
   "type": "module",
   "license": "MIT",
   "author": "Stopnetic",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/KlimentSidorov/stopin.git",
+    "url": "git+https://github.com/KlimentSidorov/stopnetic.git",
     "directory": "integrations/javascript"
   },
   "keywords": [
     "stopnetic",
     "javascript",
+    "typescript",
     "nodejs",
     "express",
+    "react",
+    "angular",
+    "vue",
+    "svelte",
     "access-control"
   ],
   "files": [
     "dist",
     "bin",
-    "examples/frontend"
+    "examples/frontend",
+    "examples/ssr"
   ],
-  "bin": { "stopnetic-js": "./bin/stopnetic-js.js" },
+  "bin": {
+    "stopnetic-js": "./bin/stopnetic-js.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
-    "./server": { "types": "./dist/server.d.ts", "default": "./dist/server.js" },
-    "./browser": { "types": "./dist/browser.d.ts", "default": "./dist/browser.js" },
-    "./react": { "types": "./dist/react.d.ts", "default": "./dist/react.js" }
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./browser": {
+      "types": "./dist/browser.d.ts",
+      "default": "./dist/browser.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "default": "./dist/react.js"
+    }
+  },
+  "peerDependencies": {
+    "react": "*"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
   },
-  "peerDependencies": { "react": "*" },
-  "peerDependenciesMeta": { "react": { "optional": true } },
   "engines": {
     "node": ">=22"
   },
   "publishConfig": {
     "access": "public",
-    "tag": "pilot",
+    "tag": "latest",
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
@@ -51,5 +74,9 @@
   "devDependencies": {
     "express": "^4.22.3",
     "express5": "npm:express@^5.2.1"
+  },
+  "homepage": "https://github.com/KlimentSidorov/stopnetic/tree/main/integrations/javascript#readme",
+  "bugs": {
+    "url": "https://github.com/KlimentSidorov/stopnetic/issues"
   }
 }