@tideworthy/tidysites-platform 0.10.10 → 0.10.12

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.10.12
+
+- The staging site is never indexed: every response carries `X-Robots-Tag: noindex, nofollow`, robots.txt disallows everything and the sitemap answers 404. The publish crawl still gets the real robots.txt and sitemap for the live copy.
+
+## 0.10.11
+
+- Editor bar: Request a change comes first and carries the blue; Edit follows it plain.
+
 ## 0.10.10
 
 - Editor: the bar reads Edit, Request a change, Revisions, Publish live; Publish live is green.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tideworthy/tidysites-platform",
-	"version": "0.10.10",
+	"version": "0.10.12",
 	"description": "The Tidysites platform integration for EmDash sites: bootstrap, sessions, maintenance, health, and publish hooks under /_tidy/*.",
 	"license": "MIT",
 	"type": "module",

package/src/editor/TidyEditor.astro

@@ -58,7 +58,7 @@ const htmlClass = !signedIn ? (signInUrl ? "tidy-has-bar tidy-idle" : "") : !act
 			<span class="tidy-bar-label"><span class="tidy-bar-dot" aria-hidden="true"></span>{label} website<span class="tidy-bar-note">A private copy to see working changes on the website, not publicly accessible.</span></span>
 			<div class="tidy-bar-actions" id="tidy-bar-actions">
 				{!signedIn && <a class="tidy-btn tidy-btn-primary" href={signInUrl!}>Sign in to edit</a>}
-				{signedIn && !active && <a class="tidy-btn tidy-btn-primary" href={toggle(true)}>Edit</a>}
+				{signedIn && !active && <a class="tidy-btn" href={toggle(true)}>Edit</a>}
 				{signedIn && active && !editable && <a class="tidy-btn" href={toggle(false)}>Done</a>}
 			</div>
 		</div>

package/src/editor/request.ts

@@ -85,10 +85,10 @@ export function mountRequestChange(): void {
 		body.focus();
 	}
 
-	const barBtn = el("button", { type: "button", class: "tidy-btn", text: "Request a change" });
+	const barBtn = el("button", { type: "button", class: "tidy-btn tidy-btn-primary", text: "Request a change" });
 	barBtn.addEventListener("click", render);
-	// Right after Edit (or Done), before Revisions and Publish live.
-	actions.insertBefore(barBtn, actions.children[1] ?? null);
+	// First on the bar: most people are here to ask for a change, not to edit.
+	actions.prepend(barBtn);
 
 	const fab = el("button", { type: "button", class: "tidy-fab", title: "Request a change", "aria-label": "Request a change" });
 	fab.innerHTML = '<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 20h9"/><path d="M16.376 3.622a1 1 0 0 1 3.002 3.002L7.368 18.635a2 2 0 0 1-.855.506l-2.872.838a.5.5 0 0 1-.62-.62l.838-2.872a2 2 0 0 1 .506-.854z"/></svg>';

package/src/middleware.ts

@@ -1,20 +1,44 @@
-/** Astro middleware registered by tidyPlatform(): the framing policy from TIDY_FRAME_ANCESTORS. */
+/**
+ * Astro middleware registered by tidyPlatform(): the framing policy from
+ * TIDY_FRAME_ANCESTORS, and no indexing of the staging site. This worker is
+ * the staging site (the live site is a static copy served by its own small
+ * worker), so every answer here carries noindex, robots.txt disallows
+ * everything and the sitemap is gone. The publish crawl identifies itself
+ * and gets the real robots.txt and sitemap, which is what the live copy
+ * ships.
+ */
 import type { MiddlewareHandler } from "astro";
 import { workerEnv } from "./lib/env";
 import { applyFramePolicy, frameAncestors } from "./lib/frame";
 
-export const onRequest: MiddlewareHandler = async (_context, next) => {
+const PUBLISH_CRAWL = "tidysites-publish";
+const NOINDEX = "noindex, nofollow";
+
+export const onRequest: MiddlewareHandler = async (context, next) => {
+	const crawl = context.request.headers.get("user-agent") === PUBLISH_CRAWL;
+	if (!crawl) {
+		const path = context.url.pathname;
+		if (path === "/robots.txt") {
+			return new Response("User-agent: *\nDisallow: /\n", { headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", "x-robots-tag": NOINDEX } });
+		}
+		if (path === "/sitemap.xml" || path === "/sitemap-index.xml" || /^\/sitemap-\d+\.xml$/.test(path)) {
+			return new Response("Not found", { status: 404, headers: { "cache-control": "no-store", "x-robots-tag": NOINDEX } });
+		}
+	}
 	const response = await next();
 	const env = await workerEnv();
 	const ancestors = frameAncestors(env?.TIDY_FRAME_ANCESTORS);
-	if (ancestors.length === 0) return response;
+	const apply = (headers: Headers) => {
+		if (ancestors.length > 0) applyFramePolicy(headers, ancestors);
+		if (!crawl) headers.set("x-robots-tag", NOINDEX);
+	};
 	// Response headers can be immutable (static assets, redirects); rebuild when so.
 	try {
-		applyFramePolicy(response.headers, ancestors);
+		apply(response.headers);
 		return response;
 	} catch {
 		const copy = new Response(response.body, response);
-		applyFramePolicy(copy.headers, ancestors);
+		apply(copy.headers);
 		return copy;
 	}
 };

package/src/version.ts

@@ -1,3 +1,3 @@
 /** Kept in step with package.json by the release checklist in MAINTAINING.md. */
-export const VERSION = "0.10.10";
+export const VERSION = "0.10.12";
 export const PLUGIN_ID = "tidy-platform";