anbaric 1.79.3 → 1.80.0

package/docs/README.md

@@ -28,6 +28,7 @@ What the framework gives you, one capability at a time.
 - [File storage](features/file-storage.md) — bytes at a path, local or in your tenant's storage
 - [Auditing](features/auditing.md) — the record of who changed what
 - [Entitlements](features/entitlements.md) — what a user has been granted, checked per request
+- [Public apps](features/public-apps.md) — apps anyone can open without signing in
 - [Skills](features/skills.md) — guidance your builders write for the agents working on your tenant
 - [Prompts](features/prompts.md) — versioned model instructions and schemas, saved at startup
 - [Serving a web UI](features/serving-a-web-ui.md) — putting your data on a page

package/docs/features/deploying.md

@@ -76,6 +76,9 @@ anbaric jobs watch <job-id>     # follow a job as it progresses
   Without the setting, jobs pause from the drain until the new version is up.
   The setting takes effect from the next deploy and is off by default. Anbaric
   Cloud only.
+- **Public apps**, also switched on per app on the Manage apps page, for
+  $100/£100 a month, can be opened by anyone without signing in; see
+  [Public apps](public-apps.md).
 
 ## Updating and tearing down
 

package/docs/features/entitlements.md

@@ -42,12 +42,14 @@ server.on("request", async (request, response) => {
 
 A request with no session, or one the platform can't resolve, is simply not
 entitled - `hasEntitlement` returns `false` rather than throwing.
+That is what a [public app](public-apps.md) sees for an anonymous visitor.
 
 ## Global entitlements
 
 Some entitlements aren't about one app. A **global entitlement** belongs to no
 app and is created in the console, never by `registerEntitlement`. Every tenant
-starts with one, `access`.
+starts with one, `access`. A [public app](public-apps.md) needs no `access`:
+anyone can open it.
 
 A grant can be scoped too. Granting a user `access` **for your app** and
 granting them `access` **globally** both make `hasEntitlement(request, "access")`

package/docs/features/public-apps.md

@@ -0,0 +1,76 @@
+# Public apps
+
+An app is private by default: only members of your tenant can open it, after
+signing in. A **public app** can be opened by anyone with its address, without
+signing in and without the `access` entitlement - a storefront, a booking page,
+a form for your customers.
+
+A builder turns it on per app on the console's **Manage apps** page. It costs
+$100/£100 a month per public app, charged by the day it is public and never
+covered by the free allowance. It takes effect within a few seconds and
+restarts nothing.
+
+## Who your app sees
+
+A public app is reached by two kinds of visitor:
+
+- **A member** of your tenant who is signed in. They arrive with their session,
+  exactly as they would at a private app, so `hasEntitlement` and
+  `Human.fromSession` work for them and your other entitlements still apply.
+- **Anyone else** - a stranger, or someone signed in to Anbaric who belongs to
+  a different tenant. They arrive with **no session at all**. The platform
+  never hands your app a session it did not issue, so nobody's identity from
+  elsewhere reaches your code.
+
+Your app decides what an anonymous visitor may see and do. Check for a member
+before anything that needs one:
+
+```ts
+import {Human, hasEntitlement} from "anbaric";
+
+const visitorOf = async (request : IncomingMessage) : Promise<Human | undefined> => {
+    try {
+        return await Human.fromSession(request);
+    } catch {
+        return undefined;
+    }
+};
+
+server.on("request", async (request, response) => {
+    if (request.url === "/admin" && ! await hasEntitlement(request, "admin")) {
+        response.writeHead(403).end("Members with the admin entitlement only");
+        return;
+    }
+    const visitor = await visitorOf(request);
+    ...
+});
+```
+
+`hasEntitlement` answers `false` for an anonymous visitor rather than throwing;
+`Human.fromSession` throws, which is why it is wrapped above. Anything an
+anonymous visitor does - a job started from a form, say - should be attributed
+to a `Code` actor of your own naming, such as `new Code("storefront")`.
+
+## Letting members sign in
+
+A member who is not signed in is treated as anonymous until they are. Give them
+a link to `/login` on your app's own address:
+
+```html
+<a href="/login">Sign in</a>
+```
+
+It takes them through the sign-in and back to the page the link was on - read
+from the browser's Referer, and only trusted when that page is on your app's
+own address; otherwise they land on your app's home page. Someone already signed
+in goes straight back. An app served under `/app/<name>` rather than its own
+address can link to `/login` the same way.
+
+Prefer serving a public app at its own address (see
+[Serving a web UI](serving-a-web-ui.md)). Under `/app/<name>`, an absolute link
+such as `/styles.css` falls outside the app and is not public.
+
+## Next
+
+- [Entitlements](entitlements.md) - what a member has been granted
+- [Authorization with actors and roles](../patterns/authorization.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric",
-  "version": "1.79.3",
+  "version": "1.80.0",
   "description": "Everything needed to write an Anbaric app: state machines, jobs, document and secret stores, local in-memory implementations and the Anbaric Cloud clients",
   "license": "MIT",
   "type": "module",
@@ -24,9 +24,9 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "anbaric-impl-cloud": "^1.79.3",
-    "anbaric-data-store": "^1.79.3",
-    "anbaric-state-machine": "^1.79.3",
-    "anbaric-tsapi": "^1.79.3"
+    "anbaric-impl-cloud": "^1.80.0",
+    "anbaric-data-store": "^1.80.0",
+    "anbaric-state-machine": "^1.80.0",
+    "anbaric-tsapi": "^1.80.0"
   }
 }