astroidjs 0.7.2 → 0.8.1

package/dist/config.d.ts

@@ -288,6 +288,44 @@ export interface TenancyConfig {
      * makes local dev work, since `wrangler dev` cannot serve subdomains.
      */
     apps?: Record<string, string>;
+    /**
+     * What a syntactically-valid tenant host whose label resolves to NOTHING
+     * (`resolveTenant` returned `null`) should get.
+     *
+     * `"fallthrough"` (the default) renders the ordinary site — which means a
+     * stranger who points a CNAME at your zone gets your homepage. `"404"` emits
+     * a guard that refuses the request instead, which is the right answer the
+     * moment tenant hosts are commercial surfaces: an unknown storefront must be
+     * unambiguously *not a page*, not a copy of the marketing site under someone
+     * else's name.
+     *
+     * Either way the decision stays visible in config rather than buried in the
+     * seam: `resolveTenant` decides *what exists*; this decides what not-existing
+     * means. Reserved labels, app labels, the apex, and off-pattern hosts are
+     * never affected — they aren't tenant candidates at all.
+     */
+    unknown?: "fallthrough" | "404";
+    /**
+     * Path prefixes the host rewrite must leave alone. Default `["/api"]`.
+     *
+     * The rewrite exists to choose which PAGE renders for a host. An API route
+     * is not a page: its address is absolute, chosen by the client that calls
+     * it, and it reads the host from `locals.tenant` rather than from its own
+     * path. Rewriting it moves it somewhere no route matches — and on an app
+     * host with a catch-all page, somewhere much worse than a 404: the page
+     * catch-all answers, so `fetch("/api/…")` gets HTML (or a redirect to a
+     * sign-in) instead of JSON, and every data load on that host silently fails
+     * while the same code works on the apex.
+     *
+     * That is not hypothetical — it is why this default exists (found on
+     * themidwestartist.com's studio, where the whole admin app loaded and then
+     * fetched nothing).
+     *
+     * Set `[]` to rewrite everything, or add prefixes for other host-agnostic
+     * surfaces (`/_actions`, `/webhooks`). Matching is prefix-based on a path
+     * segment, so `/api` matches `/api/x` and `/api` but never `/apiary`.
+     */
+    rewriteExclude?: string[];
 }
 export interface AstroidCron {
     /** Standard 5-field cron, UTC — e.g. `"*&#47;15 * * * *"`. */

package/dist/tenancy/index.d.ts

@@ -1,6 +1,19 @@
 import type { AstroidConfig, TenancyConfig } from "../config.js";
 /** Default internal prefix a tenant request is rewritten to. */
 export declare const ASTROID_TENANT_PREFIX = "/t";
+/** Path prefixes the host rewrite leaves alone unless a site says otherwise.
+ *  See {@link TenancyConfig.rewriteExclude} for why `/api` is the default. */
+export declare const ASTROID_REWRITE_EXCLUDE: string[];
+/**
+ * Whether a path is host-agnostic and must render from its own address rather
+ * than the rewritten one.
+ *
+ * Segment-aware on purpose: a prefix of `/api` must match `/api` and `/api/x`
+ * but never `/apiary`, or a site could lose a page to a coincidental name.
+ *
+ * Exported and pure so a site can unit-test its own exclusion list.
+ */
+export declare function isRewriteExcluded(pathname: string, exclude: string[]): boolean;
 /**
  * The Cloudflare zone a wildcard pattern belongs to.
  *

package/dist/tenancy/index.js

@@ -10,6 +10,21 @@
 // `src/tenancy.ts`.
 /** Default internal prefix a tenant request is rewritten to. */
 export const ASTROID_TENANT_PREFIX = "/t";
+/** Path prefixes the host rewrite leaves alone unless a site says otherwise.
+ *  See {@link TenancyConfig.rewriteExclude} for why `/api` is the default. */
+export const ASTROID_REWRITE_EXCLUDE = ["/api"];
+/**
+ * Whether a path is host-agnostic and must render from its own address rather
+ * than the rewritten one.
+ *
+ * Segment-aware on purpose: a prefix of `/api` must match `/api` and `/api/x`
+ * but never `/apiary`, or a site could lose a page to a coincidental name.
+ *
+ * Exported and pure so a site can unit-test its own exclusion list.
+ */
+export function isRewriteExcluded(pathname, exclude) {
+    return exclude.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix.replace(/\/$/, "")}/`));
+}
 /**
  * The Cloudflare zone a wildcard pattern belongs to.
  *
@@ -115,8 +130,8 @@ export function generateAstroidTenancy(config) {
         " *",
         " * `null` falls through to the ordinary site — which is a real choice, not a",
         " * default: a stranger's subdomain then renders your homepage. If that is wrong",
-        " * for this project, return null here and refuse it in the middleware's `guard`",
-        " * with a 404, so an unknown host is unambiguously not a page.",
+        ' * for this project, set `tenancy.unknown: "404"` in astroid.config.ts and the',
+        " * generated middleware refuses the host instead — unambiguously not a page.",
         " *",
         " * This runs on EVERY request to a tenant host, so a database lookup here is a",
         " * query per request. Cache it — a module-scope Map is enough within an isolate,",

package/dist/worker/generate.js

@@ -17,7 +17,7 @@ import { astroidPortal } from "../portal/config.js";
 import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "../queues/messages.js";
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, usesRealtime, } from "../realtime/scaffold.js";
 import { capturesInquiries } from "../schema/framework.js";
-import { ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
+import { ASTROID_REWRITE_EXCLUDE, ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
 import { astroidEditorRoutePlan } from "./routes.js";
 // Astroid's default editable site_settings surface — the columns the Settings
 // panel may write, and which of them hold a media-library image URL.
@@ -462,6 +462,7 @@ export function generateAstroidMiddleware(config) {
     const portal = astroidPortal(config);
     const tenancy = config.tenancy;
     const rewritePrefix = tenancy?.rewritePrefix ?? ASTROID_TENANT_PREFIX;
+    const rewriteExclude = tenancy?.rewriteExclude ?? ASTROID_REWRITE_EXCLUDE;
     return [
         "// Generated by astroidjs — do not hand-edit.",
         "// The shared Louise middleware: rate-limit the unauthenticated POST surfaces,",
@@ -475,12 +476,11 @@ export function generateAstroidMiddleware(config) {
         // two import statements for the same module is legal and reads as an
         // oversight in a file nobody is supposed to hand-edit.
         `import { ${[
+            ...(tenancy && Object.keys(tenancy.apps ?? {}).length ? ["appPrefix"] : []),
             ...(portal ? ["astroidPortalGuardConfig"] : []),
             "astroidRateRules",
             ...(portal ? ["guardResponse", "portalGuard", "resolvePortalSession"] : []),
-            ...(tenancy
-                ? [...(Object.keys(tenancy.apps ?? {}).length ? ["appPrefix"] : []), "tenantLabel"]
-                : []),
+            ...(tenancy ? ["isRewriteExcluded", "tenantLabel"] : []),
         ].join(", ")} } from "astroidjs";`,
         'import astroidConfig from "../astroid.config.js";',
         ...(tenancy
@@ -548,20 +548,36 @@ export function generateAstroidMiddleware(config) {
                 "  },",
             ]
             : []),
-        ...(portal
+        ...(portal || tenancy?.unknown === "404"
             ? [
-                "  // Route guard: the declarative prefix→roles table from your config.",
-                "  // An /api/* route always answers in JSON — redirecting fetch() to an",
-                "  // HTML login page returns 200 and markup, which reads as success.",
                 "  guard: (context) => {",
-                "    const decision = portalGuard(",
-                "      context.url.pathname,",
-                "      context.locals.portalUser,",
-                "      PORTAL_GUARD,",
-                "    );",
-                "    if (!decision) return undefined;",
-                '    if (decision.kind === "redirect") return context.redirect(decision.location);',
-                "    return guardResponse(decision) ?? undefined;",
+                ...(tenancy?.unknown === "404"
+                    ? [
+                        "    // A syntactically-valid tenant host whose label resolved to nothing is",
+                        '    // NOT a page (config `tenancy.unknown: "404"`). Falling through would',
+                        "    // render the marketing homepage on a stranger's subdomain. Reserved",
+                        "    // labels, app labels, and the apex never reach here — tenantLabel",
+                        "    // returns null for all of them, so they are not tenant candidates.",
+                        "    if (tenantLabel(context.url.hostname, TENANCY) && !context.locals.tenant) {",
+                        '      return new Response("Not found", { status: 404 });',
+                        "    }",
+                    ]
+                    : []),
+                ...(portal
+                    ? [
+                        "    // Route guard: the declarative prefix→roles table from your config.",
+                        "    // An /api/* route always answers in JSON — redirecting fetch() to an",
+                        "    // HTML login page returns 200 and markup, which reads as success.",
+                        "    const decision = portalGuard(",
+                        "      context.url.pathname,",
+                        "      context.locals.portalUser,",
+                        "      PORTAL_GUARD,",
+                        "    );",
+                        "    if (!decision) return undefined;",
+                        '    if (decision.kind === "redirect") return context.redirect(decision.location);',
+                        "    return guardResponse(decision) ?? undefined;",
+                    ]
+                    : ["    return undefined;"]),
                 "  },",
             ]
             : []),
@@ -573,9 +589,17 @@ export function generateAstroidMiddleware(config) {
                 "  // redirect — so links built from Astro.url stay correct.",
                 "  //",
                 "  // An unknown subdomain is YOUR decision: `resolveTenant` returning null",
-                "  // falls through to the ordinary site below. Return a 404 from `guard`",
-                "  // instead if a stranger's subdomain should not render your homepage.",
+                "  // falls through to the ordinary site below — or 404s first, when the",
+                '  // config sets `tenancy.unknown: "404"` (see the guard above).',
                 "  rewrite: (context) => {",
+                "    // Host-agnostic paths render from their own address. An API route is",
+                "    // addressed absolutely by whatever calls it and reads the host from",
+                "    // `locals.tenant`, so rewriting it moves it where no route matches —",
+                "    // and on an app host with a catch-all page, the PAGE answers, so",
+                "    // fetch() gets HTML instead of JSON and every data load quietly fails.",
+                `    if (isRewriteExcluded(context.url.pathname, ${JSON.stringify(rewriteExclude)})) {`,
+                "      return undefined;",
+                "    }",
                 ...(Object.keys(tenancy.apps ?? {}).length
                     ? [
                         "    // First-party app hosts (config `tenancy.apps`): a static label→prefix",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -60,7 +60,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "0.25.0"
+    "louise-toolkit": "0.25.1"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",