caracms 0.2.0 → 0.3.0

package/src/files-route.ts

@@ -29,7 +29,7 @@
  *    `CARACMS_PRELAUNCH` in this same process), so a shared cache never keeps it.
  */
 import type { APIRoute } from 'astro';
-import { clientIp } from './live/auth/request.ts';
+import { clientIp, NO_GATE_MESSAGE } from './live/auth/request.ts';
 import { fileAddress, fileKeyOf, fileTypeOf } from './files.ts';
 import { s3Bucket, type Bucket } from './editor/server/media/bucket.ts';
 import { readImagesConfig } from './editor/server/media/config.ts';
@@ -67,7 +67,7 @@ export interface FileRouteContext {
 	/** Default `process.env`, read on each request. */
 	env?: Env;
 	production?: boolean;
-	/** The socket's address (Astro's `clientAddress`), read after `X-Real-IP`. */
+	/** The socket's address (Astro's `clientAddress`), read after `X-Real-IP` under `astro dev`. */
 	clientAddress?: () => string | undefined;
 	/** Default the process's own (`filesLimiter`). */
 	limiter?: RateLimiter;
@@ -147,10 +147,15 @@ export async function handleFileRequest(request: Request, ctx: FileRouteContext
 		}
 	}
 
+	// Runs-anywhere Decision 8: a production server not started by `caracms start` has no gate, so no visitor's IP for the limit.
+	const production = ctx.production ?? isProductionBuild();
+	const ip = clientIp(request, ctx.clientAddress ?? (() => undefined), production);
+	if (ip === null) return text(503, NO_GATE_MESSAGE, {}, head);
+
 	// 4. The media variables.
 	const env = ctx.env ?? process.env;
 	const log = ctx.log ?? ((line: string) => console.error(line));
-	const config = readImagesConfig(env, ctx.production ?? isProductionBuild());
+	const config = readImagesConfig(env, production);
 	if (config.kind === 'unset') {
 		logOnce(log, `[caracms] files: /files/ answers 503: ${config.message}${config.missing.length ? ` (missing: ${config.missing.join(', ')})` : ''}`);
 		return text(503, UNAVAILABLE_TEXT, {}, head);
@@ -158,7 +163,7 @@ export async function handleFileRequest(request: Request, ctx: FileRouteContext
 
 	// 5. The visitor's allowance.
 	const limiter = ctx.limiter ?? filesLimiter(env);
-	if (await limiter.hit(clientIp(request, ctx.clientAddress ?? (() => undefined)))) {
+	if (await limiter.hit(ip)) {
 		return text(429, RATE_LIMITED_TEXT, { 'Retry-After': String(Math.ceil(FILES_LIMIT.windowMs / 1000)) }, head);
 	}
 

package/src/forms/endpoint.ts

@@ -37,8 +37,9 @@
  */
 import type { ResolvedSite } from '../config.ts';
 import { publicOrigin } from '../live/auth/index.ts';
-import { clientIp } from '../live/auth/request.ts';
+import { clientIp, NO_GATE_MESSAGE } from '../live/auth/request.ts';
 import { readCapped } from '../editor/server/media/upload.ts';
+import { isProductionBuild } from '../media.ts';
 import { readFormSettings, sendNotification, type FormSettings } from './email.ts';
 import { formLimiter, type FormRateLimiter } from './rate-limit.ts';
 import { cleanReturn, FILE_KINDS, FILE_TYPES, formsAcceptFiles, HONEYPOT, looksLikeEmail, MAX_FILE_BYTES, MAX_FILES, type ResolvedForm } from './rules.ts';
@@ -65,24 +66,14 @@ export const BAD_EMAIL_MESSAGE = "That email address doesn't look right.";
 export const TURNSTILE_VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
 const TURNSTILE_TIMEOUT_MS = 5_000;
 
-/** `SITE_URL` as an address (an http(s) origin), or undefined when it's unset or isn't one. */
-function siteUrlFromEnv(env: Env): URL | undefined {
-	const raw = env['SITE_URL']?.trim();
-	if (!raw) return undefined;
-	try {
-		const url = new URL(raw);
-		return url.protocol === 'https:' || url.protocol === 'http:' ? url : undefined;
-	} catch {
-		return undefined;
-	}
-}
-
 export { cleanReturn };
 
 export interface FormContext {
 	site: Pick<ResolvedSite, 'root' | 'forms' | 'timeZone'>;
-	/** The socket's address (Astro's `clientAddress`), read after `X-Real-IP`. */
+	/** The socket's address (Astro's `clientAddress`), read after `X-Real-IP` under `astro dev`. */
 	clientAddress?: () => string | undefined;
+	/** A production server: the IP comes from `caracms start`'s gate only (runs-anywhere Decision 8). Default: the build's define. */
+	production?: boolean;
 	env?: Env;
 	/** Astro's `site` (the route passes `context.site`): the public origin for the email's editor link. */
 	astroSite?: URL;
@@ -244,7 +235,11 @@ export async function handleForm(request: Request, ctx: FormContext): Promise<Re
 		return reply(405, { error: 'This address takes a form post.' }, { Allow: 'POST' });
 	}
 
-	const ip = clientIp(request, ctx.clientAddress ?? (() => undefined));
+	const ip = clientIp(request, ctx.clientAddress ?? (() => undefined), ctx.production ?? isProductionBuild());
+	if (ip === null) {
+		await request.body?.cancel().catch(() => {});
+		return reply(503, { error: NO_GATE_MESSAGE });
+	}
 	const takesFiles = formsAcceptFiles(ctx.site.forms);
 	const declared = Number(request.headers.get('content-length') ?? NaN);
 	const multipart = (request.headers.get('content-type') ?? '').toLowerCase().includes('multipart/form-data');
@@ -332,7 +327,7 @@ export async function handleForm(request: Request, ctx: FormContext): Promise<Re
 	let email;
 	try {
 		const settings = await (ctx.readSettings ?? (() => readFormSettings(ctx.site.root)))();
-		const siteUrl = publicOrigin(ctx.astroSite ?? siteUrlFromEnv(env), env);
+		const siteUrl = publicOrigin(ctx.astroSite, env);
 		email = await sendNotification({ submission, form, settings, siteUrl, timeZone: ctx.site.timeZone, env, fetch: ctx.fetch, now, log });
 	} catch (error) {
 		email = { status: 'failed' as const, at: now().toISOString(), to: [], error: `Could not read Site Settings: ${error instanceof Error ? error.message : String(error)}` };

package/src/head.ts

@@ -104,12 +104,20 @@ export function googleTagSnippet(tag: NonNullable<Head['googleTag']>): string {
 	return `<script async src="https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(tag.id)}"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${id});</script>`;
 }
 
+/**
+ * An address served from a `build.format: 'file'` prerender (`/about.html`, Home at
+ * `/index.html`) as the page's own address (`/about`, `/`): a document's address never ends in
+ * `.html` (Urban Return port). Others are kept as they are.
+ */
+export const withoutHtml = (path: string): string => path.replace(/(?:\/index)?\.html$/, '') || '/';
+
 /**
  * PageProps' `path` (MEC trial item 2): the document's address, the same in a public render
  * and in its preview. A preview's is `previewUrl`, its document's URL (content.ts →
  * documentUrl; null when it has no page). A public render's is the address it's served at,
  * decoded, with no trailing slash, and a paged listing's `/page/N` taken off (`listPage` > 1):
- * `/journal/page/2` is `/journal`'s page 2.
+ * `/journal/page/2` is `/journal`'s page 2. A `build.format: 'file'` prerender's `.html` comes
+ * off too (`withoutHtml`).
  */
 export function documentPath(input: { preview: boolean; previewUrl: string | null; pathname: string; listPage: number }): string | null {
 	if (input.preview) return input.previewUrl === null ? null : cleanPath(input.previewUrl) || '/';
@@ -120,6 +128,7 @@ export function documentPath(input: { preview: boolean; previewUrl: string | nul
 		// Not valid percent-encoding: kept as it came.
 	}
 	path = cleanPath(path) || '/';
+	path = withoutHtml(path);
 	if (input.listPage > 1) path = path.replace(new RegExp(`/page/${input.listPage}$`), '') || '/';
 	return path;
 }

package/src/index.ts

@@ -48,7 +48,8 @@
  */
 import type { AstroIntegration } from 'astro';
 import { fontProviders } from 'astro/config';
-import { readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { isAbsolute, join, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -59,6 +60,7 @@ import { writeSchemaFiles } from './cli/schemas.ts';
 import { configFile } from './cli/site.ts';
 import { readCodeRoutes } from './code-routes-disk.ts';
 import { GUARD_MIDDLEWARE, LOGIN_ROUTES } from './live/auth/routes.ts';
+import { HOST_COMMIT_VARIABLES } from './live/mode.ts';
 
 
 export type { SiteConfig, ResolvedSite } from './config.ts';
@@ -169,6 +171,25 @@ export function siteAddress(astroSite: string | undefined, env: Record<string, s
 	return { url: `${url.origin}${url.pathname}`.replace(/\/+$/, ''), problem: null };
 }
 
+/**
+ * Runs-anywhere Decision 9: the commit a build is made from, baked into the server.
+ * CARACMS_RUNNING_COMMIT or a host's commit variable at build, else `git rev-parse HEAD`
+ * when the build has a `.git` folder (Railway's and most Docker builds don't); null
+ * when neither. A value at run time wins over it (live/mode.ts → `runningCommitFrom`).
+ */
+export function buildCommit(root: string, env: Record<string, string | undefined> = process.env): string | null {
+	for (const name of ['CARACMS_RUNNING_COMMIT', ...HOST_COMMIT_VARIABLES]) {
+		const v = env[name]?.trim();
+		if (v) return v;
+	}
+	try {
+		const sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString().trim();
+		return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+	} catch {
+		return null;
+	}
+}
+
 /** Pre-M7 item 8: Site Settings' redirects, served as 301s on the public site. */
 export const REDIRECT_MIDDLEWARE = 'redirect-middleware.ts';
 
@@ -198,10 +219,11 @@ export function contentWatchIgnores(site: Pick<ResolvedSite, 'collections' | 'ro
 /**
  * The hosts Astro may take a request's address from (`security.allowedDomains`).
  * Without them, Astro ignores the Host header and every request reads as
- * `localhost:<port>`. Behind Railway's edge that breaks the same-origin checks on the
+ * `localhost:<port>`. Behind a host's proxy that breaks the same-origin checks on the
  * sign-in form and the editor's writes, and the addresses the pages show. Taken from
- * Astro's `site`, then Railway's public domain: the same sources as emailed links
- * (live/auth/index.ts → `publicOrigin`). A site's own `allowedDomains` wins.
+ * Astro's `site` (SITE_URL when the config sets none: `siteAddress`), then Railway's
+ * public domain: the same chain as emailed links (live/mode.ts → `addressFrom`;
+ * runs-anywhere Decision 7). A site's own `allowedDomains` wins.
  * Read at build time: Astro puts the list in the server's manifest.
  */
 export function trustedDomains(
@@ -301,8 +323,23 @@ async function loadSiteEnv(mode: string, root: string): Promise<Record<string, s
 	return loadEnv(mode, root, '');
 }
 
+/**
+ * Runs-anywhere Decisions 7 and 9: what a build baked in, also written beside the server's
+ * entry (`dist/server/caracms-build.json`) for `caracms start`'s gate, which can't import
+ * the site: `{ "site": "https://fernhill.ie" | null, "commit": "<sha>" | null }`. `site` is
+ * Astro's `site` as built (the config's, else SITE_URL's: `siteAddress`); `commit` is
+ * `buildCommit()`'s.
+ */
+export const BUILD_INFO_FILE = 'caracms-build.json';
+export interface BuildInfo {
+	site: string | null;
+	commit: string | null;
+}
+
 export default function caracms(config: SiteConfig): AstroIntegration {
 	let site: ResolvedSite;
+	let buildInfo: BuildInfo | null = null;
+	let serverDir: URL | null = null;
 	return {
 		name: 'caracms',
 		hooks: {
@@ -369,8 +406,10 @@ export default function caracms(config: SiteConfig): AstroIntegration {
 				const domains = trustedDomains(astroConfig.site ?? address.url ?? undefined, astroConfig.security?.allowedDomains);
 				if (command === 'build' && !astroConfig.security?.allowedDomains?.length) {
 					if (domains.length) logger.info(`trusting the Host header for ${domains.map((d) => d.hostname).join(', ')}`);
-					else logger.warn("the site's public address isn't known (set Astro's `site`, or build on Railway): behind a proxy, sign-in and the editor's saves will be refused as cross-origin.");
+					else logger.warn("the site's public address isn't known (set SITE_URL, at build and at run time): behind a proxy, sign-in and the editor's saves will be refused as cross-origin.");
 				}
+				const commit = dev ? null : buildCommit(site.root);
+				if (command === 'build') buildInfo = { site: address.url, commit };
 
 				updateConfig({
 					...(!astroConfig.site && address.url ? { site: address.url } : {}),
@@ -382,6 +421,9 @@ export default function caracms(config: SiteConfig): AstroIntegration {
 						define: {
 							__CARACMS_HARFBUZZ__: JSON.stringify(harfbuzz),
 							__CARACMS_PRODUCTION__: JSON.stringify(!dev),
+							// Runs-anywhere Decisions 7 and 9: the address and the commit the build was made with (editor/server/mode.ts → bakedAtBuild).
+							__CARACMS_SITE__: JSON.stringify(astroConfig.site ?? address.url ?? null),
+							__CARACMS_BUILD_COMMIT__: JSON.stringify(commit),
 							__CARACMS_TOKENS_CSS__: JSON.stringify(readFileSync(new URL('./editor/styles/tokens.css', import.meta.url), 'utf8')),
 						},
 						// Installed from npm, the package ships TypeScript and .astro source.
@@ -425,8 +467,12 @@ export default function caracms(config: SiteConfig): AstroIntegration {
 			},
 			// Posts and tags, Decision 15: a production build reads each document once (read.ts). Never in dev.
 			'astro:build:start': () => shareBuildReads(true),
-			'astro:build:done': () => shareBuildReads(false),
-			'astro:config:done': ({ injectTypes }) => {
+			'astro:build:done': () => {
+				shareBuildReads(false);
+				if (buildInfo && serverDir && existsSync(serverDir)) writeFileSync(new URL(BUILD_INFO_FILE, serverDir), `${JSON.stringify(buildInfo)}\n`);
+			},
+			'astro:config:done': ({ injectTypes, config: done }) => {
+				serverDir = done.build.server;
 				injectTypes({ filename: 'caracms.d.ts', content: '/// <reference types="caracms/virtual" />\n' });
 			},
 		},

package/src/live/README.md

@@ -13,13 +13,15 @@ live drafts store, sweep, locks and status route, and Phase 3's sign-in, sit on
 | `merge.ts` | `mergeFile({ base, draft, other })`: the per-key three-way merge, pure and byte-preserving |
 | `messages.ts` | The commit-message contract (`draftMessage`, `mergeMessage`, `publishMessage`, `parseMessage`), `Person`, `displayName` |
 | `status.ts` | Pure: `waitingFromCommits()`, `publishState()`, `PublishRecord` |
-| `redis.ts` | `RedisClient`; `connectRedis(url)` (ioredis with M1 → R2's retry and idle close) and `memoryRedis()` (the stand-in, with `calls` and `flush()`) |
+| `redis.ts` | `RedisClient`; `connectRedis(url)` (ioredis with M1 → R2's retry and idle close) and `memoryRedis()` (the stand-in, with `calls` and `flush()`). Redis diet: `batch()`, a pipeline sent again whole only when every command in it is safe to send twice |
+| `status-cache.ts` | Redis diet. `StatusCache` (one per process, `git.statusCache`): what the status poll reads, by Redis key, re-read once 30 s old, refreshes single-flight; the modules that write Redis tell it what landed (`string`, `hash`, `add`, `drop`, `landed`) |
+| `notices.ts` | Redis diet. `Notices`: "published as it stood" notices and dismissed "draft kept" ones, written through the status cache |
 | `backend.ts` | `GitBackend`; `GitHubBackend`, `MemoryBackend` (test helpers: `seed`, `push`, `file`, `deployments`, `beforeRequest`); `StaleHeadError` |
 | `branches.ts` | `Branch` (a role: `main` or `drafts`), `BranchNames` (the refs behind them), `DEFAULT_BRANCHES`. `CARACMS_MAIN_BRANCH` and `CARACMS_DRAFTS_BRANCH` (read by `mode.ts`, M9 Decision 6) name the branch Publish commits to and the one autosaves land on; unset, `main` and `drafts`. They're set together or not at all: one alone is a problem, so the mode is unconfigured (`/admin` answers 503 saying both must be set; the public site still serves). Only the backends turn a role into a ref name, so with both set a branch called `main` is never read or moved. `MemoryBackend.refs` is keyed by name |
 | `github.ts` | The App's JWT, the installation token (one repo, refreshed early), `Tracker` (request counts) |
 | `webhook.ts` | `handleGithubWebhook()`, behind `POST /_caracms/github` (`../editor/routes/github.ts`) |
 | `autosaves.ts` | Phase 2. Autosaves in Redis (`caracms:autosave:<file>`, a week; stored compare-and-set, ordered per tab by `X-Caracms-Seq`), the session's last commit (the merge's ancestor) and who last changed a document (Decision 11; no expiry, and `known: false` when neither Redis nor git can say). M5a: a new document's autosave carries `created: { over }` (its ancestor until committed), a deletion is a "gone" autosave (`text` and `document` null, `gone: { title }`) |
-| `locks.ts` | Phase 2. `Locks`: taken by the first write, heartbeat on the poll, lapse only once committed, releasing, Edit here; presence |
+| `locks.ts` | Phase 2. `Locks`: taken by the first write, heartbeat on the poll (Redis diet: only when `needsBeat`), lapse only once committed, releasing, Edit here; presence, each record holding for twice its tab's poll interval plus 3 s |
 | `sweep.ts` | Phase 2. `Sweep`: one commit per tick for everything ready; ticks only while something is pending (no Redis call otherwise); `commitAll` fills `git.commitPending` |
 | `drafts-store.ts` | Phase 2. The live `DraftsStore`: the copy with autosaves on top (a gone one leaves the file out); `write` takes the lock and stores the autosave. M5a Phase 3: `create` (the lock, then the new document as an autosave) and `delete` (the lock, then a gone autosave, the lock released to drop once committed), with `editor/server/create.ts`'s rules. M5a: any kind of document; Site Settings' autosave is marked `sweepAtOnce` (the sweep commits it on its next tick, no idle wait); `source()` is the copy with every autosave on top (a preview's reads) |
 | `editor.ts` | Phase 2. `createLiveEditor(runtime)` / `liveEditor(site, settings)`: the store, sweep and locks, and the handlers for write, status, lock, publish, history, try-again, notice |

package/src/live/auth/auth.ts

@@ -65,6 +65,8 @@ export interface AuthOptions {
 
 export interface Auth {
 	readonly secure: boolean;
+	/** The site's public origin (`AuthOptions.siteOrigin`): the mismatch sentences name it (runs-anywhere Decision 7). */
+	readonly siteOrigin: string | null;
 	readonly cookieName: string;
 	readonly whitelist: Whitelist;
 	readonly links: LinkStore;
@@ -97,6 +99,7 @@ export function createAuth(options: AuthOptions): Auth {
 
 	return {
 		secure: options.secure,
+		siteOrigin: options.siteOrigin,
 		cookieName,
 		whitelist,
 		links,
@@ -136,7 +139,7 @@ export function createAuth(options: AuthOptions): Auth {
 					const emailing = options.env['NODE_ENV'] === 'production';
 					const origin = options.siteOrigin ?? (emailing ? null : requestOrigin);
 					if (!origin) {
-						log("no sign-in link sent: the site's public address isn't known (set Astro's `site`, or run on Railway, which sets RAILWAY_PUBLIC_DOMAIN).");
+						log("no sign-in link sent: the site's public address isn't known (set SITE_URL, when the site is built and when it runs).");
 						return 'not-sent';
 					}
 					const token = await links.issue(email, next);

package/src/live/auth/guard.ts

@@ -22,7 +22,7 @@
  */
 import type { Person } from '../messages.ts';
 import type { Auth, SignedOutReason } from './auth.ts';
-import { isRead, isSameOrigin } from './request.ts';
+import { addressMismatch, isRead, isSameOrigin } from './request.ts';
 import { cleanNext, LOGIN_PATH, loginHref } from './session.ts';
 
 /** Whether the guard looks at this path at all. */
@@ -93,7 +93,8 @@ export function guard(request: Request, auth: Auth): GuardResult {
 	const api = isApi(raw);
 
 	if (!isRead(request.method) && !isSameOrigin(request)) {
-		const error = 'This only takes requests from the editor on this site.';
+		// Runs-anywhere Decision 7: the editor's own write, refused because the site's address isn't the one in use.
+		const error = addressMismatch(request, auth.siteOrigin) ?? 'This only takes requests from the editor on this site.';
 		if (api) return { kind: 'respond', response: json(403, { error, code: 'cross-origin' } satisfies ForbiddenBody) };
 		return { kind: 'respond', response: new Response(error, { status: 403, headers: { 'Content-Type': 'text/plain; charset=utf-8', ...NO_STORE } }) };
 	}

package/src/live/auth/index.ts

@@ -19,7 +19,7 @@
  */
 import { SITE_SETTINGS_FILE, type ResolvedSite } from '../../config.ts';
 import { brandFrom } from '../../editor/brand.ts';
-import type { LiveSettings } from '../mode.ts';
+import { addressFrom, type LiveSettings } from '../mode.ts';
 import { liveRuntime } from '../runtime.ts';
 import { createAuth, type Auth } from './auth.ts';
 
@@ -27,13 +27,12 @@ const SHARED = Symbol.for('caracms.auth');
 type Shared = { [SHARED]?: Promise<Auth> };
 
 /**
- * The site's public origin for emailed links: Astro's `site`, else Railway's public
- * domain. Never a request's Host header (auth.ts → `siteOrigin`).
+ * The site's public origin for emailed links: Astro's `site`, then SITE_URL, then
+ * Railway's public domain (runs-anywhere Decision 7: the chain is mode.ts → `addressFrom`).
+ * Never a request's Host header (auth.ts → `siteOrigin`).
  */
 export function publicOrigin(astroSite: URL | undefined, env: Record<string, string | undefined> = process.env): string | null {
-	if (astroSite) return astroSite.origin;
-	const domain = env['RAILWAY_PUBLIC_DOMAIN']?.trim();
-	return domain ? `https://${domain}` : null;
+	return addressFrom(env, astroSite?.href);
 }
 
 /** The process's Auth, built on first use over the shared live runtime. */
@@ -50,7 +49,7 @@ export function authFor(site: ResolvedSite, settings: LiveSettings, astroSite?:
 				readSettings: () => rt.git.read(SITE_SETTINGS_FILE),
 				// M5a Decision 10: Site Settings' brand name as committed in `drafts`.
 				siteName: () => brandFrom(rt.git.read(SITE_SETTINGS_FILE), site).name,
-				siteOrigin: publicOrigin(astroSite),
+				siteOrigin: settings.address ?? publicOrigin(astroSite),
 				env: process.env,
 				now: rt.now,
 			}),

package/src/live/auth/login.ts

@@ -37,7 +37,7 @@
  */
 import type { Auth } from './auth.ts';
 import { normaliseEmail } from './allow.ts';
-import { clientIp, isRead, isSameOrigin } from './request.ts';
+import { addressMismatch, addressNotice, clientIp, isRead, isSameOrigin, NO_GATE_MESSAGE } from './request.ts';
 import { backupPerson, cleanNext, DEFAULT_NEXT, LOGIN_PATH, loginHref, safeEqual } from './session.ts';
 import {
 	backupView,
@@ -115,8 +115,17 @@ export async function handleLogin(request: Request, ctx: LoginContext): Promise<
 		extra.Allow = allow;
 		return page(405, 'Not allowed', messageView('Not allowed', 'Use the form on the sign-in page.'));
 	};
-	const crossOrigin = () => page(403, 'Not allowed', messageView('Not allowed', 'Send the form from the sign-in page.'));
+	// Runs-anywhere Decision 7: refused because the site's address isn't the one in use, the sentence says so, naming SITE_URL.
+	const mismatch = () => addressMismatch(request, auth.siteOrigin);
+	const crossOrigin = () => page(403, 'Not allowed', messageView('Not allowed', mismatch() ?? 'Send the form from the sign-in page.'));
 	const wantsJson = (request.headers.get('accept') ?? '').includes('application/json');
+	// Runs-anywhere Decision 8: on a production server (`auth.secure` is production), the IP
+	// comes from `caracms start`'s gate alone; without it, no sign-in at all (acceptance check 17).
+	const ip = clientIp(request, ctx.clientAddress, auth.secure);
+	if (ip === null) {
+		if (pathname === SIGNIN_PATH || wantsJson) return json(503, { error: NO_GATE_MESSAGE, reason: 'failed' });
+		return page(503, 'Sign-in is off', messageView('Sign-in is off', NO_GATE_MESSAGE));
+	}
 
 	try {
 		// ────────────────────────────────────────────────────────────── confirm
@@ -138,7 +147,7 @@ export async function handleLogin(request: Request, ctx: LoginContext): Promise<
 		// ─────────────────────────────────────────────────────────────── signin
 		if (pathname === SIGNIN_PATH) {
 			if (method !== 'POST') return notAllowed('POST');
-			if (!isSameOrigin(request)) return json(403, { error: 'Sign in from the sign-in page.', reason: 'failed' });
+			if (!isSameOrigin(request)) return json(403, { error: mismatch() ?? 'Sign in from the sign-in page.', reason: 'failed' });
 			let body: Record<string, unknown>;
 			try {
 				const parsed: unknown = JSON.parse(await readBody(request));
@@ -161,7 +170,7 @@ export async function handleLogin(request: Request, ctx: LoginContext): Promise<
 				// Every attempt counts, the right password included, so the limit can't confirm a guess.
 				let over = true;
 				try {
-					over = await auth.limits.backupAttemptOver(clientIp(request, ctx.clientAddress));
+					over = await auth.limits.backupAttemptOver(ip);
 				} catch (error) {
 					auth.log(`could not count a backup sign-in attempt, so it was refused: ${error instanceof Error ? error.message : String(error)}`);
 				}
@@ -179,7 +188,7 @@ export async function handleLogin(request: Request, ctx: LoginContext): Promise<
 		// ────────────────────────────────────────────────────────────── signout
 		if (pathname === SIGNOUT_PATH) {
 			if (method !== 'POST') return notAllowed('POST');
-			if (!isSameOrigin(request)) return wantsJson ? json(403, { error: 'Sign out from the editor.', reason: 'cross-origin' }) : crossOrigin();
+			if (!isSameOrigin(request)) return wantsJson ? json(403, { error: mismatch() ?? 'Sign out from the editor.', reason: 'cross-origin' }) : crossOrigin();
 			const location = loginHref({ signedout: '1' });
 			return wantsJson ? json(200, { ok: true, location }, auth.clearCookie()) : redirect(location, auth.clearCookie());
 		}
@@ -199,8 +208,9 @@ export async function handleLogin(request: Request, ctx: LoginContext): Promise<
 		const showBackup = query.get('backup') === '1' && auth.backup.enabled;
 		if (isRead(method)) {
 			const next = cleanNext(query.get('next'));
-			if (showBackup) return page(200, 'Backup account', backupView({ next }), { script: true });
-			return page(200, 'Sign in', emailView({ next, signedOut: query.get('signedout') === '1', backupEnabled: auth.backup.enabled }));
+			const notice = addressNotice(request, auth.siteOrigin);
+			if (showBackup) return page(200, 'Backup account', backupView({ next, notice }), { script: true });
+			return page(200, 'Sign in', emailView({ next, signedOut: query.get('signedout') === '1', backupEnabled: auth.backup.enabled, notice }));
 		}
 		if (method !== 'POST') return notAllowed('GET, HEAD, POST');
 		if (!isSameOrigin(request)) return crossOrigin();
@@ -221,7 +231,6 @@ export async function handleLogin(request: Request, ctx: LoginContext): Promise<
 		}
 
 		// Every address counts against the limits, allowed or not, so the time taken is the same.
-		const ip = clientIp(request, ctx.clientAddress);
 		let over = true;
 		try {
 			over = await auth.limits.linkRequestOver(email, ip);

package/src/live/auth/middleware.ts

@@ -8,7 +8,11 @@
  *   even building the runtime, so the public site never waits on GitHub or Redis.
  *   A guarded path that passes records the person (`setPerson`) for the route.
  * - **Unconfigured** never reaches here in a correct setup (Phase 2's middleware
- *   answers first); if it does, a guarded path gets a 503 rather than through.
+ *   answers first); if it does, a guarded path gets a 503 rather than through. The
+ *   public form endpoint's POST is the exception: Phase 2 lets it through, and so does this, since
+ *   a site's forms work without the editor (M6 Decision 5; the Urban Return port found it
+ *   answering 503 here until the GitHub App's variables were set). A GET to it is as
+ *   unavailable as any other guarded path, as live mode's let-through is POST-only too.
  *
  * The mode is Phase 2's `editorMode()`, so the two agree on live and local.
  */
@@ -16,7 +20,7 @@ import type { MiddlewareHandler } from 'astro';
 import { site } from 'virtual:caracms/config';
 import { editorMode } from '../../editor/server/mode.ts';
 import { setPerson } from '../locals.ts';
-import { guard, isGuardedPath } from './guard.ts';
+import { guard, isFormEndpoint, isGuardedPath } from './guard.ts';
 import { authFor } from './index.ts';
 
 const unavailable = (text: string) => new Response(text, { status: 503, headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'private, no-store' } });
@@ -25,7 +29,7 @@ export const onRequest: MiddlewareHandler = async (context, next) => {
 	if (!isGuardedPath(context.url.pathname)) return next();
 	const mode = editorMode();
 	if (mode.kind === 'local') return next();
-	if (mode.kind !== 'live') return unavailable("The editor isn't set up on this server yet.");
+	if (mode.kind !== 'live') return isFormEndpoint(context.url.pathname) && context.request.method === 'POST' ? next() : unavailable("The editor isn't set up on this server yet.");
 
 	let auth;
 	try {

package/src/live/auth/request.ts

@@ -6,20 +6,53 @@
 const first = (value: string | null) => (value ?? '').split(',')[0]!.trim();
 
 /**
- * The client's IP, which keys the per-IP rate limits (the template's `clientIp()`,
- * `docs/admin-login.md` → Rate limits and the client IP). In order:
+ * The header `caracms start`'s gate sets on every request, replacing any copy the request
+ * brought (runs-anywhere Decision 8, the spec's Contracts): the visitor's IP, decided from
+ * the one source `CARACMS_CLIENT_IP_HEADER` names.
+ */
+export const CLIENT_IP_HEADER = 'x-caracms-client-ip';
+
+/**
+ * The mark `caracms start` puts on its own process before importing the built site, which
+ * runs in that same process (`bin/gate.mjs` → `GATED_MARK`, `markProcessGated()`):
+ * `globalThis[Symbol.for('caracms.gated')] === true`. It's what makes the header above
+ * trustworthy: with the mark there, every request reached the site through the gate, which
+ * replaced any copy the visitor sent. Without it (`node dist/server/entry.mjs`), nothing
+ * replaced it, so the header is the visitor's to choose and is never read.
+ */
+export const GATED_MARK = Symbol.for('caracms.gated');
+
+/** Whether this process was started by `caracms start` (the mark above). */
+export const isGatedProcess = (): boolean => (globalThis as Record<symbol, unknown>)[GATED_MARK] === true;
+
+/** The 503 on sign-in, forms and downloads of a production server with no gate (Decision 8; acceptance check 17). */
+export const NO_GATE_MESSAGE =
+	"This site wasn't started with `caracms start`, so it can't tell its visitors apart for the limits on signing in, forms and downloads. A developer can start it with `caracms start` (the site's start script).";
+
+/**
+ * The client's IP, which keys the per-IP rate limits (sign-in, forms, downloads).
  *
- * 1. **`X-Real-IP`.** Railway's edge overwrites it with the address that connected, so
- *    behind Railway it's the one value the client can't choose.
- * 2. The socket's address as the adapter gives it (`clientAddress`).
- * 3. The first `X-Forwarded-For` hop, only when there's nothing else. Never ahead of
- *    the socket: the client writes the leftmost hop, so keyed on it an attacker could
- *    rotate past every per-IP limit.
+ * **In production, only `x-caracms-client-ip`**, which `caracms start`'s gate sets on
+ * every request from the one trusted source, and only in a process the gate marked
+ * (`GATED_MARK`). Null when the mark is missing, whatever the request carries: the server
+ * wasn't started by `caracms start`, so a header there is one the visitor sent. Null too
+ * when the header is absent. Either way the caller answers 503 with `NO_GATE_MESSAGE`.
+ * Nothing else on the request is trusted there: Astro's Node adapter reports the first
+ * `X-Forwarded-For` entry as `clientAddress` whenever the Host is trusted, which caracms
+ * always arranges for its own domain, so the adapter's address is the visitor's to choose
+ * (`node_modules/astro/dist/core/app/node.js`), and `X-Real-IP` is trustworthy only behind
+ * a proxy that overwrites it.
  *
- * Off Railway (dev, tests) nothing proxies, so a spoofed `X-Real-IP` only rate-limits
- * the spoofer's own requests: accepted, as in the template.
+ * **Under `astro dev`** (no gate, and nothing to protect), as before: `X-Real-IP`, then
+ * the socket's address as the adapter gives it, then the first `X-Forwarded-For` hop.
+ * A spoofed one only rate-limits the spoofer's own requests.
  */
-export function clientIp(request: Request, clientAddress: () => string | undefined): string {
+export function clientIp(request: Request, clientAddress: () => string | undefined, production = false): string | null {
+	if (production) {
+		if (!isGatedProcess()) return null;
+		const gated = request.headers.get(CLIENT_IP_HEADER)?.trim();
+		return gated ? gated.slice(0, 64) : null;
+	}
 	const real = first(request.headers.get('x-real-ip'));
 	if (real) return real.slice(0, 64);
 	let socket: string | undefined;
@@ -53,4 +86,52 @@ export function isSameOrigin(request: Request): boolean {
 	}
 }
 
+/**
+ * Runs-anywhere Decision 7: the sentence for a site reached at an address that isn't its
+ * own, naming SITE_URL. The likeliest setup mistake: SITE_URL at www while people use the
+ * apex (or the other way round), or set differently at build and at run time.
+ */
+export function addressMismatchMessage(reached: string, address: string | null): string {
+	return address
+		? `This site's address is set to ${address} (SITE_URL), but it was opened at ${reached}, so signing in and saving are refused here. Open it at ${address}, or set SITE_URL to ${reached} where the site is built and where it runs.`
+		: `This site's address isn't set, so signing in and saving are refused. Set SITE_URL to ${reached} where the site is built and where it runs.`;
+}
+
+/** The address the visitor typed (the proxy's forwarded host, else Host), when it isn't the one Astro read the request as. */
+export function reachedElsewhere(request: Request): string | null {
+	const host = first(request.headers.get('x-forwarded-host')) || first(request.headers.get('host'));
+	if (!host) return null;
+	const url = new URL(request.url);
+	if (host === url.host) return null;
+	const proto = first(request.headers.get('x-forwarded-proto')) || url.protocol.replace(':', '');
+	return `${proto}://${host}`;
+}
+
+/**
+ * For a write refused by `isSameOrigin`: the mismatch sentence when the browser was on
+ * this site all along (it says `Sec-Fetch-Site: same-origin`, or its `Origin` is the
+ * request's own Host) but Astro, trusting only the site's address, read the request as
+ * another host. Null for a real cross-site request.
+ */
+export function addressMismatch(request: Request, address: string | null): string | null {
+	let origin: URL;
+	try {
+		origin = new URL(request.headers.get('origin') ?? '');
+	} catch {
+		return null;
+	}
+	if (origin.host === new URL(request.url).host) return null;
+	const fetchSite = request.headers.get('sec-fetch-site');
+	const host = first(request.headers.get('x-forwarded-host')) || first(request.headers.get('host'));
+	if (fetchSite !== 'same-origin' && !(!fetchSite && origin.host === host)) return null;
+	return addressMismatchMessage(origin.origin, address);
+}
+
+/** On a page with no `Origin` (the sign-in form's GET): the sentence when the site is opened at an address that isn't its own. */
+export function addressNotice(request: Request, address: string | null): string | null {
+	const reached = reachedElsewhere(request);
+	if (!reached || (address && new URL(address).host === new URL(reached).host)) return null;
+	return addressMismatchMessage(reached, address);
+}
+
 export const isRead = (method: string) => method === 'GET' || method === 'HEAD';

package/src/live/auth/views.ts

@@ -301,9 +301,9 @@ const FINE = html`<p class="fine">Not you? Close this tab.</p>`;
 const backupLink = (next: string) => html`<p class="si-alt"><a class="linkbtn" href="${loginHref({ backup: '1' }, next)}">Use the backup account</a></p>`;
 
 /** The email form: plain, signed out, or with the malformed-address error. */
-export function emailView(input: { next: string; value?: string; invalid?: string; signedOut?: boolean; backupEnabled: boolean }): SafeHtml {
+export function emailView(input: { next: string; value?: string; invalid?: string; signedOut?: boolean; backupEnabled: boolean; notice?: string | null }): SafeHtml {
 	const bad = !!input.invalid;
-	return html`<section class="si-card">${input.signedOut ? html`<p class="notice info" role="status">${ic('check', 'i-sm')}You're signed out.</p>` : ''}<h1>Sign in</h1><p class="sub">We'll email you a sign-in link.</p><form method="post" action="${LOGIN_PATH}" novalidate><input type="hidden" name="next" value="${input.next}"><div class="field"><label class="field-label" for="si-email">Email address</label><input class="input" id="si-email" name="email" type="email" autocomplete="email" inputmode="email" spellcheck="false" autofocus value="${input.value ?? ''}"${new SafeHtml(bad ? ' aria-invalid="true" aria-describedby="si-err"' : '')}>${
+	return html`<section class="si-card">${addressNoticeHtml(input.notice)}${input.signedOut ? html`<p class="notice info" role="status">${ic('check', 'i-sm')}You're signed out.</p>` : ''}<h1>Sign in</h1><p class="sub">We'll email you a sign-in link.</p><form method="post" action="${LOGIN_PATH}" novalidate><input type="hidden" name="next" value="${input.next}"><div class="field"><label class="field-label" for="si-email">Email address</label><input class="input" id="si-email" name="email" type="email" autocomplete="email" inputmode="email" spellcheck="false" autofocus value="${input.value ?? ''}"${new SafeHtml(bad ? ' aria-invalid="true" aria-describedby="si-err"' : '')}>${
 		bad ? html`<p class="field-err" id="si-err">${ic('warn', 'i-sm')}<span>${input.invalid}</span></p>` : ''
 	}</div><button class="btn accent block" type="submit">Send sign-in link</button></form></section>${input.backupEnabled ? backupLink(input.next) : ''}`;
 }
@@ -317,9 +317,14 @@ export function sentView(input: { email: string; next: string; again: boolean; b
 	return html`<section class="si-card">${input.again ? html`<p class="notice ok" role="status">${ic('check', 'i-sm')}Sent again.</p>` : ''}<h1>Check your email</h1><p>If <strong>${input.email}</strong> can sign in, a link is on its way. It expires in 15 minutes.</p><p class="fine">Not there? Check spam, or send again.</p><div class="row-acts"><form method="post" action="${LOGIN_PATH}"><input type="hidden" name="email" value="${input.email}"><input type="hidden" name="next" value="${input.next}"><input type="hidden" name="again" value="1"><button class="btn" type="submit">Send again</button></form><a class="linkbtn" href="${loginHref({}, input.next)}">Use a different address</a></div></section>${input.backupEnabled ? backupLink(input.next) : ''}`;
 }
 
+/** Runs-anywhere Decision 7: the site was opened at an address that isn't its own (request.ts → `addressNotice`). */
+function addressNoticeHtml(notice: string | null | undefined): SafeHtml | string {
+	return notice ? html`<p class="notice fail" role="alert" data-notice="address">${ic('warn', 'i-sm')}${notice}</p>` : '';
+}
+
 /** The backup form. Posting it without script only shows it again. */
-export function backupView(input: { next: string }): SafeHtml {
-	return html`<section class="si-card"><p class="notice fail" id="signin-error" role="alert" hidden></p><h1>Backup account</h1><p class="sub">Details are in the shared password manager.</p>${NOSCRIPT}<form method="post" action="${loginHref({ backup: '1' }, input.next)}" data-signin="backup" data-next="${input.next}"><div class="field"><label class="field-label" for="si-user">Username</label><input class="input" id="si-user" name="username" autocomplete="username" autocapitalize="off" spellcheck="false" autofocus required></div><div class="field"><label class="field-label" for="si-pass">Password</label><input class="input" id="si-pass" name="password" type="password" autocomplete="current-password" required></div><button class="btn accent block" type="submit">Sign in</button></form></section><p class="si-alt"><a class="linkbtn" href="${loginHref({}, input.next)}">Use email sign-in instead</a></p>`;
+export function backupView(input: { next: string; notice?: string | null }): SafeHtml {
+	return html`<section class="si-card">${addressNoticeHtml(input.notice)}<p class="notice fail" id="signin-error" role="alert" hidden></p><h1>Backup account</h1><p class="sub">Details are in the shared password manager.</p>${NOSCRIPT}<form method="post" action="${loginHref({ backup: '1' }, input.next)}" data-signin="backup" data-next="${input.next}"><div class="field"><label class="field-label" for="si-user">Username</label><input class="input" id="si-user" name="username" autocomplete="username" autocapitalize="off" spellcheck="false" autofocus required></div><div class="field"><label class="field-label" for="si-pass">Password</label><input class="input" id="si-pass" name="password" type="password" autocomplete="current-password" required></div><button class="btn accent block" type="submit">Sign in</button></form></section><p class="si-alt"><a class="linkbtn" href="${loginHref({}, input.next)}">Use email sign-in instead</a></p>`;
 }
 
 /**