create-astroid 0.1.2 → 0.2.0

package/template/src/pages/login.astro

@@ -3,12 +3,29 @@
 // clicking it starts a session and lands on `/?louise` (edit mode on). The gate
 // is enumeration-safe — the response is identical whether or not the email is an
 // editor — so the UI always says "check your email".
+import { env } from "cloudflare:workers";
+import { turnstileSiteKey } from "louise-toolkit/auth";
 import Site from "../layouts/Site.astro";
 
 export const prerender = false;
+
+// Turnstile, rendered ONLY when a real (non-test) site key is set.
+//
+// This has to match the server exactly. `getLouiseAuth` registers Better Auth's
+// captcha plugin on /sign-in/magic-link the moment BOTH halves of the pair are
+// real, and that plugin rejects any request without an `x-captcha-response`
+// header. So a page that never rendered a widget meant provisioning Turnstile —
+// which .env.example openly invites you to do — locked the owner out of their
+// own sign-in, with a 403 and no clue why.
+//
+// `turnstileSiteKey` returns null for the always-passing TEST key, which is the
+// same condition `activeCaptchaSecret` uses server-side. One shared rule, so the
+// widget appears exactly when the server starts demanding a token.
+const siteKey = turnstileSiteKey(env);
 ---
 
-<Site title="Sign in">
+{/* noindex: an editor sign-in page has nothing for a search result to offer. */}
+<Site title="Sign in" noindex>
   <main class="hero min-h-screen">
     <div class="hero-content w-full max-w-sm">
       <form id="magic" class="card w-full bg-base-200 shadow-sm">
@@ -26,6 +43,13 @@ export const prerender = false;
               class="input input-bordered w-full"
             />
           </label>
+          {
+            siteKey && (
+              /* Turnstile injects a hidden `cf-turnstile-response` input here once
+                 it solves. The submit handler reads it out of the form. */
+              <div class="cf-turnstile" data-sitekey={siteKey} data-size="flexible" />
+            )
+          }
           <button type="submit" class="btn btn-primary">Email me a sign-in link</button>
           <p id="msg" class="text-sm opacity-70" aria-live="polite"></p>
         </div>
@@ -33,6 +57,20 @@ export const prerender = false;
     </div>
   </main>
 
+  {
+    /* Turnstile's widget script. `is:inline` because it's a remote src Astro must
+       not process; the CSP already allows challenges.cloudflare.com for script,
+       frame, and connect (astroidSecurity). Only loaded when there's a widget. */
+    siteKey && (
+      <script
+        is:inline
+        src="https://challenges.cloudflare.com/turnstile/v0/api.js"
+        async
+        defer
+      />
+    )
+  }
+
   {/* Processed (NOT is:inline) so Astro's security.csp hashes it into script-src.
       Keep it dependency-free and static — an is:inline or define:vars script here
       would be unhashable and CSP-blocked. */}
@@ -45,10 +83,22 @@ export const prerender = false;
       const email = input?.value.trim();
       if (!email || !msg) return;
       msg.textContent = "Sending…";
+      // Turnstile writes its token into a hidden input it injects into the form.
+      // Better Auth's captcha plugin reads it from the `x-captcha-response`
+      // HEADER (not the body), and rejects the request outright when it's
+      // missing — so this header is what makes a captcha-enabled sign-in work.
+      // Absent when no widget rendered, in which case the plugin isn't active
+      // either and the header is simply not sent.
+      const token = (form as HTMLFormElement).querySelector<HTMLInputElement>(
+        'input[name="cf-turnstile-response"]',
+      )?.value;
       try {
         await fetch("/api/auth/sign-in/magic-link", {
           method: "POST",
-          headers: { "content-type": "application/json" },
+          headers: {
+            "content-type": "application/json",
+            ...(token ? { "x-captcha-response": token } : {}),
+          },
           body: JSON.stringify({ email, callbackURL: "/?louise" }),
         });
         msg.textContent = "If that email is an editor, a sign-in link is on its way.";

package/template/src/pages/robots.txt.ts

@@ -0,0 +1,36 @@
+// robots.txt — origin-aware, with the disallow list derived from your Astroid
+// config (the editor + its API always; portal and checkout routes when those
+// modules are on). Scaffolded once and yours to edit: add a Disallow here when
+// you add a route crawlers shouldn't reach.
+import type { APIRoute } from "astro";
+import { astroidRobotsTxt } from "astroidjs";
+import { env } from "cloudflare:workers";
+import astroidConfig from "../../astroid.config.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async (context) => {
+  // The origin actually serving this request — never a configured domain. A
+  // preview deploy that advertises the production host invites its content to
+  // be indexed under the real domain.
+  const origin = new URL(context.request.url).origin;
+
+  // The same site-wide switch that noindexes pages also stops the crawl, rather
+  // than relying on crawlers fetching every page to find the meta tag.
+  let disableIndexing = false;
+  try {
+    const row = await env.DB.prepare("SELECT disable_indexing FROM site_settings WHERE id = 1").first<{
+      disable_indexing: number;
+    }>();
+    disableIndexing = Boolean(row?.disable_indexing);
+  } catch {
+    // No DB binding yet (pre-provision) — fall through to the crawlable default.
+  }
+
+  return new Response(astroidRobotsTxt(astroidConfig, { origin, disableIndexing }), {
+    headers: {
+      "content-type": "text/plain; charset=utf-8",
+      "cache-control": "public, max-age=3600",
+    },
+  });
+};

package/template/src/pages/sitemap.xml.ts

@@ -0,0 +1,40 @@
+// sitemap.xml — the published `pages` rows, plus whatever else this site serves.
+// Scaffolded once and yours to edit: add your own routes (a product catalog, a
+// gallery) to the `entries` array below.
+//
+// `astroidSitemapXml` drops anything matching the config's noindex prefixes, so
+// this file and robots.txt can never disagree about what's crawlable.
+import type { APIRoute } from "astro";
+import { astroidSitemapXml, type SitemapEntry } from "astroidjs";
+import { env } from "cloudflare:workers";
+import astroidConfig from "../../astroid.config.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async (context) => {
+  const origin = new URL(context.request.url).origin;
+  const entries: SitemapEntry[] = [{ path: "/" }];
+
+  try {
+    const { results } = await env.DB.prepare(
+      "SELECT slug, updated_at FROM pages WHERE status = 'published' AND noindex = 0",
+    ).all<{ slug: string; updated_at: number | null }>();
+    for (const row of results ?? []) {
+      // `home` is served at "/", which is already listed — never at "/home".
+      if (row.slug === "home") continue;
+      // Drizzle stores `updated_at` as a Unix timestamp in SECONDS; <lastmod>
+      // wants a W3C datetime, so a raw epoch number would be invalid.
+      const lastmod = row.updated_at ? new Date(row.updated_at * 1000) : undefined;
+      entries.push({ path: `/${row.slug}`, lastmod });
+    }
+  } catch {
+    // No DB binding yet (pre-provision) — ship the root-only sitemap.
+  }
+
+  return new Response(astroidSitemapXml(astroidConfig, entries, { origin }), {
+    headers: {
+      "content-type": "application/xml; charset=utf-8",
+      "cache-control": "public, max-age=3600",
+    },
+  });
+};

package/template/src/styles/site.css

@@ -5,6 +5,15 @@
 @plugin "daisyui";
 @import "louise-toolkit/theme/louise.css";
 
+/* Astroid's section components (<Hero>, the section library, etc.) ship as SOURCE
+   inside node_modules, and Tailwind v4 does not scan node_modules by default. So
+   the utilities used ONLY in those files — bg-primary, text-primary-content,
+   items-center, and every other colorway/alignment class — would never be
+   generated, and the whole `_settings` token contract would silently no-op: a
+   section set to `colorway: "brand"` would render on the default background.
+   This tells Tailwind to scan them too. Keep it if you use any astroidjs section. */
+@source "../../node_modules/astroidjs/src/components";
+
 :root {
   --brand: __BRAND_COLOR__;
 }