create-astroid 0.1.2 → 0.3.0

package/template/src/pages/index.astro

@@ -5,6 +5,7 @@
 // Louise client turns into inline editors; saves stage a draft (versionedPageId),
 // and Publish promotes it. Seed the row once with `seed/home.seed.sql`.
 import Editable from "astroidjs/components/Editable.astro";
+import Sections from "astroidjs/components/Sections.astro";
 import { env } from "cloudflare:workers";
 import Hero from "../components/Hero.astro";
 import Site from "../layouts/Site.astro";
@@ -13,15 +14,63 @@ export const prerender = false;
 
 const { editMode } = Astro.locals;
 
-let page: { id: number; title: string; body: string | null } | null = null;
+// Edge caching (ADR 0004). Opting in emits `Cloudflare-CDN-Cache-Control`, which
+// the worker's `withEdgeCache` layer reads as "store this", then strips.
+//
+// Both conditions matter. Edit mode must NEVER opt in — a cached editor render
+// would carry draft content and the inline-edit hooks into the shared public
+// entry. And the var is off by default because `caches.default` survives
+// Cloudflare Dev Mode and Purge Everything; walk the activation runbook in
+// docs/adr/0004-edge-caching.md on a preview deploy before turning it on.
+//
+// `set(false)` is the safe state, not merely the "off" one: it emits `no-store`,
+// so nothing downstream caches this HTML either.
+if (editMode || env.ASTROID_EDGE_CACHE !== "true") {
+  Astro.cache.set(false);
+} else {
+  // Short on purpose: `caches.default` is per-colo with no global purge, so this
+  // max-age is the real worldwide freshness floor after a publish.
+  Astro.cache.set({ maxAge: 60 });
+}
+
+// `seo_*` are the page's SEO overrides, deliberately separate from `title` —
+// which is the on-page H1. The home page passes NO title to <Site>, so <title>
+// is the site-wide default ("Acme Coffee", not "Acme Coffee | Acme Coffee");
+// set `seo_title` on the row to override just the head.
+interface HomeRow {
+  id: number;
+  title: string;
+  body: string | null;
+  /** The page-builder array, stored as a JSON string in D1. */
+  sections: string | null;
+  seo_title: string | null;
+  seo_description: string | null;
+  og_image: string | null;
+  noindex: number | null;
+}
+let page: HomeRow | null = null;
 try {
-  page = await env.DB.prepare("SELECT id, title, body FROM pages WHERE slug = 'home'").first();
+  page = await env.DB.prepare(
+    "SELECT id, title, body, sections, seo_title, seo_description, og_image, noindex FROM pages WHERE slug = 'home'",
+  ).first<HomeRow>();
 } catch {
   // No DB binding yet (pre-provision) — fall through to the seed-me prompt.
 }
 
 let title = page?.title ?? "__BRAND_NAME__";
 let body = page?.body ?? "";
+// `sections` is a JSON string in D1. Bad JSON is a render-time non-event — the
+// page falls back to its prose body rather than 500ing on one malformed row.
+function parseSections(raw: string | null | undefined): unknown[] {
+  if (!raw) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+let sections = parseSections(page?.sections);
 
 // In edit mode, prefer the latest unpublished draft so edits resume across reloads.
 if (editMode && page) {
@@ -32,9 +81,18 @@ if (editMode && page) {
       .bind(page.id)
       .first<{ version_data: string }>();
     if (draft?.version_data) {
-      const d = JSON.parse(draft.version_data) as { title?: string; body?: string };
+      const d = JSON.parse(draft.version_data) as {
+        title?: string;
+        body?: string;
+        sections?: unknown;
+      };
       if (typeof d.title === "string") title = d.title;
       if (typeof d.body === "string") body = d.body;
+      // Sections stage as drafts like any other field, so edit mode must render
+      // the draft's array — otherwise an editor's in-progress section edits
+      // vanish on reload while their title edits survive.
+      if (Array.isArray(d.sections)) sections = d.sections;
+      else if (typeof d.sections === "string") sections = parseSections(d.sections);
     }
   } catch {
     // Non-fatal — fall back to the live row.
@@ -42,16 +100,31 @@ if (editMode && page) {
 }
 ---
 
-<Site title={title} description={undefined} versionedPageId={page?.id}>
+<Site
+  title={page?.seo_title ?? undefined}
+  description={page?.seo_description ?? undefined}
+  ogImage={page?.og_image ?? undefined}
+  noindex={Boolean(page?.noindex)}
+  versionedPageId={page?.id}
+  sections={sections}
+>
   {
     page ? (
-      <main class="mx-auto max-w-3xl px-6 py-16">
+      <main>
+        {/* The page-builder sections, edited on-canvas. <Sections> resolves every
+            image's alt/caption from the media registry in ONE query for the whole
+            page, then hands each section its own path so `data-louise-sfield`
+            markers land at the right depth. */}
+        <Sections items={sections} db={env.DB} mediaBase={env.MEDIA_URL} />
+
+        <div class="mx-auto max-w-3xl px-6 py-16">
         <Editable as="h1" collection="pages" key={page.id} field="title" class="text-5xl font-bold">
           {title}
         </Editable>
         <Editable as="div" collection="pages" key={page.id} field="body" type="richtext" class="prose mt-6 max-w-none">
           <Fragment set:html={body} />
         </Editable>
+        </div>
       </main>
     ) : (
       <main>

package/template/src/pages/login.astro

@@ -3,12 +3,29 @@
 // clicking it starts a session and lands on `/?louise` (edit mode on). The gate
 // is enumeration-safe — the response is identical whether or not the email is an
 // editor — so the UI always says "check your email".
+import { env } from "cloudflare:workers";
+import { turnstileSiteKey } from "louise-toolkit/auth";
 import Site from "../layouts/Site.astro";
 
 export const prerender = false;
+
+// Turnstile, rendered ONLY when a real (non-test) site key is set.
+//
+// This has to match the server exactly. `getLouiseAuth` registers Better Auth's
+// captcha plugin on /sign-in/magic-link the moment BOTH halves of the pair are
+// real, and that plugin rejects any request without an `x-captcha-response`
+// header. So a page that never rendered a widget meant provisioning Turnstile —
+// which .env.example openly invites you to do — locked the owner out of their
+// own sign-in, with a 403 and no clue why.
+//
+// `turnstileSiteKey` returns null for the always-passing TEST key, which is the
+// same condition `activeCaptchaSecret` uses server-side. One shared rule, so the
+// widget appears exactly when the server starts demanding a token.
+const siteKey = turnstileSiteKey(env);
 ---
 
-<Site title="Sign in">
+{/* noindex: an editor sign-in page has nothing for a search result to offer. */}
+<Site title="Sign in" noindex>
   <main class="hero min-h-screen">
     <div class="hero-content w-full max-w-sm">
       <form id="magic" class="card w-full bg-base-200 shadow-sm">
@@ -26,6 +43,13 @@ export const prerender = false;
               class="input input-bordered w-full"
             />
           </label>
+          {
+            siteKey && (
+              /* Turnstile injects a hidden `cf-turnstile-response` input here once
+                 it solves. The submit handler reads it out of the form. */
+              <div class="cf-turnstile" data-sitekey={siteKey} data-size="flexible" />
+            )
+          }
           <button type="submit" class="btn btn-primary">Email me a sign-in link</button>
           <p id="msg" class="text-sm opacity-70" aria-live="polite"></p>
         </div>
@@ -33,6 +57,20 @@ export const prerender = false;
     </div>
   </main>
 
+  {
+    /* Turnstile's widget script. `is:inline` because it's a remote src Astro must
+       not process; the CSP already allows challenges.cloudflare.com for script,
+       frame, and connect (astroidSecurity). Only loaded when there's a widget. */
+    siteKey && (
+      <script
+        is:inline
+        src="https://challenges.cloudflare.com/turnstile/v0/api.js"
+        async
+        defer
+      />
+    )
+  }
+
   {/* Processed (NOT is:inline) so Astro's security.csp hashes it into script-src.
       Keep it dependency-free and static — an is:inline or define:vars script here
       would be unhashable and CSP-blocked. */}
@@ -45,10 +83,22 @@ export const prerender = false;
       const email = input?.value.trim();
       if (!email || !msg) return;
       msg.textContent = "Sending…";
+      // Turnstile writes its token into a hidden input it injects into the form.
+      // Better Auth's captcha plugin reads it from the `x-captcha-response`
+      // HEADER (not the body), and rejects the request outright when it's
+      // missing — so this header is what makes a captcha-enabled sign-in work.
+      // Absent when no widget rendered, in which case the plugin isn't active
+      // either and the header is simply not sent.
+      const token = (form as HTMLFormElement).querySelector<HTMLInputElement>(
+        'input[name="cf-turnstile-response"]',
+      )?.value;
       try {
         await fetch("/api/auth/sign-in/magic-link", {
           method: "POST",
-          headers: { "content-type": "application/json" },
+          headers: {
+            "content-type": "application/json",
+            ...(token ? { "x-captcha-response": token } : {}),
+          },
           body: JSON.stringify({ email, callbackURL: "/?louise" }),
         });
         msg.textContent = "If that email is an editor, a sign-in link is on its way.";

package/template/src/pages/robots.txt.ts

@@ -0,0 +1,36 @@
+// robots.txt — origin-aware, with the disallow list derived from your Astroid
+// config (the editor + its API always; portal and checkout routes when those
+// modules are on). Scaffolded once and yours to edit: add a Disallow here when
+// you add a route crawlers shouldn't reach.
+import type { APIRoute } from "astro";
+import { astroidRobotsTxt } from "astroidjs";
+import { env } from "cloudflare:workers";
+import astroidConfig from "../../astroid.config.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async (context) => {
+  // The origin actually serving this request — never a configured domain. A
+  // preview deploy that advertises the production host invites its content to
+  // be indexed under the real domain.
+  const origin = new URL(context.request.url).origin;
+
+  // The same site-wide switch that noindexes pages also stops the crawl, rather
+  // than relying on crawlers fetching every page to find the meta tag.
+  let disableIndexing = false;
+  try {
+    const row = await env.DB.prepare("SELECT disable_indexing FROM site_settings WHERE id = 1").first<{
+      disable_indexing: number;
+    }>();
+    disableIndexing = Boolean(row?.disable_indexing);
+  } catch {
+    // No DB binding yet (pre-provision) — fall through to the crawlable default.
+  }
+
+  return new Response(astroidRobotsTxt(astroidConfig, { origin, disableIndexing }), {
+    headers: {
+      "content-type": "text/plain; charset=utf-8",
+      "cache-control": "public, max-age=3600",
+    },
+  });
+};

package/template/src/pages/sitemap.xml.ts

@@ -0,0 +1,40 @@
+// sitemap.xml — the published `pages` rows, plus whatever else this site serves.
+// Scaffolded once and yours to edit: add your own routes (a product catalog, a
+// gallery) to the `entries` array below.
+//
+// `astroidSitemapXml` drops anything matching the config's noindex prefixes, so
+// this file and robots.txt can never disagree about what's crawlable.
+import type { APIRoute } from "astro";
+import { astroidSitemapXml, type SitemapEntry } from "astroidjs";
+import { env } from "cloudflare:workers";
+import astroidConfig from "../../astroid.config.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async (context) => {
+  const origin = new URL(context.request.url).origin;
+  const entries: SitemapEntry[] = [{ path: "/" }];
+
+  try {
+    const { results } = await env.DB.prepare(
+      "SELECT slug, updated_at FROM pages WHERE status = 'published' AND noindex = 0",
+    ).all<{ slug: string; updated_at: number | null }>();
+    for (const row of results ?? []) {
+      // `home` is served at "/", which is already listed — never at "/home".
+      if (row.slug === "home") continue;
+      // Drizzle stores `updated_at` as a Unix timestamp in SECONDS; <lastmod>
+      // wants a W3C datetime, so a raw epoch number would be invalid.
+      const lastmod = row.updated_at ? new Date(row.updated_at * 1000) : undefined;
+      entries.push({ path: `/${row.slug}`, lastmod });
+    }
+  } catch {
+    // No DB binding yet (pre-provision) — ship the root-only sitemap.
+  }
+
+  return new Response(astroidSitemapXml(astroidConfig, entries, { origin }), {
+    headers: {
+      "content-type": "application/xml; charset=utf-8",
+      "cache-control": "public, max-age=3600",
+    },
+  });
+};

package/template/src/styles/site.css

@@ -5,6 +5,15 @@
 @plugin "daisyui";
 @import "louise-toolkit/theme/louise.css";
 
+/* Astroid's section components (<Hero>, the section library, etc.) ship as SOURCE
+   inside node_modules, and Tailwind v4 does not scan node_modules by default. So
+   the utilities used ONLY in those files — bg-primary, text-primary-content,
+   items-center, and every other colorway/alignment class — would never be
+   generated, and the whole `_settings` token contract would silently no-op: a
+   section set to `colorway: "brand"` would render on the default background.
+   This tells Tailwind to scan them too. Keep it if you use any astroidjs section. */
+@source "../../node_modules/astroidjs/src/components";
+
 :root {
   --brand: __BRAND_COLOR__;
 }