create-bcp-app 0.2.4 → 0.2.6

package/README.md

@@ -92,10 +92,10 @@ Example:
   "schemaVersion": 1,
   "framework": "bcp",
   "projectName": "my-app",
-  "frameworkPackage": "npm:@chidchanun/bcp@0.2.4",
+  "frameworkPackage": "npm:@chidchanun/bcp@0.2.6",
   "createdWith": {
     "package": "create-bcp-app",
-    "version": "0.2.4"
+    "version": "0.2.6"
   },
   "packageManager": "npm",
   "presets": {
@@ -277,6 +277,55 @@ Set this to a cryptographically random secret of at least 32 bytes before real a
 
 The generated `authenticateCredentials(email, password)` returns `null` until the application connects it to its own user store and password-hash verification.
 
+Generated auth stays in backward-compatible stateless JWT-cookie mode by default.
+
+BCP `0.2.5+` can opt into revocable server-side auth state without changing the generated auth route structure:
+
+```ts
+import {
+    createAuth,
+    createMemoryAuthSessionStore,
+} from "bcp/auth";
+
+const sessionStore =
+    createMemoryAuthSessionStore();
+
+const frameworkAuth =
+    createAuth<AuthenticatedUser>({
+        store: sessionStore,
+        idleTimeout: 60 * 30,
+    });
+```
+
+The memory store is intended for development/tests. Multi-process production deployments should implement `AuthSessionStore` using shared durable storage.
+
+## Authorization & request security — 0.2.6+
+
+Generated applications can add permissions to their application user shape and use server-side permission guards without changing the auth preset routes:
+
+```ts
+import {
+    createPermissionGuard,
+    hasPermission,
+} from "bcp/auth";
+```
+
+For resource-specific decisions, use `defineAuthorizationPolicy()`, `can()` or `authorize()`.
+
+Cookie-authenticated mutation routes can opt into same-origin and CSRF protection through `bcp/server`:
+
+```ts
+import {
+    createCsrfToken,
+    requireCsrfRequest,
+    requireSameOriginRequest,
+} from "bcp/server";
+```
+
+`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`, so the generated JWT auth preset does not require another environment variable to get started. Production applications may define a separate `BCP_CSRF_SECRET` for independent key rotation.
+
+Authorization and CSRF checks must remain on the server; hiding UI controls in client code is not an authorization boundary.
+
 ## Application Packaging — 0.2.4+
 
 Generated projects include:
@@ -311,8 +360,6 @@ npm ci --omit=dev
 npm start
 ```
 
-If the package manifest reports that no lockfile was included, use the install command recorded in `bcp.package.json`.
-
 ## Project generators after creation
 
 ```bash
@@ -331,14 +378,6 @@ bcp generate middleware
 bcp generate migration create_users
 ```
 
-From PowerShell:
-
-```powershell
-npm exec -- bcp-framework generate page dashboard/users
-```
-
-Use `--force` only when intentionally replacing an existing page/API/middleware scaffold.
-
 ## Options
 
 ```text
@@ -368,5 +407,5 @@ npx create-bcp-app my-app --yes
 The `--bcp` option is mainly for prerelease/local package verification:
 
 ```bash
-npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.4.tgz
+npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.6.tgz
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bcp-app",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Create a new BCP Framework application.",
   "type": "module",
   "license": "MIT",

package/template/README.md

@@ -39,6 +39,61 @@ It records non-secret scaffold choices such as Tailwind, database, authenticatio
 
 Commit this file with the project. Do not put passwords, access keys, session secrets or tokens in it.
 
+## Authentication — BCP 0.2.5+
+
+Projects created with the `JWT Cookie` preset remain stateless by default and use the generated `lib/auth.ts` helpers.
+
+BCP Authentication Platform v2 can opt into revocable server-side session state:
+
+```ts
+import {
+    createAuth,
+    createMemoryAuthSessionStore,
+} from "bcp/auth";
+
+const sessionStore =
+    createMemoryAuthSessionStore();
+
+export const appAuth =
+    createAuth({
+        store: sessionStore,
+        idleTimeout: 60 * 30,
+    });
+```
+
+The memory store is intended for local development/tests. Use a shared durable `AuthSessionStore` implementation for multi-process or multi-container production deployments.
+
+## Authorization & request security — BCP 0.2.6+
+
+Server-side permission guards:
+
+```ts
+import {
+    createPermissionGuard,
+} from "bcp/auth";
+
+export const guard =
+    createPermissionGuard(
+        "dashboard.read"
+    );
+```
+
+For ownership or resource-specific rules, use `defineAuthorizationPolicy()`, `can()` and `authorize()` from `bcp/auth`.
+
+Cookie-authenticated mutation routes can validate browser origin and CSRF state:
+
+```ts
+import {
+    createCsrfToken,
+    requireCsrfRequest,
+    requireSameOriginRequest,
+} from "bcp/server";
+```
+
+`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`.
+
+Authorization must always be enforced server-side. Client UI visibility is not a security boundary.
+
 ## Generate framework files
 
 BCP can generate common project files: