create-bcp-app 0.2.5 → 0.2.6

package/README.md

@@ -92,10 +92,10 @@ Example:
   "schemaVersion": 1,
   "framework": "bcp",
   "projectName": "my-app",
-  "frameworkPackage": "npm:@chidchanun/bcp@0.2.5",
+  "frameworkPackage": "npm:@chidchanun/bcp@0.2.6",
   "createdWith": {
     "package": "create-bcp-app",
-    "version": "0.2.5"
+    "version": "0.2.6"
   },
   "packageManager": "npm",
   "presets": {
@@ -292,16 +292,39 @@ const sessionStore =
 
 const frameworkAuth =
     createAuth<AuthenticatedUser>({
-        store:
-            sessionStore,
-        idleTimeout:
-            60 * 30,
+        store: sessionStore,
+        idleTimeout: 60 * 30,
     });
 ```
 
 The memory store is intended for development/tests. Multi-process production deployments should implement `AuthSessionStore` using shared durable storage.
 
-Authentication Platform v2 also provides `logoutAll()`, session/user revocation APIs and `createGuestGuard()` for login/register pages.
+## Authorization & request security — 0.2.6+
+
+Generated applications can add permissions to their application user shape and use server-side permission guards without changing the auth preset routes:
+
+```ts
+import {
+    createPermissionGuard,
+    hasPermission,
+} from "bcp/auth";
+```
+
+For resource-specific decisions, use `defineAuthorizationPolicy()`, `can()` or `authorize()`.
+
+Cookie-authenticated mutation routes can opt into same-origin and CSRF protection through `bcp/server`:
+
+```ts
+import {
+    createCsrfToken,
+    requireCsrfRequest,
+    requireSameOriginRequest,
+} from "bcp/server";
+```
+
+`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`, so the generated JWT auth preset does not require another environment variable to get started. Production applications may define a separate `BCP_CSRF_SECRET` for independent key rotation.
+
+Authorization and CSRF checks must remain on the server; hiding UI controls in client code is not an authorization boundary.
 
 ## Application Packaging — 0.2.4+
 
@@ -337,8 +360,6 @@ npm ci --omit=dev
 npm start
 ```
 
-If the package manifest reports that no lockfile was included, use the install command recorded in `bcp.package.json`.
-
 ## Project generators after creation
 
 ```bash
@@ -357,14 +378,6 @@ bcp generate middleware
 bcp generate migration create_users
 ```
 
-From PowerShell:
-
-```powershell
-npm exec -- bcp-framework generate page dashboard/users
-```
-
-Use `--force` only when intentionally replacing an existing page/API/middleware scaffold.
-
 ## Options
 
 ```text
@@ -394,5 +407,5 @@ npx create-bcp-app my-app --yes
 The `--bcp` option is mainly for prerelease/local package verification:
 
 ```bash
-npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.5.tgz
+npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.6.tgz
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bcp-app",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Create a new BCP Framework application.",
   "type": "module",
   "license": "MIT",

package/template/README.md

@@ -56,16 +56,43 @@ const sessionStore =
 
 export const appAuth =
     createAuth({
-        store:
-            sessionStore,
-        idleTimeout:
-            60 * 30,
+        store: sessionStore,
+        idleTimeout: 60 * 30,
     });
 ```
 
 The memory store is intended for local development/tests. Use a shared durable `AuthSessionStore` implementation for multi-process or multi-container production deployments.
 
-Authentication Platform v2 also provides session revocation, `logoutAll()`, rotation with revocation, and `createGuestGuard()` for guest-only pages such as login/register routes.
+## Authorization & request security — BCP 0.2.6+
+
+Server-side permission guards:
+
+```ts
+import {
+    createPermissionGuard,
+} from "bcp/auth";
+
+export const guard =
+    createPermissionGuard(
+        "dashboard.read"
+    );
+```
+
+For ownership or resource-specific rules, use `defineAuthorizationPolicy()`, `can()` and `authorize()` from `bcp/auth`.
+
+Cookie-authenticated mutation routes can validate browser origin and CSRF state:
+
+```ts
+import {
+    createCsrfToken,
+    requireCsrfRequest,
+    requireSameOriginRequest,
+} from "bcp/server";
+```
+
+`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`.
+
+Authorization must always be enforced server-side. Client UI visibility is not a security boundary.
 
 ## Generate framework files