create-bcp-app 0.2.5 → 0.2.7

package/README.md

@@ -92,10 +92,10 @@ Example:
   "schemaVersion": 1,
   "framework": "bcp",
   "projectName": "my-app",
-  "frameworkPackage": "npm:@chidchanun/bcp@0.2.5",
+  "frameworkPackage": "npm:@chidchanun/bcp@0.2.7",
   "createdWith": {
     "package": "create-bcp-app",
-    "version": "0.2.5"
+    "version": "0.2.7"
   },
   "packageManager": "npm",
   "presets": {
@@ -292,16 +292,70 @@ const sessionStore =
 
 const frameworkAuth =
     createAuth<AuthenticatedUser>({
-        store:
-            sessionStore,
-        idleTimeout:
-            60 * 30,
+        store: sessionStore,
+        idleTimeout: 60 * 30,
     });
 ```
 
 The memory store is intended for development/tests. Multi-process production deployments should implement `AuthSessionStore` using shared durable storage.
 
-Authentication Platform v2 also provides `logoutAll()`, session/user revocation APIs and `createGuestGuard()` for login/register pages.
+## Authorization & request security — 0.2.6+
+
+Generated applications can add permissions to their application user shape and use server-side permission guards without changing the auth preset routes:
+
+```ts
+import {
+    createPermissionGuard,
+    hasPermission,
+} from "bcp/auth";
+```
+
+For resource-specific decisions, use `defineAuthorizationPolicy()`, `can()` or `authorize()`.
+
+Cookie-authenticated mutation routes can opt into same-origin and CSRF protection through `bcp/server`:
+
+```ts
+import {
+    createCsrfToken,
+    requireCsrfRequest,
+    requireSameOriginRequest,
+} from "bcp/server";
+```
+
+`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`, so the generated JWT auth preset does not require another environment variable to get started. Production applications may define a separate `BCP_CSRF_SECRET` for independent key rotation.
+
+Authorization and CSRF checks must remain on the server; hiding UI controls in client code is not an authorization boundary.
+
+## Observability — 0.2.7+
+
+Generated projects can opt into process-local metrics and health/readiness without adding another dependency:
+
+```ts
+import {
+    createHealthRegistry,
+    createMetricsRegistry,
+    createRequestMetricsMiddleware,
+} from "bcp/observability";
+
+export const metrics =
+    createMetricsRegistry();
+
+export const health =
+    createHealthRegistry();
+
+export const requestMetrics =
+    createRequestMetricsMiddleware(
+        metrics
+    );
+```
+
+Expose metrics from an application API route with `createMetricsResponse(metrics)`. The response uses Prometheus-compatible text format.
+
+Health endpoints can return `health.response()`, which uses HTTP `200` when all checks pass and `503` when any dependency check fails or times out.
+
+The default HTTP request metrics use `method` and `status` labels only. Raw paths are intentionally excluded to avoid high-cardinality metric series.
+
+`bcp/observability` is server-only. Protect metrics and operational health detail with an appropriate network or authorization boundary when needed.
 
 ## Application Packaging — 0.2.4+
 
@@ -337,8 +391,6 @@ npm ci --omit=dev
 npm start
 ```
 
-If the package manifest reports that no lockfile was included, use the install command recorded in `bcp.package.json`.
-
 ## Project generators after creation
 
 ```bash
@@ -357,14 +409,6 @@ bcp generate middleware
 bcp generate migration create_users
 ```
 
-From PowerShell:
-
-```powershell
-npm exec -- bcp-framework generate page dashboard/users
-```
-
-Use `--force` only when intentionally replacing an existing page/API/middleware scaffold.
-
 ## Options
 
 ```text
@@ -394,5 +438,5 @@ npx create-bcp-app my-app --yes
 The `--bcp` option is mainly for prerelease/local package verification:
 
 ```bash
-npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.5.tgz
+npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.7.tgz
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bcp-app",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Create a new BCP Framework application.",
   "type": "module",
   "license": "MIT",

package/template/README.md

@@ -56,16 +56,74 @@ const sessionStore =
 
 export const appAuth =
     createAuth({
-        store:
-            sessionStore,
-        idleTimeout:
-            60 * 30,
+        store: sessionStore,
+        idleTimeout: 60 * 30,
     });
 ```
 
 The memory store is intended for local development/tests. Use a shared durable `AuthSessionStore` implementation for multi-process or multi-container production deployments.
 
-Authentication Platform v2 also provides session revocation, `logoutAll()`, rotation with revocation, and `createGuestGuard()` for guest-only pages such as login/register routes.
+## Authorization & request security — BCP 0.2.6+
+
+Server-side permission guards:
+
+```ts
+import {
+    createPermissionGuard,
+} from "bcp/auth";
+
+export const guard =
+    createPermissionGuard(
+        "dashboard.read"
+    );
+```
+
+For ownership or resource-specific rules, use `defineAuthorizationPolicy()`, `can()` and `authorize()` from `bcp/auth`.
+
+Cookie-authenticated mutation routes can validate browser origin and CSRF state:
+
+```ts
+import {
+    createCsrfToken,
+    requireCsrfRequest,
+    requireSameOriginRequest,
+} from "bcp/server";
+```
+
+`createCsrfToken()` uses `BCP_CSRF_SECRET` when configured and otherwise falls back to `BCP_SESSION_SECRET`.
+
+Authorization must always be enforced server-side. Client UI visibility is not a security boundary.
+
+## Observability — BCP 0.2.7+
+
+Create process-local metrics and health/readiness registries:
+
+```ts
+import {
+    createHealthRegistry,
+    createMetricsRegistry,
+    createRequestMetricsMiddleware,
+} from "bcp/observability";
+
+export const metrics =
+    createMetricsRegistry();
+
+export const health =
+    createHealthRegistry();
+
+export const requestMetrics =
+    createRequestMetricsMiddleware(
+        metrics
+    );
+```
+
+Expose Prometheus-compatible metrics with `createMetricsResponse(metrics)` from a server API route.
+
+Use `health.response()` for readiness endpoints. It returns HTTP `200` when all checks pass and `503` when a check fails or times out.
+
+The default request metrics use bounded `method` and `status` labels and do not include raw paths.
+
+Protect operational endpoints when their contents should not be public.
 
 ## Generate framework files