create-volt 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `create-volt` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.23.0] - 2026-06-29
+
+### Added
+- Plugin context now includes **`requireAuth`** and **`sessionFromReq`** (when the
+  auth add-on is on) so third-party add-ons can gate routes by login. Purely
+  additive — no change to defaults or security posture.
+
+### Note
+- New companion package **`volt-addon-editor`** (separate npm package): a
+  standing, role-gated RTEPro WYSIWYG editor that writes markdown pages. Mounts
+  only if `ADMIN_PATH` is set (**fail-closed**), behind magic-link auth + an
+  `ADMIN_EMAILS` allowlist; the secret path is obscurity *on top of* auth, never
+  instead. The AI key stays server-side via a key-injecting proxy. The core stays
+  no-standing-admin by default — install only where you want it
+  (`npx create-volt add editor`). See `/docs/editor`.
+
 ## [0.22.0] - 2026-06-29
 
 ### Added
@@ -318,6 +334,7 @@ All notable changes to `create-volt` are documented here. The format follows
   watching and full-page hot reload. Supports `--skip-install` and `--force`,
   and auto-detects npm / pnpm / yarn / bun for the install step.
 
+[0.23.0]: https://github.com/MIR-2025/volt/releases/tag/v0.23.0
 [0.22.0]: https://github.com/MIR-2025/volt/releases/tag/v0.22.0
 [0.21.0]: https://github.com/MIR-2025/volt/releases/tag/v0.21.0
 [0.20.0]: https://github.com/MIR-2025/volt/releases/tag/v0.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-volt",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Scaffold a new Volt app — no-build, signals-based UI with Socket.io hot reload.",
   "type": "module",
   "bin": {

package/templates/default/server.js

@@ -141,13 +141,21 @@ async function startApp() {
   const io = new SocketServer(server);
   if (enabled.has("realtime") && store) (await addonMod("realtime")).attachRealtime(io, { store });
 
-  // third-party add-ons — register(ctx) gets the app, io, store, mailer, and env
+  // third-party add-ons — register(ctx). When auth is on, requireAuth/sessionFromReq
+  // are provided so add-ons can gate routes by login.
+  let requireAuth = null;
+  let sessionFromReq = null;
+  if (enabled.has("auth") && store) {
+    const a = await addonMod("auth");
+    requireAuth = a.requireAuth(store);
+    sessionFromReq = (req) => a.sessionFromReq(store, req);
+  }
   for (const name of enabled) {
     if (BUILTINS.has(name)) continue;
     const mod = await loadAddon(name);
     const register = mod && (mod.register || mod.default);
     if (typeof register === "function") {
-      await register({ app, express, io, store, mailer, env: process.env, log: (...a) => console.log(`[${name}]`, ...a) });
+      await register({ app, express, io, store, mailer, env: process.env, requireAuth, sessionFromReq, log: (...a) => console.log(`[${name}]`, ...a) });
     } else {
       console.warn(`[volt] add-on "${name}" not found or missing a register() export — skipped`);
     }

package/templates/starter/server.js

@@ -167,13 +167,21 @@ async function startApp() {
   const io = new SocketServer(server);
   if (enabled.has("realtime") && store) (await addonMod("realtime")).attachRealtime(io, { store });
 
-  // third-party add-ons — register(ctx) gets the app, io, store, mailer, and env
+  // third-party add-ons — register(ctx). When auth is on, requireAuth/sessionFromReq
+  // are provided so add-ons can gate routes by login.
+  let requireAuth = null;
+  let sessionFromReq = null;
+  if (enabled.has("auth") && store) {
+    const a = await addonMod("auth");
+    requireAuth = a.requireAuth(store);
+    sessionFromReq = (req) => a.sessionFromReq(store, req);
+  }
   for (const name of enabled) {
     if (BUILTINS.has(name)) continue;
     const mod = await loadAddon(name);
     const register = mod && (mod.register || mod.default);
     if (typeof register === "function") {
-      await register({ app, express, io, store, mailer, env: process.env, log: (...a) => console.log(`[${name}]`, ...a) });
+      await register({ app, express, io, store, mailer, env: process.env, requireAuth, sessionFromReq, log: (...a) => console.log(`[${name}]`, ...a) });
     } else {
       console.warn(`[volt] add-on "${name}" not found or missing a register() export — skipped`);
     }