create-warlock 5.10.0 → 5.11.0

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `create-warlock` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.11.0 - 2026-09-14
+
+### Removed
+
+- The generated `guardedAdmin()` router helper. It only checked that the user was signed in — any user type — while its name and `/admin` prefix implied an admin-only area. New projects get `guarded()` (any authenticated user) and a documented example for restricting a group to a user type. Existing projects keep their own copy of the file; review it if you used `guardedAdmin`.
+
 ## 5.10.0 - 2026-09-14
 
 ### Fixed

package/package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@clack/prompts": "^0.7.0",
     "@mongez/copper": "^2.1.2",
-    "@warlock.js/fs": "5.10.0",
+    "@warlock.js/fs": "5.11.0",
     "@mongez/reinforcements": "^4.0.1",
     "cross-spawn": "^7.0.3",
     "rimraf": "^6.0.1",
@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=22.13"
   },
-  "version": "5.10.0",
+  "version": "5.11.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",

package/templates/warlock/docs/new-module.md

@@ -67,7 +67,7 @@ onceConnected(async () => {
 
 ### 2. routes.ts (Auto-imported)
 
-Main routing file that defines all module endpoints. This file is automatically imported by Warlock.js. Use router guards (`guarded`, `guardedAdmin`, `guardedGuest`, etc.) to protect routes.
+Main routing file that defines all module endpoints. This file is automatically imported by Warlock.js. Use router guards (`guarded`, `guardedGuest`, etc.) to protect routes — `guarded` requires an authenticated user; restrict a group to a specific user type (e.g. an admin-only area) by registering that type in `src/config/auth.ts` and passing it to `authMiddleware` directly, e.g. `authMiddleware(["admin"])`.
 
 **Example:**
 
@@ -531,7 +531,7 @@ export function formatUserName(user: User): string {
 
 7. **Routes:**
 
-   - Use appropriate guards (`guarded`, `guardedAdmin`, `guardedGuest`)
+   - Use appropriate guards (`guarded`, `guardedGuest`); restrict a group to a specific user type via `authMiddleware(["<type>"])`
    - Group related routes together
    - Use RESTful resources when appropriate
    - Routes file is auto-imported by Warlock.js

package/templates/warlock/src/app/shared/utils/router.ts

@@ -10,16 +10,18 @@ export function publicRoutes(callback: () => void) {
   );
 }
 
-export function guardedAdmin(callback: () => void) {
-  router.group(
-    {
-      prefix: "/admin",
-      middleware: [authMiddleware([])],
-    },
-    callback,
-  );
-}
-
+/**
+ * Require an authenticated user of the default `user` type. This scaffold
+ * registers only that one type (see `src/config/auth.ts`), so in a fresh
+ * project this effectively guards a block for any authenticated user.
+ *
+ * To restrict a group to a specific user type — for example an admin-only
+ * area — register that type in `src/config/auth.ts` and pass it explicitly
+ * to `authMiddleware`:
+ *
+ * @example
+ * router.group({ prefix: "/admin", middleware: [authMiddleware(["admin"])] }, callback);
+ */
 export function guarded(callback: () => void) {
   router.group(
     {