jxp 4.0.0 → 4.1.1

package/templates/assets/api-console.js

@@ -116,8 +116,26 @@
 		}
 	}
 
+	async function loadSessionApiKey() {
+		const access = document.documentElement.dataset.docsAccess;
+		if (access !== "protected") return;
+		try {
+			const res = await fetch("/docs/session", { credentials: "same-origin" });
+			if (!res.ok) return;
+			const data = await res.json();
+			if (!data.apikey) return;
+			const input = document.getElementById("docs-api-key");
+			if (input) input.value = data.apikey;
+		} catch {
+			/* ignore */
+		}
+	}
+
 	document.addEventListener("DOMContentLoaded", function () {
-		loadStoredKey();
+		const access = document.documentElement.dataset.docsAccess;
+		loadSessionApiKey().then(function () {
+			if (access !== "protected") loadStoredKey();
+		});
 
 		const keyInput = document.getElementById("docs-api-key");
 		const remember = document.getElementById("docs-remember-key");

package/templates/assets/docs-login.js

@@ -0,0 +1,66 @@
+(function () {
+	"use strict";
+
+	document.addEventListener("DOMContentLoaded", function () {
+		const form = document.getElementById("docs-login-form");
+		const errEl = document.getElementById("docs-login-error");
+		if (!form || !errEl) return;
+
+		form.addEventListener("submit", async function (e) {
+			e.preventDefault();
+			errEl.hidden = true;
+			const email = form.email.value.trim();
+			const password = form.password.value;
+			const next =
+				form.next && form.next.value && form.next.value.startsWith("/")
+					? form.next.value
+					: "/docs/api";
+
+			try {
+				const loginRes = await fetch("/login", {
+					method: "POST",
+					headers: {
+						"Content-Type": "application/json",
+						Accept: "application/json",
+					},
+					body: JSON.stringify({ email, password }),
+				});
+				const loginBody = await loginRes.json().catch(function () {
+					return {};
+				});
+				if (loginRes.status === 429) {
+					errEl.textContent =
+						"Too many login attempts. Please wait a minute and try again.";
+					errEl.hidden = false;
+					return;
+				}
+				if (!loginRes.ok || !loginBody.apikey) {
+					errEl.textContent =
+						loginBody.message || "Incorrect email or password";
+					errEl.hidden = false;
+					return;
+				}
+
+				const sessRes = await fetch("/docs/session", {
+					method: "POST",
+					headers: {
+						"Content-Type": "application/json",
+						Accept: "application/json",
+					},
+					credentials: "same-origin",
+					body: JSON.stringify({ apikey: loginBody.apikey }),
+				});
+				if (!sessRes.ok) {
+					errEl.textContent = "Signed in but could not start docs session";
+					errEl.hidden = false;
+					return;
+				}
+
+				window.location.href = next;
+			} catch {
+				errEl.textContent = "Login request failed";
+				errEl.hidden = false;
+			}
+		});
+	});
+})();

package/templates/assets/docs.css

@@ -225,3 +225,20 @@ body.docs-body {
 .docs-security-note {
 	font-size: 0.8rem;
 }
+
+.docs-main-full {
+	max-width: 480px;
+	margin: 0 auto;
+	padding-top: 2rem;
+}
+
+.docs-login-wrap {
+	display: flex;
+	justify-content: center;
+	padding: 1rem 0 3rem;
+}
+
+.docs-login-card {
+	width: 100%;
+	max-width: 400px;
+}

package/templates/index.pug

@@ -18,15 +18,20 @@ block content
       .card.h-100
         .card-header.fw-semibold Quick start
         .card-body
-          p.mb-2 Authenticate with an API key header (optional for exploring docs; required for live calls):
+          p.mb-2 Authenticate with an API key header#{docs_access === 'public' ? ' (optional for exploring docs; required for live calls)' : ''}:
           pre.mb-3
             code.
               curl -H "X-API-Key: YOUR_KEY" \
                 "#{base_url}/api/MODEL?limit=5"
           p.mb-0.small.text-muted
-            | Set your key in the top bar to use 
-            strong Try it 
-            |  panels on API resource pages. Keys are stored in the browser only when “Remember” is checked.
+            if docs_access === 'protected'
+              | After signing in, your API key is filled in automatically for 
+              strong Try it 
+              |  panels on API resource pages.
+            else
+              | Set your key in the top bar to use 
+              strong Try it 
+              |  panels on API resource pages. Keys are stored in the browser only when “Remember” is checked.
     .col-md-6
       .card.h-100
         .card-header.fw-semibold API at a glance

package/templates/layout.pug

@@ -1,5 +1,5 @@
 doctype html
-html(lang="en")
+html(lang="en" data-docs-access=docs_access)
   head
     meta(charset="utf-8")
     meta(name="viewport" content="width=device-width, initial-scale=1")
@@ -9,10 +9,14 @@ html(lang="en")
     link(rel="stylesheet" href="/docs/assets/docs.css")
   body.docs-body
     include navbar
-    .docs-shell
-      include sidebar
-      main.docs-main
+    if hide_sidebar
+      main.docs-main.docs-main-full
         block content
+    else
+      .docs-shell
+        include sidebar
+        main.docs-main
+          block content
     script(src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.bundle.min.js" crossorigin="anonymous")
     script(src="/docs/assets/api-console.js" defer)
     block javascripts

package/templates/login.pug

@@ -0,0 +1,39 @@
+extends layout
+
+block content
+  .docs-login-wrap
+    .card.docs-login-card.shadow-sm
+      .card-body.p-4
+        h1.h4.mb-1 Sign in to explore the API
+        p.text-muted.small.mb-4
+          | Use your normal API account (
+          code POST /login
+          | ). Guides and this site stay open; model pages and “Try it” need a session.
+        #docs-login-error.alert.alert-danger(role="alert" hidden)
+        form#docs-login-form
+          input(type="hidden" name="next" value=docs_next)
+          .mb-3
+            label.form-label(for="docs-login-email") Email
+            input#docs-login-email.form-control(
+              type="email"
+              name="email"
+              value=docs_user_email
+              required
+              autocomplete="username"
+            )
+          .mb-3
+            label.form-label(for="docs-login-password") Password
+            input#docs-login-password.form-control(
+              type="password"
+              name="password"
+              required
+              autocomplete="current-password"
+            )
+          button.btn.btn-primary.w-100(type="submit") Sign in
+        p.mt-3.mb-0.small.text-muted
+          a(href="/") Back to home
+          |  · 
+          a(href="/docs/md/api.md") Read API docs without signing in
+
+block javascripts
+  script(src="/docs/assets/docs-login.js" defer)

package/templates/navbar.pug

@@ -5,10 +5,21 @@ header.docs-topbar.navbar.navbar-expand-lg.sticky-top
     a.docs-brand.navbar-brand.mb-0(href="/")= name
     span.badge.bg-secondary.ms-2.align-self-center v#{version}
     .ms-auto.d-flex.align-items-center.gap-2.flex-wrap
-      .docs-api-key-wrap
-        label.visually-hidden(for="docs-api-key") API Key
-        input#docs-api-key.form-control.form-control-sm(type="password" placeholder="X-API-Key (optional)" autocomplete="off")
-      .form-check.form-check-inline.mb-0.docs-security-note
-        input#docs-remember-key.form-check-input(type="checkbox")
-        label.form-check-label(for="docs-remember-key") Remember
-      span.docs-security-note.text-muted.d-none.d-md-inline Dev only
+      if docs_access === 'protected' && !docs_authenticated
+        a.btn.btn-sm.btn-outline-primary(href="/docs/login?next=/docs/api") Explore API
+      if docs_access !== 'disabled' && (docs_access !== 'protected' || docs_authenticated)
+        .docs-api-key-wrap
+          label.visually-hidden(for="docs-api-key") API Key
+          input#docs-api-key.form-control.form-control-sm(
+            type="password"
+            placeholder=docs_access === 'protected' ? "X-API-Key" : "X-API-Key (optional)"
+            autocomplete="off"
+          )
+        .form-check.form-check-inline.mb-0.docs-security-note
+          input#docs-remember-key.form-check-input(type="checkbox")
+          label.form-check-label(for="docs-remember-key") Remember
+        if docs_access === 'protected'
+          form.d-inline(method="post" action="/docs/logout")
+            button.btn.btn-sm.btn-link.text-muted(type="submit") Sign out
+        else
+          span.docs-security-note.text-muted.d-none.d-md-inline Dev only