paneltir 0.6.0

package/template/api/panel-state.ts

@@ -0,0 +1,317 @@
+/**
+ * Saves this project's board back to this project's repository.
+ *
+ * COPIED FROM PANELTIR, AND NOW YOURS. It points at your repo, commits with
+ * your token, and validates your board's shape — nothing here is shared with
+ * any other project that uses the kit.
+ *
+ * The private panel POSTs its current state here; this function commits it
+ * through the GitHub API, so every edit made from the board is a normal commit
+ * with a diff and a history. Pushing to the branch triggers a rebuild, which
+ * is what makes the change visible on the site.
+ *
+ * The session cookie is re-checked here rather than trusted from the edge:
+ * the middleware is a gate, not a guarantee, and this function writes to the
+ * repository.
+ *
+ * Environment (Vercel project settings):
+ *   GH_TOKEN        fine-grained token with contents: read and write on THIS
+ *                   project's repository only. Server-side only; never sent to
+ *                   the browser.
+ *   ADMIN_PASSWORD  this project's panel password, which also signs the session.
+ *   SESSION_SECRET  optional signing key; defaults to ADMIN_PASSWORD.
+ *   PANEL_REPO      required "owner/repo" — this project's repository.
+ *   PANEL_FILE      optional path to the board within it.
+ *   PANEL_BRANCH    optional, defaults to main.
+ */
+import { SESSION_COOKIE, readCookie, verifyToken } from '../lib/session'
+
+/**
+ * Where the board lives in this repository. Set PANEL_FILE to override; the
+ * default is only a guess at a sensible place, and a wrong path here fails
+ * loudly on the first save rather than quietly writing somewhere else.
+ */
+const FILE_PATH = process.env.PANEL_FILE || 'src/data/panel-state.json'
+const MAX_BODY_BYTES = 512 * 1024
+
+interface VercelRequest {
+  method?: string
+  headers: Record<string, string | string[] | undefined>
+  body?: unknown
+}
+
+interface VercelResponse {
+  status: (code: number) => VercelResponse
+  json: (body: unknown) => void
+  setHeader: (name: string, value: string) => void
+  end: (body?: string) => void
+}
+
+function header(request: VercelRequest, name: string): string {
+  const value = request.headers[name]
+  return Array.isArray(value) ? (value[0] ?? '') : (value ?? '')
+}
+
+function authorized(request: VercelRequest): Promise<boolean> {
+  return verifyToken(readCookie(header(request, 'cookie'), SESSION_COOKIE))
+}
+
+/**
+ * Rejects anything that is not a board, before it reaches the repository.
+ *
+ * This is the same check the kit exports as `validateBoard`, written out here
+ * rather than imported. Two reasons, and both are about where this runs: a
+ * serverless function that pulls in the component library to check a JSON
+ * shape carries a React bundle it never renders, and this file is yours to
+ * edit — a board with a field of its own should be checkable without waiting
+ * for the kit. `npm run test:board` upstream puts the same boards to both and
+ * requires the same verdict, so the copy cannot quietly drift.
+ *
+ * ADAPT THIS TO YOUR BOARD. What is here checks the shape every Paneltir board
+ * shares. Whatever else yours relies on, check it here: this function is the
+ * only thing between a bad request and a commit, and a board that will not
+ * parse is a panel that will not open.
+ *
+ * It collects every problem instead of stopping at the first. Somebody looking
+ * at a rejected save wants the list.
+ */
+const BOARD_VERSION = 2
+const INTENTS = ['decide', 'explain', 'solve', 'do', 'cheap', 'safe', 'fast', 'askme', 'hold']
+const LEVELS = ['high', 'medium', 'low']
+const OWNERS = ['claude', 'you']
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function isText(value: unknown): boolean {
+  if (typeof value === 'string') return true
+  if (!isObject(value)) return false
+  return Object.values(value).every((entry) => typeof entry === 'string')
+}
+
+function invalidState(state: unknown): string | null {
+  const problems: string[] = []
+  const say = (at: string, says: string) => problems.push(at ? `${at}: ${says}` : says)
+
+  if (!isObject(state)) return 'the board is not a JSON object'
+
+  // Answered first: a board written for an older kit fails the shape check for
+  // reasons that are not faults, and saying "v" is the useful answer.
+  if (state.v !== BOARD_VERSION) {
+    return state.v === undefined
+      ? `v: no version. This panel reads v ${BOARD_VERSION}`
+      : `v: written for v ${JSON.stringify(state.v)}, and this panel reads v ${BOARD_VERSION}`
+  }
+
+  if (typeof state.project !== 'string') say('project', 'must be a string')
+  if (typeof state.updatedAt !== 'string') say('updatedAt', 'must be a string')
+
+  const columnIds = new Set<string>()
+  if (!Array.isArray(state.columns) || state.columns.length === 0) {
+    say('columns', 'must be a non-empty array — a board with no columns has nowhere to put a card')
+  } else {
+    state.columns.forEach((column, index) => {
+      const at = `columns[${index}]`
+      if (!isObject(column)) return say(at, 'must be an object')
+      if (typeof column.id !== 'string' || column.id === '') return say(`${at}.id`, 'must be a non-empty string')
+      if (columnIds.has(column.id)) say(`${at}.id`, `"${column.id}" is used by more than one column`)
+      columnIds.add(column.id)
+      if (!isText(column.title)) say(`${at}.title`, 'must be a string, or an object of language strings')
+    })
+  }
+
+  const areaIds = new Set<string>()
+  if (!Array.isArray(state.areas)) {
+    say('areas', 'must be an array')
+  } else {
+    state.areas.forEach((area, index) => {
+      if (!isObject(area) || typeof area.id !== 'string') return say(`areas[${index}].id`, 'must be a non-empty string')
+      areaIds.add(area.id)
+    })
+  }
+
+  const cardIds = new Set<string>()
+  if (!Array.isArray(state.cards)) {
+    say('cards', 'must be an array')
+  } else if (state.cards.length > 500) {
+    say('cards', 'too many cards')
+  } else {
+    state.cards.forEach((card, index) => {
+      const at = `cards[${index}]`
+      if (!isObject(card)) return say(at, 'must be an object')
+
+      if (typeof card.id !== 'string' || card.id === '') {
+        say(`${at}.id`, 'must be a non-empty string')
+      } else if (cardIds.has(card.id)) {
+        say(`${at}.id`, `"${card.id}" is used by more than one card`)
+      } else {
+        cardIds.add(card.id)
+      }
+
+      if (typeof card.column !== 'string') {
+        say(`${at}.column`, 'must be a string')
+      } else if (columnIds.size && !columnIds.has(card.column)) {
+        say(`${at}.column`, `"${card.column}" is not one of the board's columns, so this card is drawn nowhere`)
+      }
+
+      // A card whose area is missing or unknown is invisible behind every area
+      // filter: it is on the board and cannot be found from the filter row.
+      if (typeof card.area !== 'string') {
+        say(`${at}.area`, 'must be a string')
+      } else if (areaIds.size && !areaIds.has(card.area)) {
+        say(`${at}.area`, `"${card.area}" is not one of the board's areas`)
+      }
+
+      if (!isText(card.title)) say(`${at}.title`, 'must be a string, or an object of language strings')
+
+      for (const key of ['priority', 'risk']) {
+        const level = (card as Record<string, unknown>)[key]
+        if (level !== undefined && !LEVELS.includes(level as string)) {
+          say(`${at}.${key}`, `must be high, medium or low — found ${JSON.stringify(level)}`)
+        }
+      }
+
+      if (card.owner !== undefined && !OWNERS.includes(card.owner as string)) {
+        say(`${at}.owner`, `must be claude or you — found ${JSON.stringify(card.owner)}`)
+      }
+
+      if (card.intent !== undefined && card.intent !== null && !INTENTS.includes(card.intent as string)) {
+        say(`${at}.intent`, `${JSON.stringify(card.intent)} is not one of: ${INTENTS.join(', ')}`)
+      }
+
+      if (card.checks !== undefined && !Array.isArray(card.checks)) say(`${at}.checks`, 'must be an array')
+      if (card.notes !== undefined && !Array.isArray(card.notes)) say(`${at}.notes`, 'must be an array')
+    })
+  }
+
+  if (!Array.isArray(state.runs)) say('runs', 'must be an array')
+
+  return problems.length ? problems.join('; ') : null
+}
+
+
+/**
+ * What the panel needs, and what of it is actually configured.
+ *
+ * Reports only whether a variable is set, never its value: the panel needs to
+ * know it cannot save, not what the token is. Without this the first sign of a
+ * missing token is a failed save, which reads as the panel being broken rather
+ * than unfinished.
+ */
+function configuration() {
+  const repo = process.env.PANEL_REPO
+  const missing: string[] = []
+  if (!process.env.GH_TOKEN) missing.push('GH_TOKEN')
+  if (!repo) missing.push('PANEL_REPO')
+  return {
+    ready: missing.length === 0,
+    missing,
+    // Safe to echo: these are addresses, not secrets, and seeing the wrong one
+    // is how a misconfigured target gets noticed before it is written to.
+    repo: repo ?? null,
+    branch: process.env.PANEL_BRANCH || 'main',
+    file: FILE_PATH,
+  }
+}
+
+export default async function handler(request: VercelRequest, response: VercelResponse) {
+  response.setHeader('Cache-Control', 'no-store')
+
+  if (request.method !== 'POST' && request.method !== 'GET') {
+    response.setHeader('Allow', 'GET, POST')
+    return response.status(405).json({ error: 'Use GET or POST.' })
+  }
+
+  // Authorised before anything is reported: what is configured is not public.
+  if (!(await authorized(request))) {
+    return response.status(401).json({ error: 'Sign in to continue.' })
+  }
+
+  // GET asks what is set up; only POST writes.
+  if (request.method === 'GET') return response.status(200).json(configuration())
+
+  const token = process.env.GH_TOKEN
+  if (!token) return response.status(503).json({ error: 'GH_TOKEN is not configured.' })
+
+  // No default: writing to the wrong repository is worse than not writing.
+  const repo = process.env.PANEL_REPO
+  if (!repo) return response.status(503).json({ error: 'PANEL_REPO is not configured.' })
+  const branch = process.env.PANEL_BRANCH || 'main'
+
+  const payload = (typeof request.body === 'string' ? safeParse(request.body) : request.body) as
+    | { state?: unknown; message?: unknown }
+    | undefined
+  if (!payload) return response.status(400).json({ error: 'Malformed body.' })
+
+  const problem = invalidState(payload.state)
+  if (problem) return response.status(400).json({ error: problem })
+
+  const content = `${JSON.stringify(payload.state, null, 2)}\n`
+  if (Buffer.byteLength(content, 'utf8') > MAX_BODY_BYTES) {
+    return response.status(413).json({ error: 'The state is too large.' })
+  }
+
+  const message =
+    typeof payload.message === 'string' && payload.message.trim()
+      ? payload.message.trim().slice(0, 120)
+      : 'chore(panel): update the board from the panel'
+
+  const api = `https://api.github.com/repos/${repo}/contents/${FILE_PATH}`
+  const githubHeaders = {
+    authorization: `Bearer ${token}`,
+    accept: 'application/vnd.github+json',
+    'x-github-api-version': '2022-11-28',
+    'user-agent': 'paneltir-panel',
+  }
+
+  try {
+    // The current blob sha is what makes the write a fast-forward: if someone
+    // else changed the file meanwhile, GitHub rejects it instead of silently
+    // overwriting their edit.
+    const current = await fetch(`${api}?ref=${encodeURIComponent(branch)}`, { headers: githubHeaders })
+    if (!current.ok && current.status !== 404) {
+      return response.status(502).json({ error: `GitHub answered ${current.status} when reading the file.` })
+    }
+    const sha = current.ok ? ((await current.json()) as { sha?: string }).sha : undefined
+
+    const write = await fetch(api, {
+      method: 'PUT',
+      headers: { ...githubHeaders, 'content-type': 'application/json' },
+      body: JSON.stringify({
+        message,
+        content: Buffer.from(content, 'utf8').toString('base64'),
+        branch,
+        ...(sha ? { sha } : {}),
+      }),
+    })
+
+    if (!write.ok) {
+      const detail = (await write.json().catch(() => ({}))) as { message?: string }
+      const conflict = write.status === 409 || write.status === 422
+      return response.status(conflict ? 409 : 502).json({
+        error: conflict
+          ? 'The file changed in the repository since this panel loaded. Reload and save again.'
+          : `GitHub answered ${write.status}.`,
+        detail: detail.message,
+      })
+    }
+
+    const result = (await write.json()) as { commit?: { sha?: string; html_url?: string } }
+    return response.status(200).json({
+      ok: true,
+      sha: result.commit?.sha,
+      url: result.commit?.html_url,
+    })
+  } catch (error) {
+    return response.status(502).json({ error: 'Could not reach GitHub.', detail: String(error) })
+  }
+}
+
+function safeParse(value: string): unknown {
+  try {
+    return JSON.parse(value)
+  } catch {
+    return undefined
+  }
+}

package/template/lib/session.ts

@@ -0,0 +1,170 @@
+/**
+ * This project's panel session: one signed cookie, verified the same way on
+ * the edge and in the serverless functions.
+ *
+ * COPIED FROM PANELTIR, AND NOW YOURS. Its password is this project's, its
+ * secret is this project's, and nothing here is shared with any other project
+ * that uses the kit.
+ *
+ * The panel used HTTP Basic auth, which works but hands the browser's own
+ * credential dialog to anyone opening /admin — an untitled grey box that
+ * cannot be branded, cannot say what it is protecting, and cannot report a
+ * wrong password as anything other than showing itself again. So the password
+ * is posted to /api/login instead and answered with this cookie.
+ *
+ * The cookie carries no data worth protecting — only an expiry and a
+ * signature over it — so there is nothing in it to decrypt or tamper into
+ * something useful. Everything else is derived server-side.
+ *
+ * Web Crypto is used rather than node:crypto because this module runs in both
+ * runtimes: the edge middleware verifies the same token the Node function
+ * issues. For the same reason the environment is read through `env()` rather
+ * than touching `process` directly: a bare `process.env.X` is a ReferenceError
+ * wherever `process` is not defined, and in middleware that reads as the whole
+ * route crashing rather than as a missing variable.
+ *
+ * Environment:
+ *   ADMIN_PASSWORD  the password. Required; without it the panel fails closed.
+ *   SESSION_SECRET  optional signing key. Defaults to ADMIN_PASSWORD, which
+ *                   means changing the password invalidates every session
+ *                   already issued — the behaviour you want from a password
+ *                   change.
+ */
+
+export const SESSION_COOKIE = 'pt_session'
+/** Eight hours: a working day, then the panel asks again. */
+export const SESSION_MAX_AGE = 60 * 60 * 8
+const VERSION = 'v1'
+
+const encoder = new TextEncoder()
+
+/**
+ * Reads one variable, surviving a runtime with no `process` at all.
+ *
+ * The names are written out as literal `process.env.X` accesses because that
+ * is the form build tools substitute at build time; reading them through a
+ * computed key would leave nothing to substitute.
+ */
+export function env(name: 'ADMIN_PASSWORD' | 'SESSION_SECRET'): string | undefined {
+  try {
+    if (name === 'ADMIN_PASSWORD') return process.env.ADMIN_PASSWORD || undefined
+    return process.env.SESSION_SECRET || undefined
+  } catch {
+    return undefined
+  }
+}
+
+function signingSecret(): string | null {
+  const password = env('ADMIN_PASSWORD')
+  if (!password) return null
+  return env('SESSION_SECRET') || password
+}
+
+async function hmac(secret: string, message: string): Promise<string> {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  )
+  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message))
+  // base64url, so the value never needs escaping in a cookie.
+  let binary = ''
+  for (const byte of new Uint8Array(signature)) binary += String.fromCharCode(byte)
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+/** Compares two strings in constant time, so the response timing leaks nothing. */
+export function safeEqual(a: string, b: string): boolean {
+  const left = encoder.encode(a)
+  const right = encoder.encode(b)
+  // Fold the length difference into the result instead of returning early.
+  let diff = left.length ^ right.length
+  const max = Math.max(left.length, right.length)
+  for (let i = 0; i < max; i += 1) diff |= (left[i] ?? 0) ^ (right[i] ?? 0)
+  return diff === 0
+}
+
+/** Issues a token that stops being valid on its own, without any server state. */
+export async function issueToken(now = Date.now()): Promise<string | null> {
+  const secret = signingSecret()
+  if (!secret) return null
+  const expires = Math.floor(now / 1000) + SESSION_MAX_AGE
+  const body = `${VERSION}.${expires}`
+  return `${body}.${await hmac(secret, body)}`
+}
+
+export async function verifyToken(token: string | undefined, now = Date.now()): Promise<boolean> {
+  const secret = signingSecret()
+  if (!secret || !token) return false
+
+  const parts = token.split('.')
+  if (parts.length !== 3) return false
+  const [version, expires, signature] = parts
+  if (version !== VERSION) return false
+
+  const expiry = Number(expires)
+  if (!Number.isSafeInteger(expiry) || expiry * 1000 <= now) return false
+
+  // The signature is checked even when the expiry already failed above only in
+  // the sense that both paths are cheap; there is no secret in the expiry.
+  return safeEqual(signature, await hmac(secret, `${version}.${expires}`))
+}
+
+/** Reads one cookie out of a Cookie header, without a parser dependency. */
+export function readCookie(header: string | null | undefined, name: string): string | undefined {
+  if (!header) return undefined
+  for (const pair of header.split(';')) {
+    const eq = pair.indexOf('=')
+    if (eq === -1) continue
+    if (pair.slice(0, eq).trim() === name) return pair.slice(eq + 1).trim()
+  }
+  return undefined
+}
+
+/**
+ * `Secure` is left off on localhost only: a secure cookie is never stored over
+ * plain http, which would make the panel impossible to sign into in local
+ * development while changing nothing about how it behaves in production.
+ */
+export function sessionCookie(token: string, { secure = true } = {}): string {
+  return [
+    `${SESSION_COOKIE}=${token}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Lax',
+    secure ? 'Secure' : null,
+    `Max-Age=${SESSION_MAX_AGE}`,
+  ]
+    .filter(Boolean)
+    .join('; ')
+}
+
+export function clearedCookie({ secure = true } = {}): string {
+  return [
+    `${SESSION_COOKIE}=`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Lax',
+    secure ? 'Secure' : null,
+    'Max-Age=0',
+  ]
+    .filter(Boolean)
+    .join('; ')
+}
+
+/**
+ * Where to send someone after they sign in.
+ *
+ * Only a path on this site is ever accepted: anything absolute, protocol
+ * relative, or not starting with /admin falls back to the panel. Without this
+ * the login form would forward a visitor to any URL an attacker put in the
+ * query string, with the site's own name on the link.
+ */
+export function safeNext(raw: string | null | undefined): string {
+  if (!raw) return '/admin'
+  if (!raw.startsWith('/admin')) return '/admin'
+  if (raw.startsWith('//') || raw.includes('\\')) return '/admin'
+  return raw
+}

package/template/middleware.ts

@@ -0,0 +1,175 @@
+/**
+ * Vercel Edge Middleware — the gate in front of this project's private panel.
+ *
+ * COPIED FROM PANELTIR, AND NOW YOURS. Unlike anything in node_modules, this
+ * file is meant to be read and edited: it holds this project's password rule,
+ * not the kit's. `npx paneltir init` will not overwrite it once it exists.
+ *
+ * It guards /admin, the panel's own JavaScript bundle (emitted under
+ * assets/panel/ for exactly this reason) and the write API, so the board
+ * cannot be downloaded or committed to without a session.
+ *
+ * What it does when there is no session depends on what was asked for: a page
+ * is sent to the sign-in screen, anything else gets a 401 it can read. A page
+ * navigation answered with 401 is how you end up looking at the browser's own
+ * grey credential box, which is the thing this replaced.
+ *
+ * ## Why this file imports nothing
+ *
+ * It used to read the session through `lib/session.ts`, which is also what the
+ * serverless functions use — one module, no duplication. That version answered
+ * MIDDLEWARE_INVOCATION_FAILED in production: not a thrown request, because
+ * the handler already catches those, but the module failing before any of its
+ * code ran. The import was the only thing at that level that could fail.
+ *
+ * So this file is deliberately standalone. It is the one file that runs in a
+ * runtime nobody here can inspect, under a build nobody here controls, and it
+ * is the gate on everything private — the last place worth being clever about
+ * sharing code. `npm run test:auth` asserts that its copy of the token check
+ * agrees with `lib/session.ts` on the same inputs, so the duplication is held
+ * honest by a test rather than by memory.
+ *
+ * Two rules hold whatever else happens:
+ *
+ *   - it fails closed. Missing configuration, or a fault in this file, denies
+ *     the panel; nothing makes it fall open.
+ *   - it never throws. A middleware that throws takes the route down with a
+ *     crash page that says nothing, and the panel's own door is the worst
+ *     place to have to guess from.
+ */
+
+/**
+ * What the gate covers. Adjust the last entry to wherever this project's build
+ * emits the private panel's own JavaScript: protecting the page but not its
+ * bundle leaves the board downloadable by anyone who reads the HTML.
+ */
+export const config = {
+  matcher: ['/admin', '/admin/:path*', '/api/:path*', '/assets/panel/:path*'],
+}
+
+const SESSION_COOKIE = 'pt_session'
+const VERSION = 'v1'
+
+/**
+ * Reads one variable, surviving a runtime with no `process` at all.
+ *
+ * Written out as literal `process.env.X` accesses because that is the form
+ * build tools substitute at build time; a computed key would leave nothing to
+ * substitute. A bare access is a ReferenceError where `process` is undefined,
+ * which in middleware reads as the whole route crashing rather than as a
+ * missing variable — hence the catch.
+ */
+function env(name: 'ADMIN_PASSWORD' | 'SESSION_SECRET'): string | undefined {
+  try {
+    if (name === 'ADMIN_PASSWORD') return process.env.ADMIN_PASSWORD || undefined
+    return process.env.SESSION_SECRET || undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** Kept identical to lib/session.ts; test:auth asserts they agree. */
+function signingSecret(): string | null {
+  const password = env('ADMIN_PASSWORD')
+  if (!password) return null
+  return env('SESSION_SECRET') || password
+}
+
+function safeEqual(a: string, b: string): boolean {
+  const encoder = new TextEncoder()
+  const left = encoder.encode(a)
+  const right = encoder.encode(b)
+  let diff = left.length ^ right.length
+  const max = Math.max(left.length, right.length)
+  for (let i = 0; i < max; i += 1) diff |= (left[i] ?? 0) ^ (right[i] ?? 0)
+  return diff === 0
+}
+
+async function hmac(secret: string, message: string): Promise<string> {
+  const encoder = new TextEncoder()
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  )
+  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message))
+  let binary = ''
+  for (const byte of new Uint8Array(signature)) binary += String.fromCharCode(byte)
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+async function verifyToken(token: string | undefined, now = Date.now()): Promise<boolean> {
+  const secret = signingSecret()
+  if (!secret || !token) return false
+
+  const parts = token.split('.')
+  if (parts.length !== 3) return false
+  const [version, expires, signature] = parts
+  if (version !== VERSION) return false
+
+  const expiry = Number(expires)
+  if (!Number.isSafeInteger(expiry) || expiry * 1000 <= now) return false
+
+  return safeEqual(signature, await hmac(secret, `${version}.${expires}`))
+}
+
+function readCookie(header: string | null | undefined, name: string): string | undefined {
+  if (!header) return undefined
+  for (const pair of header.split(';')) {
+    const eq = pair.indexOf('=')
+    if (eq === -1) continue
+    if (pair.slice(0, eq).trim() === name) return pair.slice(eq + 1).trim()
+  }
+  return undefined
+}
+
+function closed(message: string, status = 503): Response {
+  return new Response(message, {
+    status,
+    headers: { 'Cache-Control': 'no-store', 'content-type': 'text/plain' },
+  })
+}
+
+async function gate(request: Request): Promise<Response | undefined> {
+  const url = new URL(request.url)
+  // Signing in cannot require being signed in.
+  if (url.pathname === '/api/login' || url.pathname === '/api/logout') return undefined
+
+  if (!env('ADMIN_PASSWORD')) {
+    return closed('The panel is not configured: ADMIN_PASSWORD is missing.')
+  }
+
+  const token = readCookie(request.headers.get('cookie'), SESSION_COOKIE)
+  if (await verifyToken(token)) return undefined
+
+  // A navigation asks for HTML first; fetch() from the panel asks for JSON.
+  if ((request.headers.get('accept') || '').includes('text/html')) {
+    const login = new URL('/login', url)
+    // So signing in returns to whatever was actually asked for.
+    login.searchParams.set('next', url.pathname + url.search)
+    // One header, built by hand: Response.redirect is not equally forgiving
+    // about being handed a URL rather than a string in every runtime.
+    return new Response(null, {
+      status: 302,
+      headers: { 'Cache-Control': 'no-store', location: login.toString() },
+    })
+  }
+
+  return new Response(JSON.stringify({ error: 'Sign in to continue.' }), {
+    status: 401,
+    headers: { 'Cache-Control': 'no-store', 'content-type': 'application/json' },
+  })
+}
+
+export default async function middleware(request: Request): Promise<Response | undefined> {
+  try {
+    return await gate(request)
+  } catch (error) {
+    // Named, not swallowed: an operator reading this should not have to open a
+    // log to find out which of the possible faults it is.
+    const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error)
+    return closed(`The panel gate failed, so the panel is closed.\n\n${detail.slice(0, 300)}`)
+  }
+}