stack-site-builder 1.13.0 → 1.14.0

package/src/components/StackCard.astro

@@ -26,9 +26,12 @@ interface Props {
   repo?: string;
   version?: string;
   deprecated?: boolean;
+  /** Private entry: show a lock and the (public) `teaser` instead of the description. */
+  isPrivate?: boolean;
+  teaser?: string;
 }
 
-const { slug, lang, name, formerNames = [], vendor, description, tags, pricing, license, language, category, logo, logoDark, repo, version, deprecated } =
+const { slug, lang, name, formerNames = [], vendor, description, tags, pricing, license, language, category, logo, logoDark, repo, version, deprecated, isPrivate = false, teaser } =
   Astro.props;
 const t = useTranslations(lang);
 const href = getRelativeLocaleUrl(lang, `stack/${slug}/`);
@@ -54,7 +57,11 @@ const langTokens = (language ?? '')
   .split('/')
   .map((s) => s.trim())
   .filter(Boolean);
-const searchText = `${name} ${description} ${tags.join(' ')}`.toLowerCase();
+// Private entries: the card carries only public copy — the title and the
+// authored `teaser` (description stays inside the encrypted detail page), and
+// the search index must not include the hidden description either.
+const shownDesc = isPrivate ? (teaser ?? '') : description;
+const searchText = `${name} ${shownDesc} ${tags.join(' ')}`.toLowerCase();
 ---
 
 {/* The card is a container, not a link: the name is the stretched primary link
@@ -85,6 +92,11 @@ const searchText = `${name} ${description} ${tags.join(' ')}`.toLowerCase();
       <div class="min-w-0">
         <h3 class="truncate text-base font-semibold text-[var(--aas-text)]">
           <a href={href} class="no-underline after:absolute after:inset-0 after:content-['']">
+            {isPrivate && (
+              <span aria-label={t('private.badge')} title={t('private.badge')}>
+                🔒{' '}
+              </span>
+            )}
             {name}
           </a>
         </h3>
@@ -100,7 +112,7 @@ const searchText = `${name} ${description} ${tags.join(' ')}`.toLowerCase();
     <p
       class="aas-md mt-2 text-sm leading-relaxed text-[var(--aas-muted)]"
       data-card-desc
-      set:html={inlineMd(description)}
+      set:html={inlineMd(shownDesc)}
     />
 
     {/* Secondary facts: version · release date · language · license.

package/src/components/StackDetail.astro

@@ -402,8 +402,16 @@ const relatedToolsByFolder = new Map(projectRail.map((p) => [p.folder, p.tools])
 
 <script>
   import { startScrollSpy, initBackToTop, initReveals } from '../lib/toc-rail-client';
+  import { initOnReady } from '../lib/reinit';
 
+  // Wrapped in initOnReady: on a private tool page all of this DOM sits inside
+  // the encrypted body, so the load-time run wires nothing (null rail, empty
+  // lists — its document listeners are inert) and the post-decryption run does
+  // the real wiring against the injected DOM.
+  initOnReady(() => {
   const rail = document.querySelector<HTMLElement>('[data-toc-rail]');
+  if (rail?.dataset.aasInit) return;
+  if (rail) rail.dataset.aasInit = '1';
   // Scroll-spy + back-to-top + prose-<details> persistence, shared with
   // TocRail.astro. The tab/version/example handlers below re-run the spy after
   // changing which headings are visible.
@@ -481,6 +489,7 @@ const relatedToolsByFolder = new Map(projectRail.map((p) => [p.folder, p.tools])
       });
     }),
   );
+  });
 </script>
 
 {

package/src/components/TagIndex.astro

@@ -45,6 +45,8 @@ const entries = (await getStacksByTag(lang, tag)).sort((a, b) =>
         repo={e.data.repo}
         version={e.data.version}
         deprecated={e.data.deprecated}
+        isPrivate={e.data.private}
+        teaser={e.data.teaser}
       />
     ))
   }

package/src/components/TocRail.astro

@@ -64,11 +64,17 @@ const hasContent = items.length > 0 || relatedTools.length > 0 || Boolean(projec
 
 <script>
   import { startScrollSpy, initBackToTop, initReveals } from '../lib/toc-rail-client';
+  import { initOnReady } from '../lib/reinit';
 
-  const rail = document.querySelector<HTMLElement>('[data-toc-rail]');
-  if (rail) {
-    startScrollSpy(rail);
-    initBackToTop(rail);
-    initReveals(rail);
-  }
+  // Re-runs after private-content decryption (the rail ships inside the
+  // encrypted body); the dataset flag keeps a live rail from double-wiring.
+  initOnReady(() => {
+    const rail = document.querySelector<HTMLElement>('[data-toc-rail]');
+    if (rail && !rail.dataset.aasInit) {
+      rail.dataset.aasInit = '1';
+      startScrollSpy(rail);
+      initBackToTop(rail);
+      initReveals(rail);
+    }
+  });
 </script>

package/src/components/VendorIndex.astro

@@ -45,6 +45,8 @@ const vendorName = entries[0]?.data.vendor ?? vendor;
         repo={e.data.repo}
         version={e.data.version}
         deprecated={e.data.deprecated}
+        isPrivate={e.data.private}
+        teaser={e.data.teaser}
       />
     ))
   }

package/src/content.ts

@@ -107,6 +107,11 @@ export function defineAasCollections({ categoryMap }: { categoryMap: Map<string,
         )
         .default([]),
       featured: z.boolean().default(false),
+      // Login-gated entry: the body ships encrypted and listings show only the
+      // title (+ `teaser`, an explicitly PUBLIC one-liner written for the gate).
+      // See docs/private-content-design.md. Requires the AAS_PRIVATE_* env vars.
+      private: z.boolean().default(false),
+      teaser: z.string().optional(),
     }),
   });
 
@@ -147,6 +152,10 @@ export function defineAasCollections({ categoryMap }: { categoryMap: Map<string,
           .optional(),
         tags: z.array(z.string()).default([]),
         draft: z.boolean().default(false),
+        // Login-gated entry (encrypted body; listings show title + optional
+        // PUBLIC `teaser`). See docs/private-content-design.md.
+        private: z.boolean().default(false),
+        teaser: z.string().optional(),
       }),
   });
 
@@ -181,6 +190,10 @@ export function defineAasCollections({ categoryMap }: { categoryMap: Map<string,
         tags: z.array(z.string()).default([]),
         order: z.number().optional(), // manual sort on the index (lower first)
         draft: z.boolean().default(false),
+        // Login-gated entry (encrypted body; listings show title + optional
+        // PUBLIC `teaser`). See docs/private-content-design.md.
+        private: z.boolean().default(false),
+        teaser: z.string().optional(),
       }),
   });
 
@@ -221,6 +234,10 @@ export function defineAasCollections({ categoryMap }: { categoryMap: Map<string,
       toc_level: z.number().int().min(2).max(4).default(2),
       toc_open: z.boolean().default(true),
       draft: z.boolean().default(false),
+      // Login-gated deck (encrypted body; the slides index shows title +
+      // optional PUBLIC `teaser`). See docs/private-content-design.md.
+      private: z.boolean().default(false),
+      teaser: z.string().optional(),
     }),
   });
 
@@ -249,6 +266,10 @@ export function defineAasCollections({ categoryMap }: { categoryMap: Map<string,
         navLabel: z.string().optional(),
         order: z.number().default(0),
         draft: z.boolean().default(false),
+        // Login-gated page (encrypted body; the nav/meta show title + optional
+        // PUBLIC `teaser`). See docs/private-content-design.md.
+        private: z.boolean().default(false),
+        teaser: z.string().optional(),
       }),
   });
 

package/src/i18n/ui.ts

@@ -67,6 +67,13 @@ export const ui = {
     'nav.menu': 'Menu',
     'code.copy': 'Copy code',
     'code.copied': 'Copied',
+    'private.badge': 'Private',
+    'private.locked': 'This content is private. Log in to view it.',
+    'private.id': 'ID',
+    'private.password': 'Password',
+    'private.submit': 'Unlock',
+    'private.error': 'Wrong ID or password.',
+    'private.logout': 'Log out',
     'slides.title': 'Slides',
     'slides.tagline': 'Concept decks — the same ideas as the concept pages, in slide form.',
     'slides.deck': 'Deck',
@@ -209,6 +216,13 @@ export const ui = {
     'nav.menu': '메뉴',
     'code.copy': '코드 복사',
     'code.copied': '복사됨',
+    'private.badge': '비공개',
+    'private.locked': '비공개 콘텐츠입니다. 로그인 후 볼 수 있습니다.',
+    'private.id': '아이디',
+    'private.password': '비밀번호',
+    'private.submit': '잠금 해제',
+    'private.error': '아이디 또는 비밀번호가 올바르지 않습니다.',
+    'private.logout': '로그아웃',
     'slides.title': '슬라이드',
     'slides.tagline': '개념 덱 — 개념 페이지와 같은 내용을 슬라이드로 옮겼습니다.',
     'slides.deck': '덱',

package/src/layouts/BaseLayout.astro

@@ -17,9 +17,11 @@ interface Props {
   path: string;
   /** Wider container — used by detail pages that have a right-rail TOC. */
   wide?: boolean;
+  /** Private entries: ask crawlers not to index the gate page. */
+  noindex?: boolean;
 }
 
-const { title, lang, path, wide = false } = Astro.props;
+const { title, lang, path, wide = false, noindex = false } = Astro.props;
 const t = useTranslations(lang);
 // Collapse any authored line breaks (used for on-page wrapping) to a single
 // space so the SEO meta description stays one clean line.
@@ -113,6 +115,7 @@ const navItems = allNavItems.filter((item) => !item.section || sectionEnabled(it
     <meta name="generator" content={Astro.generator} />
     <title>{title}</title>
     <meta name="description" content={description} />
+    {noindex && <meta name="robots" content="noindex" />}
     <link rel="icon" type="image/svg+xml" href={`${base.replace(/\/$/, '')}/favicon.svg`} />
     {/* On the root (default-locale) home, send first-time visitors to the
         locale matching their browser — unless they've already picked one (the
@@ -262,6 +265,8 @@ const navItems = allNavItems.filter((item) => !item.section || sectionEnabled(it
     <BackToTop lang={lang} />
 
     <script>
+      import { initOnReady } from '../lib/reinit';
+
       // Clicking a heading's "#" anchor copies that section's URL to the
       // clipboard (and updates the address bar) instead of just navigating.
       document.addEventListener('click', (e) => {
@@ -279,8 +284,9 @@ const navItems = allNavItems.filter((item) => !item.section || sectionEnabled(it
       // Mount a copy-to-clipboard button on every code block: README/overview
       // prose (.prose pre), the file viewer (.aas-projfile), and the Code tab
       // (.aas-code). The button is pinned to a non-scrolling host so it stays in
-      // place on long, horizontally-scrolling code.
-      (function mountCopyButtons() {
+      // place on long, horizontally-scrolling code. Re-runs after private-content
+      // decryption (mount() skips hosts that already have a button).
+      initOnReady(function mountCopyButtons() {
         const LABEL = document.documentElement.dataset.copyLabel || 'Copy code';
         const DONE = document.documentElement.dataset.copiedLabel || 'Copied';
         const COPY_ICON =
@@ -334,7 +340,7 @@ const navItems = allNavItems.filter((item) => !item.section || sectionEnabled(it
           const fig = el.closest('figure');
           mount(el, (fig as HTMLElement) ?? wrap(el));
         });
-      })();
+      });
 
       // Close any open <details> dropdown when clicking outside it (or on Esc).
       // Only nav dropdowns — leave file-tree folders (.aas-tree-dir) and prose

package/src/lib/private-client.ts

@@ -0,0 +1,160 @@
+/**
+ * Browser half of private content: login (PBKDF2 → unwrap the site key),
+ * session caching in localStorage, AES-GCM decryption and DOM injection.
+ * Crypto parameters must match src/lib/private.ts. Loaded only by PrivateGate.
+ */
+import { PRIVATE_DECRYPTED_EVENT } from './reinit';
+
+const KDF_ITERATIONS = 600_000;
+const STORE = 'aas:pk';
+
+interface GateData {
+  iv: string;
+  ct: string;
+  users: { h: string; s: string; iv: string; w: string }[];
+  salt: string; // build salt for id hashing, base64
+  days: number; // session lifetime (0 = never expires)
+}
+
+const dec = (s: string) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+const enc = (b: ArrayBuffer | Uint8Array) => btoa(String.fromCharCode(...new Uint8Array(b)));
+
+async function sha256Hex(bytes: Uint8Array): Promise<string> {
+  const d = await crypto.subtle.digest('SHA-256', bytes as BufferSource);
+  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+async function deriveKek(password: string, salt: Uint8Array): Promise<CryptoKey> {
+  const base = await crypto.subtle.importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, [
+    'deriveKey',
+  ]);
+  return crypto.subtle.deriveKey(
+    { name: 'PBKDF2', hash: 'SHA-256', salt: salt as BufferSource, iterations: KDF_ITERATIONS },
+    base,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['decrypt'],
+  );
+}
+
+async function aesDecrypt(keyBytes: Uint8Array | CryptoKey, iv: Uint8Array, data: Uint8Array): Promise<ArrayBuffer> {
+  const key =
+    keyBytes instanceof CryptoKey
+      ? keyBytes
+      : await crypto.subtle.importKey('raw', keyBytes as BufferSource, 'AES-GCM', false, ['decrypt']);
+  return crypto.subtle.decrypt({ name: 'AES-GCM', iv: iv as BufferSource }, key, data as BufferSource);
+}
+
+function storedKey(days: number): Uint8Array | null {
+  try {
+    const raw = localStorage.getItem(STORE);
+    if (!raw) return null;
+    const { k, t } = JSON.parse(raw) as { k: string; t: number };
+    if (days > 0 && Date.now() - t > days * 86_400_000) {
+      localStorage.removeItem(STORE);
+      return null;
+    }
+    return dec(k);
+  } catch {
+    return null;
+  }
+}
+
+function clearSession(): void {
+  try {
+    localStorage.removeItem(STORE);
+  } catch {
+    /* ignore */
+  }
+}
+
+/** Swap the gate for the decrypted HTML; re-run inline scripts; notify re-init hooks. */
+function inject(gate: HTMLElement, html: string, logoutLabel: string): void {
+  const host = document.createElement('div');
+  host.innerHTML = html;
+  // innerHTML-injected <script> tags don't execute — recreate each one so
+  // classic/inline scripts run (hoisted module scripts re-init via the event).
+  host.querySelectorAll('script').forEach((old) => {
+    const s = document.createElement('script');
+    for (const a of old.attributes) s.setAttribute(a.name, a.value);
+    s.textContent = old.textContent;
+    old.replaceWith(s);
+  });
+  // A discreet logout control above the content.
+  const bar = document.createElement('div');
+  bar.className = 'aas-private-bar';
+  const btn = document.createElement('button');
+  btn.type = 'button';
+  btn.className = 'aas-private-logout';
+  btn.textContent = `\u{1F513} ${logoutLabel}`;
+  btn.addEventListener('click', () => {
+    clearSession();
+    location.reload();
+  });
+  bar.appendChild(btn);
+  gate.replaceWith(bar, ...host.childNodes);
+  document.dispatchEvent(new CustomEvent(PRIVATE_DECRYPTED_EVENT));
+}
+
+async function tryDecrypt(gate: HTMLElement, data: GateData, keyBytes: Uint8Array, logoutLabel: string): Promise<boolean> {
+  try {
+    const html = new TextDecoder().decode(await aesDecrypt(keyBytes, dec(data.iv), dec(data.ct)));
+    inject(gate, html, logoutLabel);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Wire one gate element (PrivateGate renders exactly one per page). */
+export async function mountGate(gate: HTMLElement): Promise<void> {
+  const data = JSON.parse(gate.querySelector('[data-private-data]')!.textContent!) as GateData;
+  const logoutLabel = gate.dataset.logoutLabel ?? 'Log out';
+
+  // Already logged in on this device → decrypt with no form flash. A failure
+  // means the master secret rotated: drop the stale key and show the form.
+  const cachedK = storedKey(data.days);
+  if (cachedK && (await tryDecrypt(gate, data, cachedK, logoutLabel))) return;
+  if (cachedK) clearSession();
+  gate.querySelector<HTMLElement>('[data-private-form]')!.hidden = false;
+
+  const form = gate.querySelector('form')!;
+  const error = gate.querySelector<HTMLElement>('[data-private-error]')!;
+  form.addEventListener('submit', async (e) => {
+    e.preventDefault();
+    error.hidden = true;
+    const idInput = form.querySelector<HTMLInputElement>('input[name="id"]')!;
+    const pwInput = form.querySelector<HTMLInputElement>('input[name="password"]')!;
+    const button = form.querySelector<HTMLButtonElement>('button[type="submit"]')!;
+    button.disabled = true;
+    try {
+      const id = idInput.value.trim().toLowerCase();
+      const salt = dec(data.salt);
+      const idBytes = new TextEncoder().encode(id);
+      const joined = new Uint8Array(salt.length + idBytes.length);
+      joined.set(salt);
+      joined.set(idBytes, salt.length);
+      const h = await sha256Hex(joined);
+      const user = data.users.find((u) => u.h === h);
+      if (user) {
+        const kek = await deriveKek(pwInput.value, dec(user.s));
+        try {
+          const k = new Uint8Array(await aesDecrypt(kek, dec(user.iv), dec(user.w)));
+          if (await tryDecrypt(gate, data, k, logoutLabel)) {
+            try {
+              localStorage.setItem(STORE, JSON.stringify({ k: enc(k), t: Date.now() }));
+            } catch {
+              /* private browsing — session just won't persist */
+            }
+            return;
+          }
+        } catch {
+          /* wrong password (unwrap failed) — fall through to the error */
+        }
+      }
+      error.hidden = false;
+    } finally {
+      button.disabled = false;
+    }
+  });
+}

package/src/lib/private.ts

@@ -0,0 +1,129 @@
+/**
+ * Build-side half of private (login-gated) content. Runs only during
+ * `astro build` / `astro dev` (Node): derives the site content key, wraps it
+ * per user, and encrypts rendered HTML. The browser half (login + decrypt)
+ * lives in ./private-client.ts; the whole design is documented in
+ * docs/private-content-design.md.
+ *
+ * Env contract (see .env.sample in a consuming site):
+ *   AAS_PRIVATE_USERS         "id:password,id2:password2" (plaintext passwords)
+ *   AAS_PRIVATE_MASTER_SECRET stable secret K derives from; rotate = global logout
+ *   AAS_PRIVATE_SESSION_DAYS  client session lifetime in days (0 = never; default 30)
+ */
+import { createCipheriv, createHash, hkdfSync, pbkdf2Sync, randomBytes } from 'node:crypto';
+
+/** Must match private-client.ts. */
+export const KDF_ITERATIONS = 600_000;
+const HKDF_INFO = 'aas-private-v1';
+const MIN_PASSWORD_LENGTH = 10;
+
+export interface PrivateUserRecord {
+  /** SHA-256(buildSalt + lowercase(id)), hex — the deployed site never carries raw ids. */
+  h: string;
+  /** PBKDF2 salt, base64. */
+  s: string;
+  /** AES-GCM IV for the wrapped key, base64. */
+  iv: string;
+  /** wrappedK = AES-256-GCM(KEK, K) with auth tag appended, base64. */
+  w: string;
+}
+
+const b64 = (b: Buffer | Uint8Array) => Buffer.from(b).toString('base64');
+
+interface PrivateConfig {
+  key: Buffer; // K — the site content key
+  users: PrivateUserRecord[];
+  buildSalt: string; // base64; used by the client to hash the entered id
+  sessionDays: number;
+}
+
+let cached: PrivateConfig | null = null;
+
+/**
+ * Parse env + derive keys, once per build. Throws (failing the build loudly)
+ * when private entries exist but the env contract isn't met — a misconfigured
+ * build must not ship silently locked-forever pages.
+ */
+function getConfig(): PrivateConfig {
+  if (cached) return cached;
+
+  const secret = process.env.AAS_PRIVATE_MASTER_SECRET?.trim();
+  const usersRaw = process.env.AAS_PRIVATE_USERS?.trim();
+  if (!secret || !usersRaw) {
+    throw new Error(
+      '[private] this site has `private: true` entries, but AAS_PRIVATE_MASTER_SECRET ' +
+        'and/or AAS_PRIVATE_USERS is not set. Set both in .env (locally) or as CI ' +
+        'secrets — see docs/private-content-design.md.',
+    );
+  }
+
+  // K derives from the master secret (not random): ordinary redeploys keep
+  // logged-in devices working; rotating the secret is the global-logout switch.
+  const key = Buffer.from(hkdfSync('sha256', secret, 'aas-private', HKDF_INFO, 32));
+
+  const buildSaltBytes = randomBytes(16);
+  const users: PrivateUserRecord[] = [];
+  const seen = new Set<string>();
+  for (const pair of usersRaw.split(',')) {
+    const idx = pair.indexOf(':');
+    if (idx < 1) throw new Error(`[private] AAS_PRIVATE_USERS entry is not "id:password": "${pair.trim()}"`);
+    const id = pair.slice(0, idx).trim().toLowerCase();
+    const password = pair.slice(idx + 1).trim();
+    if (seen.has(id)) throw new Error(`[private] duplicate user id "${id}" in AAS_PRIVATE_USERS`);
+    seen.add(id);
+    if (password.length < MIN_PASSWORD_LENGTH)
+      throw new Error(
+        `[private] password for user "${id}" is shorter than ${MIN_PASSWORD_LENGTH} chars — ` +
+          'wrapped keys can be brute-forced offline, use a long passphrase',
+      );
+    const salt = randomBytes(16);
+    const kek = pbkdf2Sync(password, salt, KDF_ITERATIONS, 32, 'sha256');
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', kek, iv);
+    const wrapped = Buffer.concat([cipher.update(key), cipher.final(), cipher.getAuthTag()]);
+    users.push({
+      h: createHash('sha256').update(Buffer.concat([buildSaltBytes, Buffer.from(id)])).digest('hex'),
+      s: b64(salt),
+      iv: b64(iv),
+      w: b64(wrapped),
+    });
+  }
+
+  const daysRaw = process.env.AAS_PRIVATE_SESSION_DAYS?.trim();
+  const sessionDays = daysRaw === undefined || daysRaw === '' ? 30 : Number(daysRaw);
+  if (!Number.isFinite(sessionDays) || sessionDays < 0)
+    throw new Error(`[private] AAS_PRIVATE_SESSION_DAYS must be a number ≥ 0 (got "${daysRaw}")`);
+
+  console.warn(
+    '[private] this build contains private entries — remember: the SOURCE repo must be ' +
+      'private (the .mdx files are plaintext); only the built output is encrypted.',
+  );
+
+  cached = { key, users, buildSalt: b64(buildSaltBytes), sessionDays };
+  return cached;
+}
+
+/** Everything PrivateGate embeds for the client (records are ~120 bytes/user). */
+export function privateClientData(): { users: PrivateUserRecord[]; salt: string; days: number } {
+  const { users, buildSalt, sessionDays } = getConfig();
+  return { users, salt: buildSalt, days: sessionDays };
+}
+
+/** AES-256-GCM encrypt rendered HTML with the site content key. */
+export function encryptHtml(html: string): { iv: string; ct: string } {
+  const { key } = getConfig();
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const ct = Buffer.concat([cipher.update(html, 'utf8'), cipher.final(), cipher.getAuthTag()]);
+  return { iv: b64(iv), ct: b64(ct) };
+}
+
+/**
+ * Pathname registry for the sitemap filter: PrivateGate records every private
+ * page it renders; index.mjs (a separate module graph — hence globalThis) reads
+ * it in the sitemap `filter`, which @astrojs/sitemap runs after the pages built.
+ */
+export function registerPrivatePath(pathname: string): void {
+  const g = globalThis as { __aasPrivatePaths?: Set<string> };
+  (g.__aasPrivatePaths ??= new Set()).add(pathname.replace(/\/?$/, '/'));
+}

package/src/lib/reinit.ts

@@ -0,0 +1,12 @@
+/**
+ * Run a DOM-wiring routine now AND again whenever private content is decrypted
+ * and injected (the injected HTML wasn't there when page scripts first ran).
+ * Component scripts whose targets can sit inside a private gate wrap their init
+ * in this. `fn` must be idempotent or guard against double-wiring itself.
+ */
+export const PRIVATE_DECRYPTED_EVENT = 'aas:private-decrypted';
+
+export function initOnReady(fn: () => void): void {
+  fn();
+  document.addEventListener(PRIVATE_DECRYPTED_EVENT, () => fn());
+}

package/src/pages/[...lang]/[page].astro

@@ -3,6 +3,7 @@ import { site } from '@aas-data/site';
 import type { GetStaticPaths } from 'astro';
 import BaseLayout from '../../layouts/BaseLayout.astro';
 import PageDetail from '../../components/PageDetail.astro';
+import PrivateGate from '../../components/PrivateGate.astro';
 import { getPages, pageSlugOf } from '../../lib/pages';
 import { allLocales, langParam } from '../../lib/locales';
 
@@ -18,13 +19,17 @@ export const getStaticPaths = (async () => {
 
 const { lang, entry } = Astro.props;
 const slug = pageSlugOf(entry);
+const priv = entry.data.private;
 ---
 
 <BaseLayout
   title={`${entry.data.title} — ${site.name}`}
-  description={entry.data.description}
+  description={priv ? entry.data.teaser : entry.data.description}
   lang={lang}
   path={`${slug}/`}
+  noindex={priv}
 >
-  <PageDetail entry={entry} lang={lang} />
+  <PrivateGate enabled={priv} lang={lang} title={entry.data.title} teaser={entry.data.teaser}>
+    <PageDetail entry={entry} lang={lang} />
+  </PrivateGate>
 </BaseLayout>

package/src/pages/[...lang]/article/[...id].astro

@@ -3,6 +3,7 @@ import { site } from '@aas-data/site';
 import type { GetStaticPaths } from 'astro';
 import BaseLayout from '../../../layouts/BaseLayout.astro';
 import ArticleDetail from '../../../components/ArticleDetail.astro';
+import PrivateGate from '../../../components/PrivateGate.astro';
 import { getArticles, articleSlugOf } from '../../../lib/articles';
 import { allLocales, langParam } from '../../../lib/locales';
 
@@ -18,13 +19,17 @@ export const getStaticPaths = (async () => {
 
 const { lang, entry } = Astro.props;
 const slug = articleSlugOf(entry);
+const priv = entry.data.private;
 ---
 
 <BaseLayout
   title={`${entry.data.title} — ${site.name}`}
-  description={entry.data.description}
+  description={priv ? entry.data.teaser : entry.data.description}
   lang={lang}
   path={`article/${slug}/`}
+  noindex={priv}
 >
-  <ArticleDetail entry={entry} lang={lang} />
+  <PrivateGate enabled={priv} lang={lang} title={entry.data.title} teaser={entry.data.teaser}>
+    <ArticleDetail entry={entry} lang={lang} />
+  </PrivateGate>
 </BaseLayout>

package/src/pages/[...lang]/concept/[...id].astro

@@ -3,6 +3,7 @@ import { site } from '@aas-data/site';
 import type { GetStaticPaths } from 'astro';
 import BaseLayout from '../../../layouts/BaseLayout.astro';
 import ConceptDetail from '../../../components/ConceptDetail.astro';
+import PrivateGate from '../../../components/PrivateGate.astro';
 import { getConcepts, conceptSlugOf } from '../../../lib/concepts';
 import { allLocales, langParam } from '../../../lib/locales';
 
@@ -18,13 +19,17 @@ export const getStaticPaths = (async () => {
 
 const { lang, entry } = Astro.props;
 const slug = conceptSlugOf(entry);
+const priv = entry.data.private;
 ---
 
 <BaseLayout
   title={`${entry.data.title} — ${site.name}`}
-  description={entry.data.description}
+  description={priv ? entry.data.teaser : entry.data.description}
   lang={lang}
   path={`concept/${slug}/`}
+  noindex={priv}
 >
-  <ConceptDetail entry={entry} lang={lang} />
+  <PrivateGate enabled={priv} lang={lang} title={entry.data.title} teaser={entry.data.teaser}>
+    <ConceptDetail entry={entry} lang={lang} />
+  </PrivateGate>
 </BaseLayout>