stack-site-builder 1.13.0 → 1.15.0

package/src/lib/private-client.ts

@@ -0,0 +1,160 @@
+/**
+ * Browser half of private content: login (PBKDF2 → unwrap the site key),
+ * session caching in localStorage, AES-GCM decryption and DOM injection.
+ * Crypto parameters must match src/lib/private.ts. Loaded only by PrivateGate.
+ */
+import { PRIVATE_DECRYPTED_EVENT } from './reinit';
+
+const KDF_ITERATIONS = 600_000;
+const STORE = 'aas:pk';
+
+interface GateData {
+  iv: string;
+  ct: string;
+  users: { h: string; s: string; iv: string; w: string }[];
+  salt: string; // build salt for id hashing, base64
+  days: number; // session lifetime (0 = never expires)
+}
+
+const dec = (s: string) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+const enc = (b: ArrayBuffer | Uint8Array) => btoa(String.fromCharCode(...new Uint8Array(b)));
+
+async function sha256Hex(bytes: Uint8Array): Promise<string> {
+  const d = await crypto.subtle.digest('SHA-256', bytes as BufferSource);
+  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+async function deriveKek(password: string, salt: Uint8Array): Promise<CryptoKey> {
+  const base = await crypto.subtle.importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, [
+    'deriveKey',
+  ]);
+  return crypto.subtle.deriveKey(
+    { name: 'PBKDF2', hash: 'SHA-256', salt: salt as BufferSource, iterations: KDF_ITERATIONS },
+    base,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['decrypt'],
+  );
+}
+
+async function aesDecrypt(keyBytes: Uint8Array | CryptoKey, iv: Uint8Array, data: Uint8Array): Promise<ArrayBuffer> {
+  const key =
+    keyBytes instanceof CryptoKey
+      ? keyBytes
+      : await crypto.subtle.importKey('raw', keyBytes as BufferSource, 'AES-GCM', false, ['decrypt']);
+  return crypto.subtle.decrypt({ name: 'AES-GCM', iv: iv as BufferSource }, key, data as BufferSource);
+}
+
+function storedKey(days: number): Uint8Array | null {
+  try {
+    const raw = localStorage.getItem(STORE);
+    if (!raw) return null;
+    const { k, t } = JSON.parse(raw) as { k: string; t: number };
+    if (days > 0 && Date.now() - t > days * 86_400_000) {
+      localStorage.removeItem(STORE);
+      return null;
+    }
+    return dec(k);
+  } catch {
+    return null;
+  }
+}
+
+function clearSession(): void {
+  try {
+    localStorage.removeItem(STORE);
+  } catch {
+    /* ignore */
+  }
+}
+
+/** Swap the gate for the decrypted HTML; re-run inline scripts; notify re-init hooks. */
+function inject(gate: HTMLElement, html: string, logoutLabel: string): void {
+  const host = document.createElement('div');
+  host.innerHTML = html;
+  // innerHTML-injected <script> tags don't execute — recreate each one so
+  // classic/inline scripts run (hoisted module scripts re-init via the event).
+  host.querySelectorAll('script').forEach((old) => {
+    const s = document.createElement('script');
+    for (const a of old.attributes) s.setAttribute(a.name, a.value);
+    s.textContent = old.textContent;
+    old.replaceWith(s);
+  });
+  // A discreet logout control above the content.
+  const bar = document.createElement('div');
+  bar.className = 'aas-private-bar';
+  const btn = document.createElement('button');
+  btn.type = 'button';
+  btn.className = 'aas-private-logout';
+  btn.textContent = `\u{1F513} ${logoutLabel}`;
+  btn.addEventListener('click', () => {
+    clearSession();
+    location.reload();
+  });
+  bar.appendChild(btn);
+  gate.replaceWith(bar, ...host.childNodes);
+  document.dispatchEvent(new CustomEvent(PRIVATE_DECRYPTED_EVENT));
+}
+
+async function tryDecrypt(gate: HTMLElement, data: GateData, keyBytes: Uint8Array, logoutLabel: string): Promise<boolean> {
+  try {
+    const html = new TextDecoder().decode(await aesDecrypt(keyBytes, dec(data.iv), dec(data.ct)));
+    inject(gate, html, logoutLabel);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Wire one gate element (PrivateGate renders exactly one per page). */
+export async function mountGate(gate: HTMLElement): Promise<void> {
+  const data = JSON.parse(gate.querySelector('[data-private-data]')!.textContent!) as GateData;
+  const logoutLabel = gate.dataset.logoutLabel ?? 'Log out';
+
+  // Already logged in on this device → decrypt with no form flash. A failure
+  // means the master secret rotated: drop the stale key and show the form.
+  const cachedK = storedKey(data.days);
+  if (cachedK && (await tryDecrypt(gate, data, cachedK, logoutLabel))) return;
+  if (cachedK) clearSession();
+  gate.querySelector<HTMLElement>('[data-private-form]')!.hidden = false;
+
+  const form = gate.querySelector('form')!;
+  const error = gate.querySelector<HTMLElement>('[data-private-error]')!;
+  form.addEventListener('submit', async (e) => {
+    e.preventDefault();
+    error.hidden = true;
+    const idInput = form.querySelector<HTMLInputElement>('input[name="id"]')!;
+    const pwInput = form.querySelector<HTMLInputElement>('input[name="password"]')!;
+    const button = form.querySelector<HTMLButtonElement>('button[type="submit"]')!;
+    button.disabled = true;
+    try {
+      const id = idInput.value.trim().toLowerCase();
+      const salt = dec(data.salt);
+      const idBytes = new TextEncoder().encode(id);
+      const joined = new Uint8Array(salt.length + idBytes.length);
+      joined.set(salt);
+      joined.set(idBytes, salt.length);
+      const h = await sha256Hex(joined);
+      const user = data.users.find((u) => u.h === h);
+      if (user) {
+        const kek = await deriveKek(pwInput.value, dec(user.s));
+        try {
+          const k = new Uint8Array(await aesDecrypt(kek, dec(user.iv), dec(user.w)));
+          if (await tryDecrypt(gate, data, k, logoutLabel)) {
+            try {
+              localStorage.setItem(STORE, JSON.stringify({ k: enc(k), t: Date.now() }));
+            } catch {
+              /* private browsing — session just won't persist */
+            }
+            return;
+          }
+        } catch {
+          /* wrong password (unwrap failed) — fall through to the error */
+        }
+      }
+      error.hidden = false;
+    } finally {
+      button.disabled = false;
+    }
+  });
+}

package/src/lib/private.ts

@@ -0,0 +1,129 @@
+/**
+ * Build-side half of private (login-gated) content. Runs only during
+ * `astro build` / `astro dev` (Node): derives the site content key, wraps it
+ * per user, and encrypts rendered HTML. The browser half (login + decrypt)
+ * lives in ./private-client.ts; the whole design is documented in
+ * docs/private-content-design.md.
+ *
+ * Env contract (see .env.sample in a consuming site):
+ *   AAS_PRIVATE_USERS         "id:password,id2:password2" (plaintext passwords)
+ *   AAS_PRIVATE_MASTER_SECRET stable secret K derives from; rotate = global logout
+ *   AAS_PRIVATE_SESSION_DAYS  client session lifetime in days (0 = never; default 30)
+ */
+import { createCipheriv, createHash, hkdfSync, pbkdf2Sync, randomBytes } from 'node:crypto';
+
+/** Must match private-client.ts. */
+export const KDF_ITERATIONS = 600_000;
+const HKDF_INFO = 'aas-private-v1';
+const MIN_PASSWORD_LENGTH = 10;
+
+export interface PrivateUserRecord {
+  /** SHA-256(buildSalt + lowercase(id)), hex — the deployed site never carries raw ids. */
+  h: string;
+  /** PBKDF2 salt, base64. */
+  s: string;
+  /** AES-GCM IV for the wrapped key, base64. */
+  iv: string;
+  /** wrappedK = AES-256-GCM(KEK, K) with auth tag appended, base64. */
+  w: string;
+}
+
+const b64 = (b: Buffer | Uint8Array) => Buffer.from(b).toString('base64');
+
+interface PrivateConfig {
+  key: Buffer; // K — the site content key
+  users: PrivateUserRecord[];
+  buildSalt: string; // base64; used by the client to hash the entered id
+  sessionDays: number;
+}
+
+let cached: PrivateConfig | null = null;
+
+/**
+ * Parse env + derive keys, once per build. Throws (failing the build loudly)
+ * when private entries exist but the env contract isn't met — a misconfigured
+ * build must not ship silently locked-forever pages.
+ */
+function getConfig(): PrivateConfig {
+  if (cached) return cached;
+
+  const secret = process.env.AAS_PRIVATE_MASTER_SECRET?.trim();
+  const usersRaw = process.env.AAS_PRIVATE_USERS?.trim();
+  if (!secret || !usersRaw) {
+    throw new Error(
+      '[private] this site has `private: true` entries, but AAS_PRIVATE_MASTER_SECRET ' +
+        'and/or AAS_PRIVATE_USERS is not set. Set both in .env (locally) or as CI ' +
+        'secrets — see docs/private-content-design.md.',
+    );
+  }
+
+  // K derives from the master secret (not random): ordinary redeploys keep
+  // logged-in devices working; rotating the secret is the global-logout switch.
+  const key = Buffer.from(hkdfSync('sha256', secret, 'aas-private', HKDF_INFO, 32));
+
+  const buildSaltBytes = randomBytes(16);
+  const users: PrivateUserRecord[] = [];
+  const seen = new Set<string>();
+  for (const pair of usersRaw.split(',')) {
+    const idx = pair.indexOf(':');
+    if (idx < 1) throw new Error(`[private] AAS_PRIVATE_USERS entry is not "id:password": "${pair.trim()}"`);
+    const id = pair.slice(0, idx).trim().toLowerCase();
+    const password = pair.slice(idx + 1).trim();
+    if (seen.has(id)) throw new Error(`[private] duplicate user id "${id}" in AAS_PRIVATE_USERS`);
+    seen.add(id);
+    if (password.length < MIN_PASSWORD_LENGTH)
+      throw new Error(
+        `[private] password for user "${id}" is shorter than ${MIN_PASSWORD_LENGTH} chars — ` +
+          'wrapped keys can be brute-forced offline, use a long passphrase',
+      );
+    const salt = randomBytes(16);
+    const kek = pbkdf2Sync(password, salt, KDF_ITERATIONS, 32, 'sha256');
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', kek, iv);
+    const wrapped = Buffer.concat([cipher.update(key), cipher.final(), cipher.getAuthTag()]);
+    users.push({
+      h: createHash('sha256').update(Buffer.concat([buildSaltBytes, Buffer.from(id)])).digest('hex'),
+      s: b64(salt),
+      iv: b64(iv),
+      w: b64(wrapped),
+    });
+  }
+
+  const daysRaw = process.env.AAS_PRIVATE_SESSION_DAYS?.trim();
+  const sessionDays = daysRaw === undefined || daysRaw === '' ? 30 : Number(daysRaw);
+  if (!Number.isFinite(sessionDays) || sessionDays < 0)
+    throw new Error(`[private] AAS_PRIVATE_SESSION_DAYS must be a number ≥ 0 (got "${daysRaw}")`);
+
+  console.warn(
+    '[private] this build contains private entries — remember: the SOURCE repo must be ' +
+      'private (the .mdx files are plaintext); only the built output is encrypted.',
+  );
+
+  cached = { key, users, buildSalt: b64(buildSaltBytes), sessionDays };
+  return cached;
+}
+
+/** Everything PrivateGate embeds for the client (records are ~120 bytes/user). */
+export function privateClientData(): { users: PrivateUserRecord[]; salt: string; days: number } {
+  const { users, buildSalt, sessionDays } = getConfig();
+  return { users, salt: buildSalt, days: sessionDays };
+}
+
+/** AES-256-GCM encrypt rendered HTML with the site content key. */
+export function encryptHtml(html: string): { iv: string; ct: string } {
+  const { key } = getConfig();
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const ct = Buffer.concat([cipher.update(html, 'utf8'), cipher.final(), cipher.getAuthTag()]);
+  return { iv: b64(iv), ct: b64(ct) };
+}
+
+/**
+ * Pathname registry for the sitemap filter: PrivateGate records every private
+ * page it renders; index.mjs (a separate module graph — hence globalThis) reads
+ * it in the sitemap `filter`, which @astrojs/sitemap runs after the pages built.
+ */
+export function registerPrivatePath(pathname: string): void {
+  const g = globalThis as { __aasPrivatePaths?: Set<string> };
+  (g.__aasPrivatePaths ??= new Set()).add(pathname.replace(/\/?$/, '/'));
+}

package/src/lib/reinit.ts

@@ -0,0 +1,12 @@
+/**
+ * Run a DOM-wiring routine now AND again whenever private content is decrypted
+ * and injected (the injected HTML wasn't there when page scripts first ran).
+ * Component scripts whose targets can sit inside a private gate wrap their init
+ * in this. `fn` must be idempotent or guard against double-wiring itself.
+ */
+export const PRIVATE_DECRYPTED_EVENT = 'aas:private-decrypted';
+
+export function initOnReady(fn: () => void): void {
+  fn();
+  document.addEventListener(PRIVATE_DECRYPTED_EVENT, () => fn());
+}

package/src/lib/sections.ts

@@ -11,13 +11,24 @@ import { site } from '@aas-data/site';
  * the `nav` / `draft` frontmatter, or by not authoring the page.
  *
  * A site sets overrides in `src/data/site.ts` (`sections`), which astro.config
- * also forwards to the theme integration for route filtering. Omitted = enabled.
+ * also forwards to the theme integration for route filtering. Omitted = enabled —
+ * except `courses`, which is opt-IN (`{ courses: true }`): enabling it requires
+ * site-side data (`src/data/course-categories.ts`), so it must never switch on
+ * by a theme upgrade alone.
  */
-export type SectionKey = 'concepts' | 'articles' | 'samples' | 'slides' | 'glossary' | 'pages';
+export type SectionKey =
+  | 'concepts'
+  | 'articles'
+  | 'courses'
+  | 'samples'
+  | 'slides'
+  | 'glossary'
+  | 'pages';
 
 const DEFAULTS: Record<SectionKey, boolean> = {
   concepts: true,
   articles: true,
+  courses: false, // opt-in: needs src/data/course-categories.ts on the site
   samples: true,
   slides: true,
   glossary: true,

package/src/pages/[...lang]/[page].astro

@@ -3,6 +3,7 @@ import { site } from '@aas-data/site';
 import type { GetStaticPaths } from 'astro';
 import BaseLayout from '../../layouts/BaseLayout.astro';
 import PageDetail from '../../components/PageDetail.astro';
+import PrivateGate from '../../components/PrivateGate.astro';
 import { getPages, pageSlugOf } from '../../lib/pages';
 import { allLocales, langParam } from '../../lib/locales';
 
@@ -18,13 +19,17 @@ export const getStaticPaths = (async () => {
 
 const { lang, entry } = Astro.props;
 const slug = pageSlugOf(entry);
+const priv = entry.data.private;
 ---
 
 <BaseLayout
   title={`${entry.data.title} — ${site.name}`}
-  description={entry.data.description}
+  description={priv ? entry.data.teaser : entry.data.description}
   lang={lang}
   path={`${slug}/`}
+  noindex={priv}
 >
-  <PageDetail entry={entry} lang={lang} />
+  <PrivateGate enabled={priv} lang={lang} title={entry.data.title} teaser={entry.data.teaser}>
+    <PageDetail entry={entry} lang={lang} />
+  </PrivateGate>
 </BaseLayout>

package/src/pages/[...lang]/article/[...id].astro

@@ -3,6 +3,7 @@ import { site } from '@aas-data/site';
 import type { GetStaticPaths } from 'astro';
 import BaseLayout from '../../../layouts/BaseLayout.astro';
 import ArticleDetail from '../../../components/ArticleDetail.astro';
+import PrivateGate from '../../../components/PrivateGate.astro';
 import { getArticles, articleSlugOf } from '../../../lib/articles';
 import { allLocales, langParam } from '../../../lib/locales';
 
@@ -18,13 +19,17 @@ export const getStaticPaths = (async () => {
 
 const { lang, entry } = Astro.props;
 const slug = articleSlugOf(entry);
+const priv = entry.data.private;
 ---
 
 <BaseLayout
   title={`${entry.data.title} — ${site.name}`}
-  description={entry.data.description}
+  description={priv ? entry.data.teaser : entry.data.description}
   lang={lang}
   path={`article/${slug}/`}
+  noindex={priv}
 >
-  <ArticleDetail entry={entry} lang={lang} />
+  <PrivateGate enabled={priv} lang={lang} title={entry.data.title} teaser={entry.data.teaser}>
+    <ArticleDetail entry={entry} lang={lang} />
+  </PrivateGate>
 </BaseLayout>

package/src/pages/[...lang]/concept/[...id].astro

@@ -3,6 +3,7 @@ import { site } from '@aas-data/site';
 import type { GetStaticPaths } from 'astro';
 import BaseLayout from '../../../layouts/BaseLayout.astro';
 import ConceptDetail from '../../../components/ConceptDetail.astro';
+import PrivateGate from '../../../components/PrivateGate.astro';
 import { getConcepts, conceptSlugOf } from '../../../lib/concepts';
 import { allLocales, langParam } from '../../../lib/locales';
 
@@ -18,13 +19,17 @@ export const getStaticPaths = (async () => {
 
 const { lang, entry } = Astro.props;
 const slug = conceptSlugOf(entry);
+const priv = entry.data.private;
 ---
 
 <BaseLayout
   title={`${entry.data.title} — ${site.name}`}
-  description={entry.data.description}
+  description={priv ? entry.data.teaser : entry.data.description}
   lang={lang}
   path={`concept/${slug}/`}
+  noindex={priv}
 >
-  <ConceptDetail entry={entry} lang={lang} />
+  <PrivateGate enabled={priv} lang={lang} title={entry.data.title} teaser={entry.data.teaser}>
+    <ConceptDetail entry={entry} lang={lang} />
+  </PrivateGate>
 </BaseLayout>

package/src/pages/[...lang]/course/[...id].astro

@@ -0,0 +1,35 @@
+---
+import { site } from '@aas-data/site';
+import type { GetStaticPaths } from 'astro';
+import BaseLayout from '../../../layouts/BaseLayout.astro';
+import CourseDetail from '../../../components/CourseDetail.astro';
+import PrivateGate from '../../../components/PrivateGate.astro';
+import { getCourses, courseSlugOf } from '../../../lib/courses';
+import { allLocales, langParam } from '../../../lib/locales';
+
+export const getStaticPaths = (async () => {
+  const paths: Awaited<ReturnType<GetStaticPaths>> = [];
+  for (const lang of allLocales) {
+    for (const entry of await getCourses(lang)) {
+      paths.push({ params: { lang: langParam(lang), id: courseSlugOf(entry) }, props: { lang, entry } });
+    }
+  }
+  return paths;
+}) satisfies GetStaticPaths;
+
+const { lang, entry } = Astro.props;
+const slug = courseSlugOf(entry);
+const priv = entry.data.private;
+---
+
+<BaseLayout
+  title={`${entry.data.title} — ${site.name}`}
+  description={priv ? entry.data.teaser : entry.data.description}
+  lang={lang}
+  path={`course/${slug}/`}
+  noindex={priv}
+>
+  <PrivateGate enabled={priv} lang={lang} title={entry.data.title} teaser={entry.data.teaser}>
+    <CourseDetail entry={entry} lang={lang} />
+  </PrivateGate>
+</BaseLayout>

package/src/pages/[...lang]/course/category/[id].astro

@@ -0,0 +1,25 @@
+---
+import { site } from '@aas-data/site';
+import type { GetStaticPaths } from 'astro';
+import BaseLayout from '../../../../layouts/BaseLayout.astro';
+import CourseIndex from '../../../../components/CourseIndex.astro';
+import { courseTree } from '@aas-data/course-categories';
+import { allLocales, langParam } from '../../../../lib/locales';
+
+export const getStaticPaths = (() => {
+  const paths: Awaited<ReturnType<GetStaticPaths>> = [];
+  for (const lang of allLocales) {
+    for (const id of courseTree.allIds) {
+      paths.push({ params: { lang: langParam(lang), id }, props: { lang, id } });
+    }
+  }
+  return paths;
+}) satisfies GetStaticPaths;
+
+const { lang, id } = Astro.props as { lang: string; id: string };
+const node = courseTree.map.get(id)!;
+---
+
+<BaseLayout title={`${node.label[lang]} — ${site.name}`} lang={lang} path={`course/category/${id}/`}>
+  <CourseIndex lang={lang} categoryId={id} />
+</BaseLayout>

package/src/pages/[...lang]/course/index.astro

@@ -0,0 +1,18 @@
+---
+import { site } from '@aas-data/site';
+import type { GetStaticPaths } from 'astro';
+import BaseLayout from '../../../layouts/BaseLayout.astro';
+import CourseIndex from '../../../components/CourseIndex.astro';
+import { useTranslations } from '../../../i18n/ui';
+import { allLocales, langParam } from '../../../lib/locales';
+
+export const getStaticPaths = (() =>
+  allLocales.map((lang) => ({ params: { lang: langParam(lang) }, props: { lang } }))) satisfies GetStaticPaths;
+
+const { lang } = Astro.props;
+const t = useTranslations(lang);
+---
+
+<BaseLayout title={`${t('course.title')} — ${site.name}`} lang={lang} path="course/">
+  <CourseIndex lang={lang} />
+</BaseLayout>

package/src/pages/[...lang]/rss.xml.ts

@@ -0,0 +1,40 @@
+import rss from '@astrojs/rss';
+import type { APIContext, GetStaticPaths } from 'astro';
+import { getRelativeLocaleUrl } from 'astro:i18n';
+import { site } from '@aas-data/site';
+import { getArticles, articleSlugOf } from '../../lib/articles';
+import { allLocales, langParam } from '../../lib/locales';
+import { useTranslations } from '../../i18n/ui';
+
+// Per-locale RSS feed of the articles collection: /rss.xml (default locale)
+// and /<code>/rss.xml. Injected with the `articles` section, so a site that
+// turns the blog off has no feed either.
+export const getStaticPaths = (() =>
+  allLocales.map((lang) => ({
+    params: { lang: langParam(lang) },
+    props: { lang },
+  }))) satisfies GetStaticPaths;
+
+export async function GET(context: APIContext) {
+  const { lang } = context.props as { lang: string };
+  const t = useTranslations(lang);
+  if (!context.site) {
+    throw new Error('RSS needs `site` set in astro.config (it already powers the sitemap).');
+  }
+  // getArticles drops drafts; private entries stay out of the feed entirely,
+  // mirroring the sitemap's private-page filter.
+  const articles = (await getArticles(lang)).filter((a) => !a.data.private);
+  return rss({
+    title: `${site.name} — ${t('blog.title')}`,
+    description: t('blog.tagline'),
+    site: context.site,
+    customData: `<language>${lang}</language>`,
+    items: articles.map((a) => ({
+      title: a.data.title,
+      description: a.data.description,
+      pubDate: a.data.date,
+      // Locale-relative and base-aware; rss() resolves it against `site`.
+      link: getRelativeLocaleUrl(lang, `article/${articleSlugOf(a)}/`),
+    })),
+  });
+}

package/src/pages/[...lang]/stack/[...id].astro

@@ -4,6 +4,7 @@ import type { GetStaticPaths } from 'astro';
 import { getRelativeLocaleUrl } from 'astro:i18n';
 import BaseLayout from '../../../layouts/BaseLayout.astro';
 import StackDetail from '../../../components/StackDetail.astro';
+import PrivateGate from '../../../components/PrivateGate.astro';
 import { getStacks, getStackAliases, slugOf, type StackEntry } from '../../../lib/stacks';
 import { allLocales, langParam } from '../../../lib/locales';
 
@@ -28,6 +29,7 @@ const { lang, entry, redirectTo } = Astro.props as {
   redirectTo: string | null;
 };
 const target = redirectTo ? getRelativeLocaleUrl(lang, `stack/${redirectTo}/`) : null;
+const priv = entry?.data.private ?? false;
 ---
 
 {
@@ -48,11 +50,14 @@ const target = redirectTo ? getRelativeLocaleUrl(lang, `stack/${redirectTo}/`) :
   ) : (
     <BaseLayout
       title={`${entry!.data.name} — ${site.name}`}
-      description={entry!.data.description}
+      description={priv ? entry!.data.teaser : entry!.data.description}
       lang={lang}
       path={`stack/${slugOf(entry!)}/`}
+      noindex={priv}
     >
-      <StackDetail entry={entry!} lang={lang} />
+      <PrivateGate enabled={priv} lang={lang} title={entry!.data.name} teaser={entry!.data.teaser}>
+        <StackDetail entry={entry!} lang={lang} />
+      </PrivateGate>
     </BaseLayout>
   )
 }