first commit

examples/basic-app/app/middleware/auth.ts

@@ -0,0 +1,16 @@
+import { getUser, type Context, type Next } from "@wrnexus/core";
+
+// Hydrates ctx.user from the session on every request, then guards protected
+// routes. `getUser(ctx)` is then available to every downstream page/API route.
+export default async function auth(ctx: Context, next: Next) {
+  // Populate ctx.user from the session (equivalent to the sessionAuth() helper).
+  ctx.user = ctx.session.get("user") ?? null;
+
+  // Protect the dashboard: send anonymous visitors to the login page.
+  if (ctx.url.pathname.startsWith("/dashboard") && getUser(ctx) == null) {
+    return new Response(null, { status: 302, headers: { Location: "/login?next=/dashboard" } });
+  }
+
+  ctx.locals.requestId = crypto.randomUUID();
+  return next();
+}

examples/basic-app/app/middleware/logger.ts

@@ -0,0 +1,6 @@
+import { requestLogger } from "@wrnexus/core";
+import { env } from "../env.ts"; // validated at startup (throws on misconfiguration)
+
+// Structured request logging: pretty in dev, JSON in production. Runs before
+// every page and API route; the request id is stored on ctx.locals.requestId.
+export default requestLogger({ format: env.NODE_ENV === "production" ? "json" : "pretty" });

examples/basic-app/app/middleware/ratelimit.ts

@@ -0,0 +1,16 @@
+import { rateLimit, type Context, type Next } from "@wrnexus/core";
+
+// Scoped rate limiting: throttle POST /api/login to blunt brute-force attempts.
+// The limiter keeps per-IP counters; other routes pass straight through.
+const loginLimiter = rateLimit({
+  max: 5,
+  windowMs: 60_000,
+  message: "Too many login attempts. Please wait a minute and try again.",
+});
+
+export default async function ratelimit(ctx: Context, next: Next) {
+  if (ctx.url.pathname === "/api/login" && ctx.req.method === "POST") {
+    return loginLimiter(ctx, next);
+  }
+  return next();
+}