Authentication

Fumapress has no built-in login. You check the session in plugin middleware, which runs first on every request your server receives.

Vercel, Netlify and Cloudflare serve prerendered pages and the files of public/ without your server, so those requests never reach middleware. Render your content on demand to put it behind middleware.

Protecting the Whole SiteCopy Anchor Link

createPress(content, { mode: "force-dynamic" }); 

createPress(content).plugins({
  name: "site:auth",
  async middleware(request, next) {
    const session = await getSession(request);
    if (!session) return new Response("Unauthorized", { status: 401 });

    return next();
  },
});

Protecting a SectionCopy Anchor Link

Follow the first step of Protecting the Whole Site, then check in your middleware that the URL starts with the prefix. This check also covers client navigations and <page>.md.

createPress(content).plugins({
  name: "site:auth",
  async middleware(request, next) {
    const { pathname } = new URL(request.url);
    const session = await getSession(request);

    const isInternal =
      pathname.startsWith(this.withBase("/internal")) || pathname === this.withBase("/internal.md");

    if (isInternal && !session) return new Response("Unauthorized", { status: 401 });
    return next();
  },
});

With internationalization, the language prefix comes first, like /zh/internal.

URLs like //internal and /%69nternal redirect to /internal first, so your check only receives /internal.

Generated RoutesCopy Anchor Link

Plugins also serve your content at paths outside the prefix. For each route below, check its path in the same middleware, exclude the section with the options of the plugin, or remove the plugin.

Hiding Pages from the SidebarCopy Anchor Link

Middleware blocks a page, but the sidebar still shows its link. Remove the folder from the page tree, the data behind the sidebar:

createPress(content, {
  pageTree: {
    transformers: [
      {
        root(node) {
          return {
            ...node,
            children: node.children.filter((item) => item.name !== "Internal"), 
          };
        },
      },
    ],
  },
});

The tree is the same for every reader, so the section is hidden from everyone, signed in or not.