Imported from heisdeku/sanity-content-architecture-kit (astro/.claude/skills/basic-auth-and-redirects/SKILL.md). Install upstream with npx skills add heisdeku/sanity-content-architecture-kit --skill basic-auth-and-redirects. Copyright stays with the author.

Basic Auth and redirects

Name: basic-auth-and-redirects
Author: heisdeku

Both live in src/middleware.ts and src/features/site/{basic-auth,security,redirects}.ts.

Order (spec section 6): pass-through for assets, /studio, /api/* (except the rewrite-only Markdown route) -> Basic Auth -> redirects -> Markdown negotiation -> 404s.
SITE_SECURITY_QUERY returns basicAuthEnabled and the paths with passwordProtect; it is cached 60 s in memory. Site-wide wins. Credentials are BASIC_AUTH_USER and BASIC_AUTH_PASSWORD (env only), compared with timingSafeEqual.
If Sanity is unreachable the middleware fails open and logs a warning. If protection is on but credentials are missing it also fails open with a warning.
Protected responses are private, no-store and never enter the route cache.
Redirects come from site.redirects[] (REDIRECTS_QUERY, cached 60 s): exact from match, to is an appLink resolved with resolveLink, status 301 or 302 from the document.
/api/revalidate clears both TTL caches when the Site document changes.

{ "ocm": "1", "id": "heisdeku-sanity-content-architecture-kit-basic-auth-and-7fa30c", "kind": "skill", "name": "basic-auth-and-redirects", "description": "Site-wide and per-document Basic Auth plus CMS-managed redirects in the Astro middleware. Use when changing access protection or redirects.", "publisher": "heisdeku", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Site-wide and per-document Basic Auth plus CMS-managed redirects in the Astro middleware. Use when changing access protection or redirects." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/heisdeku/sanity-content-architecture-kit", "path": "astro/.claude/skills/basic-auth-and-redirects/SKILL.md", "ref": "270c441ec985e3e56ef0e3cf2315adfc13107bf0", "url": "https://github.com/heisdeku/sanity-content-architecture-kit/blob/270c441ec985e3e56ef0e3cf2315adfc13107bf0/astro/.claude/skills/basic-auth-and-redirects/SKILL.md", "key": "heisdeku/sanity-content-architecture-kit/astro/.claude/skills/basic-auth-and-redirects/SKILL.md" } }, "instructions": "# Basic Auth and redirects\n\nBoth live in `src/middleware.ts` and `src/features/site/{basic-auth,security,redirects}.ts`.\n\n- Order (spec section 6): pass-through for assets, `/studio`, `/api/*` (except the\n rewrite-only Markdown route) -> Basic Auth -> redirects -> Markdown negotiation -> 404s.\n- `SITE_SECURITY_QUERY` returns `basicAuthEnabled` and the paths with `passwordProtect`;\n it is cached 60 s in memory. Site-wide wins. Credentials are `BASIC_AUTH_USER` and\n `BASIC_AUTH_PASSWORD` (env only), compared with `timingSafeEqual`.\n- If Sanity is unreachable the middleware fails open and logs", "cost": { "context_tokens": 258 } }

basic-auth-and-redirects

About

Basic Auth and redirects

Use it

Manifest

Reviews