This library needs alternative to middleware

[akomm]

I propose an module export of sort, name might be more generic than guard, because it might have other usages (evtl. middleware?)

type Maybe<T> = T | undefined | null
type GuardFunction = () => Promise<Maybe<Response>> | Maybe<Response>

export const guard: GuardFunction = ({request}) => {
   await session.requireActiveUser(request)
}

Behavior:
This function is invoked once for direct hit on the route its defined in or, or its child routes. When it returns null | undefined, nothing happens. If it returns or throws a Response, its served instead of the regular response from the matched route.

Currently you have to add await session.requireActiveUser(request) in every single action and loader that loads data or executes any action to properly protect your content. Even some intermediate layout routes that load data, otherwise this data is exposed to direct api hits.

I also have to add:
The current behavior, while technically it makes sense, is not very intuitive with the concept of JS being just enhancement and the outcome (not the UX) be it full page reload or local reload is expected to be mostly the same.

I think the loaders/actions are not a perfect fit for making those checks. The outcome on ssr and lokal is different (even though as said, technically it makes sense).

[machour]

There's already a conversation about middleware happening here: #2857 you may want to check it out

[akomm]

funny, searching middleware now gives some hits. I did it before and it was surprisingly empty. O.o