wyucandClaude Opus 4.8
ee79762ef9
When ACCESS_CODE is set, verification tokens (timestamp.HMAC) never expired because neither verifier checked the timestamp, and POST /api/access-code/verify had no attempt throttling. - Enforce a 7-day token lifetime in a shared, Edge-safe module used by both the Node verifier and the middleware Web-Crypto verifier, and reject non-canonical signatures in both. - Rate-limit verification only when the client identity is trusted (TRUST_PROXY_HEADERS=true): a per-client sliding window (10 failures / 60s) whose attempt is reserved atomically at check time, returning 429 with Retry-After. Without a trusted proxy the app cannot attribute requests to a client, so no shared throttle is applied — a long random ACCESS_CODE is the protection, and a warning is logged when it is short. - Store bounded, copied identity keys so a large forwarding header cannot retain memory. - Document the behavior in .env.example, README, and configuration docs. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This is a Next.js application generated with Create Fumadocs.
Run development server:
npm run dev
# or
pnpm dev
# or
yarn dev
The site is mounted under the /docs basePath, so open
http://localhost:3000/docs in your browser.
Build the static site (next build + static export, output in out/):
pnpm build
Explore
In the project, you can see:
lib/locales.mjs: Single source of truth for locales — language list, default locale, per-locale search tokenizer, RTL set, labels, and the/docsbasePath. Plain JS so thescripts/postexport.mjsbuild step can import it too.lib/source.ts: Content source adapter,loader()wires the MDX content with i18n.lib/layout.shared.tsx: Shared layout options (nav, GitHub link, Live Demo link).
| Route | Description |
|---|---|
app/(en) |
English (default locale), served unprefixed at /docs/<slug>. |
app/(intl)/[lang] |
Other locales, served at /docs/<lang>/<slug>. |
app/static.json/route.ts |
Build-time Orama static search index (served at /docs/static.json). |
scripts/postexport.mjs |
Post-build step: per-locale index redirects + English alias stubs. |
Fumadocs MDX
A source.config.ts config file has been included, you can customise different options like frontmatter schema.
Read the Introduction for further details.
Known limitations
English supports only top-level docs pages
The default locale (en) is served unprefixed (/docs/getting-started). To keep
it unprefixed without the hydration conflict that a catch-all two-route-group
split causes, the English route app/(en)/[slug] is a single (non-catch-all)
segment. As a result, nested English pages would 404 — e.g.
content/docs/guides/intro.mdx resolves for every other locale (their routes are
catch-all under app/(intl)/[lang]/[...slug]) but not for English.
Only top-level English docs pages work today. Adding nested English docs requires
revisiting the (en) route group (and resolving the hydration conflict that the
current split avoids); this is deliberately deferred.
Learn More
To learn more about Next.js and Fumadocs, take a look at the following resources:
- Next.js Documentation - learn about Next.js features and API.
- Learn Next.js - an interactive Next.js tutorial.
- Fumadocs - learn about Fumadocs