Auth & edit mode

Louise ships the editor and the field contract; you own authentication. Any auth that can answer “is this request an editor?” works. This guide describes one concrete, secure approach as a baseline.

Edit mode is a signal, not a permission

Edit mode is a sticky cookie the host app resolves per request (toggled by a query param):

• ?louise → enter edit mode (Site Admins only) and set the cookie
• ?louise=off → clear it

When a Site Admin is in edit mode, middleware exposes two separate facts to the request:

• locals.editMode—the page renders edit affordances (markers, the bar).
• locals.editor—the save/media endpoints trust the write.

The rule

locals.editor—not the page’s edit mode—is what authorizes a write. Edit mode only decides whether affordances render; a save must be re-checked against the session. Never authorize a write on edit mode alone.

An example auth setup (Better Auth)

In this example, login is at /louise, passwordless via Better Auth magic-link delivered through Cloudflare Email Sending (Louise’s email primitive). Notable choices:

• Owner-allowlisted. The auth route rejects any email that isn’t the configured owner before Better Auth runs, returning an enumeration-safe response—so an anonymous caller can’t relay magic links to third parties or mint user rows.
• Passkeys for fast re-entry after a one-time, session-gated enrollment; magic link remains the bootstrap/fallback.
• Per-request construction. Better Auth is built per request (getAuth(env, baseURL)) because bindings and the signing secret only exist at request time on Workers.
• Rate-limited & captcha’d public POSTs (sign-in, contact, checkout).

None of this is in the louise package—it’s the host app’s wiring. Louise’s contribution is the email primitive the magic link rides on and the client that only renders once your middleware says “editor”.