zeekay 372bf3e511 feat: auth-gated docs — OIDC login, per-page access control, sidebar filtering ...

Native auth support for @hanzo/docs framework. Any fork can enable
OIDC-based content gating with a single config object.

Core (@hanzo/docs-core):
- Frontmatter schema: `access` (public|authenticated|team|admin)
  and `accessOrgs` (string[]) fields
- Page tree: propagates access fields to sidebar Item nodes
- PageData interface extended with access fields

UI (@hanzo/docs-ui/auth):
- DocsAuthProvider + useDocsAuth() — React context, JWT cookie decode
- DocsLoginButton — sign in/out with avatar, navbar-ready
- Protected — inline content gate with blurred placeholder
- createDocsAuthMiddleware() — server-side JWT validation via jose JWKS
- createAuthHandlers() — /auth/login, /auth/callback, /auth/logout
- filterPageTreeByAccess() — hides gated pages from sidebar

MDX (@hanzo/docs-mdx):
- Re-exports accessSchema for consumer schema extension

Tests: 12/12 passing (filter-tree unit tests)
Example: apps/base-docs/content/docs/partner-guide.mdx

Usage for any fork:
```tsx
// middleware.ts
export default createDocsAuthMiddleware({
  enabled: true,
  issuer: 'https://iam.alpha.redacted.com',
  clientId: 'app-redacted-docs',
})

// layout.tsx
<DocsAuthProvider config={authConfig}>
  <DocsLoginButton />
  {children}
</DocsAuthProvider>

// any page frontmatter
---
access: authenticated
accessOrgs: ["acme"]
---
```

2026-03-20 15:51:13 -07:00

..

auth-filter-tree.test.ts

feat: auth-gated docs — OIDC login, per-page access control, sidebar filtering

2026-03-20 15:51:13 -07:00