update readme

Author: levino

README.md

@@ -1,41 +1,47 @@
-# Website
+# Protected docs
 
-This website is built using [Docusaurus](https://docusaurus.io/), a modern static website generator.
+This is an example on how to restrict access to a documentation website written with [`docusaurus`](https://docusaurus.io/).
 
-### Installation
+## Details
 
-```
-$ yarn
-```
-
-### Local Development
-
-```
-$ yarn start
-```
+The implementation uses vercels ["middleware"](./middleware.ts) to check each request for the correct authentication data. For user management and authentication, a [`PocketBase`](https://pocketbase.io/) instance is used.
 
-This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
+## Considerations
 
-### Build
+It is important to note that at least with `docusaurus`, one cannot protect individual routes. This is because once one route has been opened, `docusaurus` behaves like a SPA and greedily loads all the content into the client. No way to disentangle that js-blob.
 
-```
-$ yarn build
-```
-
-This command generates static content into the `build` directory and can be served using any static contents hosting service.
+In this implementation, anybody can sign up and then immediately see the content. That is kinda pointless of course. It is possible to check for roles or attributes on the users. For example one could adjust the middleware like so:
 
-### Deployment
+```typescript
+// middleware.ts
+import PocketBase from "pocketbase";
+import { next, rewrite } from "@vercel/edge";
 
-Using SSH:
+export const config = {
+  matcher: ["/", "/((?!public/|api/).*)"],
+};
 
-```
-$ USE_SSH=true yarn deploy
+export default async function authentication(request: Request) {
+  const pb = new PocketBase("https://levinkeller.de");
+  const cookie = request.headers.get("cookie");
+  if (!cookie) return rewrite("/public/login.html");
+  pb.authStore.loadFromCookie(cookie);
+  try {
+    await pb.collection("users").authRefresh();
+    if (pb.authStore.model?.member) {
+      return next();
+    } else {
+      // not_a_member.html shows instructions on how to reach the admin to make the person a member.
+      return rewrite("/public/not_a_member.html");
+    }
+  } catch {
+    return rewrite("/public/login.html");
+  }
+}
 ```
 
-Not using SSH:
+Then only users whos accounts are made a "member" after creation could access the website.**Please be aware that this only is secure, iff you make sure that users cannot make themselves "members" [by using `@request.data.member:isset = false` in the appropriate API rules](https://github.com/pocketbase/pocketbase/discussions/5486#discussioncomment-10556948)!**
 
-```
-$ GIT_USER=<Your GitHub username> yarn deploy
-```
+## Run it yourself
 
-If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch.
+In order to run this yourself, you need to host a `PocketBase` instance and then fork this repo and adjust the values. Deployment needs to happen via vercel. I assume it also works on netlify or coolify with some minor adjustments.