Draft mode

Draft mode lets an editor see unpublished content. draftMode() (in @shadow-js/dusk/server) reports whether the current request is in draft mode, and while it is, the page cache and the data cache are bypassed. The secret is a variable of the environment (DUSK_DRAFT_SECRET by default, at least 32 characters). Two endpoints are served:

• POST /_dusk/draft/enable with a form or JSON body { "secret": "...", "path": "/posts/1" } sets a signed cookie and redirects to path (a path of this app). A wrong secret is 401.
• POST /_dusk/draft/disable clears the cookie.

The secret is never read from a URL, and a GET to either endpoint is 405. Both endpoints are POST requests, so they are protected by the same same-origin check as every state change. The secret is compared by its hash, so the time of a wrong guess does not depend on the secret.

The cookie (__dusk_draft) is HttpOnly, Secure on https, SameSite=Lax, Path=/, with no Domain. It lives eight hours: the Max-Age says so, and the signed value carries its own expiry, so a copy of the cookie stops working at the same time whatever a client does with Max-Age. The signature is made with the draft secret alone, so changing DUSK_DRAFT_SECRET ends every draft cookie at once (there is no list of older secrets: that is the way to revoke one). Rate limit the enable endpoint with the app-wide middleware if the secret could be guessed; the endpoint runs after it.