diff --git a/content/(account)/api-keys.mdx b/content/(account)/api-keys.mdx index 1a2fa46b..506283b6 100644 --- a/content/(account)/api-keys.mdx +++ b/content/(account)/api-keys.mdx @@ -117,7 +117,7 @@ Lifetimes differ by kind: | Space key for an unclaimed Space | Matches that Space's unclaimed window. If you claim with **Claim & keep access**, it keeps working for another 7 days | | Continuation token | 30 minutes at most | -Share links, passwords, and machine credentials are the Space access model. They are covered in [access and share links](/access). +Share links, passwords, and machine credentials are the Space access model. They are covered in [Spacefast Share](/share). :::warning[Treat every one of these as a password] They go in a secret manager or an environment variable, never in a repository, a screenshot, or a chat message. A key pasted anywhere public should be revoked, not rotated later. diff --git a/content/(concepts)/spaces.mdx b/content/(concepts)/spaces.mdx index c85abcff..d76f4e69 100644 --- a/content/(concepts)/spaces.mdx +++ b/content/(concepts)/spaces.mdx @@ -66,7 +66,9 @@ The owner depends on how the Space was created: To move a Space to another team, run `sf spaces transfer --space docs`, or open **Space settings → General → Transfer this space → Transfer space…**. If you are an owner or admin of both teams, the move is instant. The Space keeps serving at its current address. Otherwise the target team has 7 days to accept, and nothing changes until they do. Roles and membership are on [Teams](/teams). -## Access when you create one + + +## Sharing when you create one A new team-owned Space starts at one of two presets. A Space published without an account has no owning team. Its space key and claim link open it until the claim window ends; see [Publish without an account](/anonymous-and-claim). @@ -79,7 +81,7 @@ The API still accepts `team` and treats it as `private`. Set it on the request that creates the Space, with `sf publish --access public` or the `access` field on `createPublish` and [`createSpace`](/api/reference/spaces/createspace). Sending `access` together with a `spaceId` is a validation error, because the field only applies at creation. Omit it and the Space takes the owning team's default for new Spaces. -Everything after that, including people, share links, passwords, and access requests, is on [Access and sharing](/access). +Everything after that, including people, share links, passwords, and access requests, is on [Spacefast Share](/share). ## Find your Spaces diff --git a/content/(concepts)/teams.mdx b/content/(concepts)/teams.mdx index cc6242f2..3ff06ec4 100644 --- a/content/(concepts)/teams.mdx +++ b/content/(concepts)/teams.mdx @@ -104,7 +104,7 @@ To hand the team over, use **Team settings → Danger zone → Transfer ownershi | `private` | Access for the owning team | | `public` | Access for the owning team, plus view access for anyone on the web | -The default is `private`. The API accepts `team` as a legacy spelling of `private`. From a terminal, `sf teams defaults` prints the current value and `sf teams defaults public` sets it. Per-Space access, share links, and passwords are covered in [access and share links](/access). +The default is `private`. The API accepts `team` as a legacy spelling of `private`. From a terminal, `sf teams defaults` prints the current value and `sf teams defaults public` sets it. Per-Space access, share links, and passwords are covered in [Spacefast Share](/share). ## Move a Space to another team diff --git a/content/(dynamic)/wordpress.mdx b/content/(dynamic)/wordpress.mdx index f1f28c51..8457f5ee 100644 --- a/content/(dynamic)/wordpress.mdx +++ b/content/(dynamic)/wordpress.mdx @@ -94,7 +94,7 @@ Five Abilities in the `zero-storage` category are registered by the runtime, so | `zero/storage-move` | write | Moves a file into a folder, creating the folder path if needed | `edit_post` | | `zero/storage-delete` | write | Trashes a file. It leaves every listing and stays recoverable | `delete_post` | -The "Needs" column is a WordPress capability. The Space projects it from the calling credential's Grant, so what a credential may do is decided per request against the path it asked for. See [Access and sharing](/access). +The "Needs" column is a WordPress capability. The Space projects it from the calling credential's Grant, so what a credential may do is decided per request against the path it asked for. See [Spacefast Share](/share). WordPress decides which file types `zero/storage-upload` accepts. diff --git a/content/(dynamic)/zero-runtime.mdx b/content/(dynamic)/zero-runtime.mdx index 572cf1c6..f3998ae0 100644 --- a/content/(dynamic)/zero-runtime.mdx +++ b/content/(dynamic)/zero-runtime.mdx @@ -199,7 +199,7 @@ Outbound access has nothing to do with who can open your space. Calling an API d ### Example: invite People from your app -There is no `ctx.people`. To invite someone to a private space, or resend their invite, call the People API from an action with a [machine credential](/access#machine-credentials). +There is no `ctx.people`. To invite someone to a private space, or resend their invite, call the People API from an action with a [machine credential](/share#machine-credentials). ```bash sf share token create --name invites --path '/**' --role manager --show-secret --json \ diff --git a/content/(reference)/config-file.mdx b/content/(reference)/config-file.mdx index 6a14e213..1e3dbb22 100644 --- a/content/(reference)/config-file.mdx +++ b/content/(reference)/config-file.mdx @@ -208,13 +208,15 @@ See [Functions](/functions). `sf.jsonc` is the only writer. See [Crons](/crons) for the schedule grammar. -## Access + + +## Sharing | Key | Type | Default | What it does | | --- | --- | --- | --- | | `access` | `"public"` or `{ public: string[] }` | none | Live paths that stay public whatever the Space's access setting is | -`"public"` is shorthand for `{ "public": ["/**"] }`. Prefix a pattern with `!` to exclude it, and use `*` and `**` as whole-segment wildcards. Patterns must be unique, and a non-empty list needs at least one inclusion. The declaration is inactive until the Space is claimed. See [Access](/access). +`"public"` is shorthand for `{ "public": ["/**"] }`. Prefix a pattern with `!` to exclude it, and use `*` and `**` as whole-segment wildcards. Patterns must be unique, and a non-empty list needs at least one inclusion. The declaration is inactive until the Space is claimed. See [Spacefast Share](/share). ## Routing diff --git a/content/(reference)/glossary.mdx b/content/(reference)/glossary.mdx index c7682bcd..038fb617 100644 --- a/content/(reference)/glossary.mdx +++ b/content/(reference)/glossary.mdx @@ -33,7 +33,7 @@ The runtime for shipping a worker alongside your site — npm packages, framewor ## Grant -One rule in a Space's access list: it names an audience (public, team, one person, a link, a password, a machine, or an external identity) and what that audience can do. A Space has no public-or-private flag — its access is just the sum of its grants. See [Access and sharing](/access). +One rule in a Space's access list: it names an audience (public, team, one person, a link, a password, a machine, or an external identity) and what that audience can do. A Space has no public-or-private flag — its access is just the sum of its grants. See [Spacefast Share](/share). ## Live (the live channel) diff --git a/content/(serve)/meta.ts b/content/(serve)/meta.ts index c3778f38..19a81121 100644 --- a/content/(serve)/meta.ts +++ b/content/(serve)/meta.ts @@ -10,7 +10,7 @@ export default defineMeta({ "routing", "caching", "stats", - "access", + "share", "customization", "site-pages", ], diff --git a/content/(serve)/routing.mdx b/content/(serve)/routing.mdx index 3e2344cc..a1fcc871 100644 --- a/content/(serve)/routing.mdx +++ b/content/(serve)/routing.mdx @@ -83,7 +83,7 @@ Header names must match `^[A-Za-z0-9-]+$`. Some names are owned by the platform | `cdn-cache-control`, `cloudflare-cdn-cache-control`, `netlify-cdn-cache-control`, `surrogate-control` | `header_cdn_cache_unsupported` | | `Basic-Auth` | `header_basic_auth_unsupported` | -`Basic-Auth` is rejected before anything else. The offending line is redacted from the diagnostics and stripped from the compiled bytes, so the credential never reaches a log. For real access control, see [Access and sharing](/access). +`Basic-Auth` is rejected before anything else. The offending line is redacted from the diagnostics and stripped from the compiled bytes, so the credential never reaches a log. For real access control, see [Spacefast Share](/share). `Cache-Control` is allowed and warns with `header_cache_control_platform_managed`. It applies to browser responses; shared caching is managed for you. See [Caching](/caching). diff --git a/content/(serve)/access.mdx b/content/(serve)/share.mdx similarity index 96% rename from content/(serve)/access.mdx rename to content/(serve)/share.mdx index 3e73de81..54f6cb4d 100644 --- a/content/(serve)/access.mdx +++ b/content/(serve)/share.mdx @@ -1,12 +1,14 @@ --- -title: Access and sharing +title: Spacefast Share description: Make a Space public, hand out scoped share links or a password, invite people, and revoke any of it sidebar: { order: 5 } --- -Visitor access comes from additive grants. Removing a public grant closes that route to the public only if no other public grant matches; links, people, and team access can remain. +Spacefast Share (formerly Spacefast Access) decides who can open a Space. Visitor access comes from additive grants. Removing a public grant closes that route to the public only if no other public grant matches; links, people, and team access can remain. -## Access is a list, not a switch + + +## Sharing uses grants Access is a set of additive **grants**, each one naming an audience, a set of capabilities, the paths it covers, and which published target it applies to. A matching grant admits a visitor. Revoking one grant does not revoke other matching grants or remove the owning team's permissions. @@ -39,7 +41,7 @@ Share links and passwords are forwardable secrets, so they cap at `viewer` or `c ## In the dashboard -Open the Space and go to **Access**. The page is titled **Manage access**. +Open the Space and go to **Share**. The **General access** card holds a segmented control with two options: diff --git a/content/(serve)/urls.mdx b/content/(serve)/urls.mdx index 179859d1..67b27e35 100644 --- a/content/(serve)/urls.mdx +++ b/content/(serve)/urls.mdx @@ -86,7 +86,7 @@ A share link is the page you want with the secret in the query string: https://my-site.space.fast/docs?__=sfl_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ``` -At the current hostname, one request returns that page without an access redirect or interstitial, so `curl` and an agent get the same document a browser does. Creating, scoping, and revoking them is on [Access and sharing](/access). +At the current hostname, one request returns that page without an access redirect or interstitial, so `curl` and an agent get the same document a browser does. Creating, scoping, and revoking them is on [Spacefast Share](/share). ## Hostnames you cannot claim diff --git a/content/agents/share-claude-artifact.mdx b/content/agents/share-claude-artifact.mdx index 6e63274c..738d88d6 100644 --- a/content/agents/share-claude-artifact.mdx +++ b/content/agents/share-claude-artifact.mdx @@ -27,9 +27,9 @@ See [Claude Code setup](/agents/claude-code) or [Claude Desktop setup](/agents/c ## Choose who can open it -New personal Spaces are private by default, and a bare URL to a private Space does not grant access. To let anyone on the web open it, set **General access** to **Public** in the Space's **Access** settings. +New personal Spaces are private by default, and a bare URL to a private Space does not grant access. To let anyone on the web open it, set **General access** to **Public** in the Space's **Share** settings. -For a restricted audience, keep the Space private and create a share link on the **Share link** card instead. Anyone with the share link can open the Space without an account. [Access and sharing](/access) explains the choices and how to revoke access. +For a restricted audience, keep the Space private and create a share link on the **Share link** card instead. Anyone with the share link can open the Space without an account. [Spacefast Share](/share) explains the choices and how to revoke access. ## Update the same link diff --git a/content/cli/publish.mdx b/content/cli/publish.mdx index 78bc0420..30f90323 100644 --- a/content/cli/publish.mdx +++ b/content/cli/publish.mdx @@ -151,7 +151,9 @@ sf publish ./dist --prebuilt # you built it, upload it unchanged `--remote` creates a build you can follow with [`sf builds logs`](/cli/builds). -## Access for a new Space + + +## Sharing a new Space `--access` sets root access at creation time only. diff --git a/content/cli/share.mdx b/content/cli/share.mdx index 2c83c807..66229e6a 100644 --- a/content/cli/share.mdx +++ b/content/cli/share.mdx @@ -17,7 +17,7 @@ Access is a list of **Grants**. Each Grant says who (audience), what they may do Credential-backed audiences get their own commands (`link`, `password`, `token`, `identity`) so the proof and its Grant are created in one write. `sf share grant` is for the two audiences that need no proof: `public` and `team`. -See [Access and sharing](/access) for the concepts. +See [Spacefast Share](/share) for the concepts. ## Space selection flags diff --git a/content/cli/spaces.mdx b/content/cli/spaces.mdx index 3fef0ad3..8dde9053 100644 --- a/content/cli/spaces.mdx +++ b/content/cli/spaces.mdx @@ -116,7 +116,7 @@ sf spaces add --name docs ### Output -The Space summary. `--json` returns the created Space with its state entry. A new team-owned Space has no automatic share link, so the receipt can omit `access`. The owning team signs in at the live URL. Create a [share link](/access#share-links) when you need one. Any access URL or claim link in a receipt is masked unless you pass `--show-secret`. +The Space summary. `--json` returns the created Space with its state entry. A new team-owned Space has no automatic share link, so the receipt can omit `access`. The owning team signs in at the live URL. Create a [share link](/share#share-links) when you need one. Any access URL or claim link in a receipt is masked unless you pass `--show-secret`. ## sf spaces update diff --git a/redirects.ts b/redirects.ts index 482c4763..c52217fd 100644 --- a/redirects.ts +++ b/redirects.ts @@ -3,7 +3,8 @@ // Blume prefixes deployment.base on both sides. export const redirects: { from: string; to: string; status: 301 }[] = [ - { from: "/access-control", to: "/access", status: 301 }, + { from: "/access", to: "/share", status: 301 }, + { from: "/access-control", to: "/share", status: 301 }, { from: "/analytics", to: "/stats", status: 301 }, { from: "/anonymous-publish", to: "/anonymous-and-claim", status: 301 }, { from: "/api/docs", to: "/api/reference#docs", status: 301 }, @@ -23,7 +24,7 @@ export const redirects: { from: string; to: string; status: 301 }[] = [ { from: "/api/versioning", to: "/api", status: 301 }, { from: "/builds", to: "/git", status: 301 }, { from: "/claim", to: "/anonymous-and-claim", status: 301 }, - { from: "/cli/access", to: "/access", status: 301 }, + { from: "/cli/access", to: "/share", status: 301 }, { from: "/cli/analytics", to: "/stats", status: 301 }, { from: "/cli/channels", to: "/cli/versions", status: 301 }, { from: "/cli/docs", to: "/cli", status: 301 }, diff --git a/scripts/docs-experience.test.mjs b/scripts/docs-experience.test.mjs index 7ef9a371..00a85c10 100644 --- a/scripts/docs-experience.test.mjs +++ b/scripts/docs-experience.test.mjs @@ -103,7 +103,7 @@ const firstFactCases = [ evidence: [/Space-level value/iu, /wins/iu, /team/iu], }, { - route: "/access", + route: "/share", question: "Does removing one public grant remove all access?", evidence: [/removing a public grant/iu, /no other public grant matches/iu, /links, people, and team access can remain/iu], }, diff --git a/scripts/redirect-rules.test.mjs b/scripts/redirect-rules.test.mjs index 9f9dc280..952c01b5 100644 --- a/scripts/redirect-rules.test.mjs +++ b/scripts/redirect-rules.test.mjs @@ -40,6 +40,9 @@ test("the complete compatibility map reserves the website's splats and host-spec assert.deepEqual(compilation.diagnostics.filter(({ severity }) => severity === "error"), []); assert.ok(compilation.stats.dynamicRedirectCount <= 100, JSON.stringify(compilation.stats)); for (const [source, destination] of [ + ["/access", "/share/"], + ["/access-control", "/share/"], + ["/cli/access", "/share/"], ["/platform-api", "/platforms/api/reference/"], ["/platform-api/spaces/getspace", "/platforms/api/reference/spaces/getspace/"], ]) {