From superpowers-sage
Implements Laravel-style HTTP middleware in Acorn for WordPress/Sage/Bedrock routes, including JWT auth, rate limiting, CORS, custom guards, and role checks.
npx claudepluginhub codigodoleo/superpowers-sage --plugin superpowers-sageThis skill uses the workspace's default tool permissions.
- Protecting Acorn routes with authentication (JWT, API tokens, custom guards)
Sets up Laravel routing with Acorn in WordPress/Sage/Bedrock for custom endpoints, APIs, forms, dashboards, webhooks using controllers, middleware, and route model binding.
Provides Laravel middleware best practices: before/after patterns, terminable middleware, groups, parameters, and examples for auth checks, security headers, and request logging.
Implements Next.js 15/16 middleware for Edge (middleware.ts) and Node.js (proxy.ts), handling authentication, RBAC, redirects, rewrites, i18n, security headers, rate limiting, matchers, and geo routing.
Share bugs, ideas, or general feedback.
register_rest_route() endpoints — middleware does NOT run there; use add_action('admin_init') / rest_pre_dispatch insteadtemplate_redirect actionwp-rest-api skill guidance insteadroutes/web.php or routes/api.phpRouteServiceProvider bootedfirebase/php-jwt installed via lando theme-composer require firebase/php-jwtMiddleware filters HTTP requests before they reach route controllers — the same pipeline concept as Laravel. Each middleware inspects or transforms the request, then either passes it forward or returns a response early.
Critical distinction: Middleware only runs on Acorn-registered routes (defined in routes/web.php or routes/api.php). It does NOT intercept native WordPress requests (admin pages, REST API endpoints registered via register_rest_route(), or front-end page loads handled by the template hierarchy). Use add_action/add_filter hooks for WordPress-native requests.
# 1. Generate a middleware class
lando acorn make:middleware EnsureJsonResponse
# Or use the helper script (see Scripts section)
bash skills/acorn-middleware/scripts/create-middleware.sh MyMiddleware --type=filter
// app/Http/Middleware/EnsureJsonResponse.php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
class EnsureJsonResponse
{
public function handle(Request $request, Closure $next): Response
{
$request->headers->set('Accept', 'application/json');
return $next($request);
}
}
// app/Http/Kernel.php — register middleware aliases
protected $middlewareAliases = [
'auth.jwt' => \App\Http\Middleware\AuthenticateJwt::class,
'role' => \App\Http\Middleware\CheckRole::class,
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
];
// routes/api.php — apply to routes
Route::middleware(['auth.jwt', 'throttle:60,1'])->group(function () {
Route::get('/posts', [PostController::class, 'index']);
Route::post('/posts', [PostController::class, 'store'])->middleware('role:editor,administrator');
});
| Pattern | Class | Registration |
|---|---|---|
| Force JSON responses | EnsureJsonResponse | api middleware group |
| JWT auth | AuthenticateJwt | 'auth.jwt' alias |
| Role check | CheckRole | 'role:administrator' |
| Rate limiting | built-in ThrottleRequests | 'throttle:60,1' |
| CORS | built-in HandleCors | global middleware |
| Capability check | CheckCapability | 'capability:edit_posts' |
Deep content extracted from this skill. Read on demand — zero tokens until needed.
JwtService, AuthenticateJwt middleware, AuthController (login/refresh/me), route registration, client-side token flow, and .env variables.Guard contract, WordPressGuard implementation, registering via Auth::extend(), configuring config/auth.php, using auth()->user() in controllers.web, api, api.auth), middleware parameters, CheckRole, ThrottleRequests, CORS config, middleware ordering.current_user_can() returning false), best practices table, common mistakes table, escalation paths.# Create a new middleware via Lando
bash skills/acorn-middleware/scripts/create-middleware.sh <Name> [--type=auth|filter]
# Examples
bash skills/acorn-middleware/scripts/create-middleware.sh CheckApiKey --type=filter
bash skills/acorn-middleware/scripts/create-middleware.sh AuthenticateJwt --type=auth
Script: scripts/create-middleware.sh — runs lando acorn make:middleware <Name> with guard checks.
Boilerplate templates with {{PLACEHOLDER}} tokens. Copy and replace placeholders.
{{CLASS_NAME}} and {{GUARD_NAME}}.passes() hook. Replace {{CLASS_NAME}}, {{REJECTION_MESSAGE}}, {{REJECTION_STATUS}}.lando acorn route:list and verify the middleware alias appears in the middleware column for protected routes.For detailed debug tips and common mistake patterns, read references/troubleshooting.md.
See references/troubleshooting.md for the full failure modes list, common mistakes table, and escalation paths.
register_rest_route), or template-hierarchy requests.wp_set_current_user($user->ID) in JWT/auth middleware, or current_user_can() will fail downstream.JWT_SECRET. Use env('JWT_SECRET') and store a 32+ character random string in .env.app/Http/Kernel.php before registering middleware aliases or groups — without it, aliases silently do nothing.EnsureJsonResponse before auth in API groups.throttle:5,1 for login, throttle:10,1 for token refresh.$request->bearerToken(), not manual Authorization header parsing.