docs(recipes): add auth csrf boundary

Document the provider-explicit auth/session and CSRF boundary for the SaaS tutorial. The recipe keeps cookies, sessions, CSRF policy, and rejection behavior in Axum/Tower/app code while hemx handlers continue to receive typed context/forms and return generated effects. req: laws/002 req: auth/001 req: auth/002 req: auth/003 req: auth/004 req: auth/005 req: failure/004 req: examples/001
2026-06-05 09:30:13 +02:00
parent 2c043d2f96
commit a7012b94c2
3 changed files with 238 additions and 3 deletions
@@ -12,7 +12,7 @@ What it proves today:
 - page shell with plain CSS and one explicit metrics island script
 - compile-time surface generation plus interaction tests

-For a provider-explicit persistence boundary, see `../../docs/recipes/sqlx-persistence.md`.
+For provider-explicit boundaries, see `../../docs/recipes/sqlx-persistence.md` and `../../docs/recipes/auth-session-csrf.md`.

 What it deliberately does not claim yet: