Changes for version 0.12 - 2026-08-15
- Adds Punk::Auth. The `auth` keyword freezes the config at to_app (model, a fields map so existing schemas need no renames, session_key, roles hook, rank ladder); croaks without a session, on any unknown option, and on a roles target typo - at boot.
- Context surface: $c->login / logout / auth_id / current_user (memoized per request, model loaded through an await seam so the blocking DBI backend and the future-returning DBIx::Loop backend both work).
- auth_guard for `under`: the bare is-anyone-signed-in form runs entirely in C. Denial negotiates - a browser is redirected to login_path with a relative-only ?to= return-to, an API client gets the house 401 - with on_denied '403', '404' or a coderef. The roles hook may return one role, a list or an arrayref; a required role on the rank ladder means "this or better", one outside it matches exactly (a staff role next to tenant roles). Guards record what they learned in $c->stash->{auth}.
- Bare `model;` registers everything under MyApp::Model::*
Modules
a MVC web framework
the per-application registry and boot compiler
the authentication battery
password hashing
cross-origin resource sharing
single-use CSRF tokens
the subcommands behind the punk tool
YAML configuration with secrets kept out of the file
the per-request object
base class for Punk controllers
the development error page
an async result that runs on the loop, or blocks
scaffold a new Punk application
security response headers
a level-based logger
the storage-agnostic model tier
the default DBI backend for Punk models
a non-blocking backend for Punk models
a directory of markdown as a documentation site
the api mount: spec-first operations
base class for Punk plugins
rate limiting and IP blocking over Hyperman's shared arena
a lazy wrapper over the PSGI environment
a response builder
the compiled-at-boot route tables (XS)
the handle an under returns
a Server-Sent Events stream
signed cookie sessions
serving files from a directory
an in-process test client for Punk applications
a pure-Perl RFC 6455 codec for testing WebSocket servers
the client side of one WebSocket connection
the outbound HTTP agent on the context
an uploaded file from a multipart form
collecting request validation
the Template::Stencil view engine
the pluggable view engine registry (XS)
a WebSocket connection
pub/sub groups of WebSocket connections
Provides
in bench/apps/cat-lib/BenchCat.pm
in bench/apps/cat-lib/BenchCat/Controller/Root.pm
in lib/Punk/Test.pm
Examples
- example/Chat/README.pod
- example/Chat/app.psgi
- example/Chat/bin/make-cert
- example/Chat/bin/punk-chat
- example/Chat/bin/tls-proxy
- example/Chat/docs/api.md
- example/Chat/docs/index.md
- example/Chat/docs/reference/config.md
- example/Chat/docs/running.md
- example/Chat/docs/websockets.md
- example/Chat/lib/Chat.pm
- example/Chat/lib/Chat/Auth.pm
- example/Chat/lib/Chat/Bus.pm
- example/Chat/lib/Chat/Controller/API/Message.pm
- example/Chat/lib/Chat/Controller/WS/Chat.pm
- example/Chat/lib/Chat/Controller/Web/Chat.pm
- example/Chat/lib/Chat/Model/Message.pm
- example/Chat/lib/Chat/Schema.pm
- example/Chat/openapi.json
- example/Chat/root/static/chat.css
- example/Chat/root/static/chat.js
- example/Chat/root/templates/index.tmpl
- example/Chat/root/templates/layout.tmpl
- example/Chat/root/templates/room.tmpl
- example/Chat/tls/server.crt
- example/Chat/tls/server.key