@cancia/astro 0.10.0 → 0.12.0

package/dist/chunk-XZCXWILA.js

@@ -0,0 +1,145 @@
+import {
+  createRateLimiter,
+  getIp,
+  isRateLimited,
+  recordFailure
+} from "./chunk-ECPYHIAW.js";
+import {
+  SESSION_TTL_MS,
+  clearSessionCookie,
+  isSecureRequest,
+  normaliseEmail,
+  readSessionCookie,
+  redeemLoginToken,
+  requestLoginLink,
+  revokeSession,
+  serialiseSessionCookie
+} from "./chunk-6GUOGDWO.js";
+
+// src/auth/email.ts
+var LOOPS_API_URL = "https://app.loops.so/api/v1/transactional";
+var consoleLoginEmail = async ({ to, url }) => {
+  console.log(
+    `
+  \x1B[36m[cancia]\x1B[0m login link for \x1B[1m${to}\x1B[0m:
+  ${url}
+`
+  );
+};
+var loopsLoginEmail = async ({ to, url }) => {
+  const apiKey = process.env.LOOPS_API_KEY;
+  const transactionalId = process.env.CANCIA_LOGIN_TID;
+  if (!apiKey || !transactionalId) {
+    throw new Error(
+      "Loops login email needs LOOPS_API_KEY and CANCIA_LOGIN_TID in the server environment."
+    );
+  }
+  const res = await fetch(LOOPS_API_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`
+    },
+    body: JSON.stringify({
+      email: to,
+      transactionalId,
+      dataVariables: { loginUrl: url }
+    })
+  });
+  if (!res.ok) {
+    throw new Error(`Loops login email failed (${res.status})`);
+  }
+};
+function resolveLoginEmailSender(explicit) {
+  if (explicit) return explicit;
+  if (process.env.LOOPS_API_KEY && process.env.CANCIA_LOGIN_TID) return loopsLoginEmail;
+  return consoleLoginEmail;
+}
+
+// src/auth/handlers.ts
+var json = (body, status, headers = {}) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "Content-Type": "application/json", ...headers }
+});
+var NEUTRAL_ACK = { ok: true, message: "If that address can edit this site, a link is on its way." };
+function looksLikeEmail(value) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) && value.length <= 254;
+}
+async function handleLoginRequest(request, ctx, origin) {
+  const limiter = ctx.limiter ?? createRateLimiter();
+  const now = ctx.now ?? Date.now();
+  const ip = getIp(request);
+  if (isRateLimited(limiter, ip, now)) {
+    return json({ error: "Too many attempts. Try again in a minute." }, 429);
+  }
+  let email;
+  try {
+    const body = await request.json();
+    email = body?.email;
+  } catch {
+    return json({ error: "Invalid request body" }, 400);
+  }
+  if (!email || !looksLikeEmail(email.trim())) {
+    return json({ error: "Enter a valid email address." }, 400);
+  }
+  const normalised = normaliseEmail(email);
+  if (isRateLimited(limiter, `email:${normalised}`, now)) {
+    return json(NEUTRAL_ACK, 200);
+  }
+  recordFailure(limiter, ip, now);
+  recordFailure(limiter, `email:${normalised}`, now);
+  const { token } = await requestLoginLink(ctx.store, ctx.site, normalised, now);
+  if (token) {
+    const url = `${origin}/?cancia_login=${encodeURIComponent(token)}`;
+    void ctx.sendEmail({ to: normalised, url, site: ctx.site }).catch((err) => {
+      console.error(
+        `[cancia] failed to send login email: ${err instanceof Error ? err.message : String(err)}`
+      );
+    });
+  }
+  void ctx.store.purgeExpired(ctx.site, new Date(now).toISOString()).catch(() => {
+  });
+  return json(NEUTRAL_ACK, 200);
+}
+async function handleLoginCallback(request, ctx) {
+  const now = ctx.now ?? Date.now();
+  let token;
+  try {
+    const body = await request.json();
+    token = body?.token;
+  } catch {
+    return json({ error: "Invalid request body" }, 400);
+  }
+  const result = await redeemLoginToken(ctx.store, ctx.site, token ?? "", now);
+  if (!result.sessionToken) {
+    return json({ error: "That link is invalid or has expired. Request a new one." }, 401);
+  }
+  return json(
+    { ok: true, email: result.email },
+    200,
+    {
+      "Set-Cookie": serialiseSessionCookie(result.sessionToken, {
+        secure: isSecureRequest(request),
+        maxAgeSeconds: Math.floor(SESSION_TTL_MS / 1e3)
+      })
+    }
+  );
+}
+async function handleLogout(request, ctx) {
+  await revokeSession(ctx.store, ctx.site, readSessionCookie(request));
+  return json({ ok: true }, 200, {
+    "Set-Cookie": clearSessionCookie({ secure: isSecureRequest(request) })
+  });
+}
+async function handleSessionCheck(request, ctx, authorize) {
+  const verdict = await authorize();
+  return json({ authenticated: verdict.ok, email: verdict.email }, 200);
+}
+
+export {
+  resolveLoginEmailSender,
+  handleLoginRequest,
+  handleLoginCallback,
+  handleLogout,
+  handleSessionCheck
+};

package/dist/content.js

@@ -1,10 +1,10 @@
 import "./chunk-FOSOWSXV.js";
 import "./chunk-CJDIVWO3.js";
+import "./chunk-XINNLVZP.js";
+import "./chunk-U7V53JX7.js";
 import {
   createSqliteAdapterV2
-} from "./chunk-MXVOJRAM.js";
-import "./chunk-U7V53JX7.js";
-import "./chunk-2NVZWZPE.js";
+} from "./chunk-S5YLB6P3.js";
 import "./chunk-7IA5B5CF.js";
 
 // src/content.ts

package/dist/{upload-DwCGjXbz.d.ts → email-BRK4WAO2.d.ts}

@@ -10,4 +10,12 @@ declare function makeLocalUploadHandler(opts: {
     maxMB?: number;
 }): UploadHandler;
 
-export { type UploadHandler as U, makeLocalUploadHandler as m };
+interface LoginEmailPayload {
+    to: string;
+    /** The full, ready-to-click URL. */
+    url: string;
+    site: string;
+}
+type SendLoginEmail = (payload: LoginEmailPayload) => Promise<void>;
+
+export { type SendLoginEmail as S, type UploadHandler as U, makeLocalUploadHandler as m };

package/dist/endpoints/auth-callback.d.ts

@@ -0,0 +1 @@
+export { c as POST } from './auth-request.js';

package/dist/endpoints/auth-callback.js

@@ -0,0 +1,9 @@
+import {
+  callback
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  callback as POST
+};

package/dist/endpoints/auth-logout.d.ts

@@ -0,0 +1 @@
+export { l as POST } from './auth-request.js';

package/dist/endpoints/auth-logout.js

@@ -0,0 +1,9 @@
+import {
+  logout
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  logout as POST
+};

package/dist/endpoints/auth-request.d.ts

@@ -0,0 +1,18 @@
+/** POST /api/cancia/auth/request — { email } */
+declare function requestLink({ request }: {
+    request: Request;
+}): Promise<Response>;
+/** POST /api/cancia/auth/callback — { token } */
+declare function callback({ request }: {
+    request: Request;
+}): Promise<Response>;
+/** POST /api/cancia/auth/logout */
+declare function logout({ request }: {
+    request: Request;
+}): Promise<Response>;
+/** GET /api/cancia/auth/session — "am I signed in?" */
+declare function session({ request }: {
+    request: Request;
+}): Promise<Response>;
+
+export { requestLink as POST, callback as c, logout as l, session as s };

package/dist/endpoints/auth-request.js

@@ -0,0 +1,9 @@
+import {
+  requestLink
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  requestLink as POST
+};

package/dist/endpoints/auth-session.d.ts

@@ -0,0 +1 @@
+export { s as GET } from './auth-request.js';

package/dist/endpoints/auth-session.js

@@ -0,0 +1,9 @@
+import {
+  session
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  session as GET
+};

package/dist/endpoints/auth.js

@@ -1,13 +1,21 @@
 import {
   createRateLimiter,
   runAuth
-} from "../chunk-GJIX7MWC.js";
+} from "../chunk-ECPYHIAW.js";
 
 // src/endpoints/auth.ts
 import { getCanciaRuntime } from "virtual:cancia/runtime";
 var limiter = createRateLimiter();
 async function POST({ request }) {
-  const { secret } = getCanciaRuntime();
+  const { secret, auth } = getCanciaRuntime();
+  if (auth) {
+    return new Response(
+      JSON.stringify({
+        error: "This site uses email login. Open the site and request a link instead."
+      }),
+      { status: 403, headers: { "Content-Type": "application/json" } }
+    );
+  }
   return runAuth({ request, secret, limiter });
 }
 export {

package/dist/endpoints/content.js

@@ -2,20 +2,20 @@ import {
   extractRoute,
   invalidateOnSave
 } from "../chunk-VGRG5DN7.js";
+import {
+  guardRequest
+} from "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-X6ZFFGIA.js";
 
 // src/endpoints/content.ts
 import { getCanciaRuntime } from "virtual:cancia/runtime";
-function checkAuth(req, secret) {
-  if (!secret) return null;
-  const token = req.headers.get("Authorization")?.replace("Bearer ", "").trim();
-  if (token !== secret)
-    return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-  return null;
+async function checkAuth(req, secret, auth) {
+  return (await guardRequest(req, { secret, auth })).deny;
 }
 async function GET({ request }) {
-  const { storage, secret } = getCanciaRuntime();
-  const deny = checkAuth(request, secret);
+  const { storage, secret, auth } = getCanciaRuntime();
+  const deny = await checkAuth(request, secret, auth);
   if (deny) return deny;
   const site = new URL(request.url).searchParams.get("site");
   if (!site)
@@ -27,8 +27,8 @@ async function GET({ request }) {
 }
 async function POST(context) {
   const { request } = context;
-  const { storage, secret, publishMode } = getCanciaRuntime();
-  const deny = checkAuth(request, secret);
+  const { storage, secret, publishMode, auth } = getCanciaRuntime();
+  const deny = await checkAuth(request, secret, auth);
   if (deny) return deny;
   const body = await request.json().catch(() => null);
   if (!body?.site || !body?.key || !body?.lang || body?.value === void 0)
@@ -43,8 +43,8 @@ async function POST(context) {
   });
 }
 async function DELETE({ request }) {
-  const { storage, secret } = getCanciaRuntime();
-  const deny = checkAuth(request, secret);
+  const { storage, secret, auth } = getCanciaRuntime();
+  const deny = await checkAuth(request, secret, auth);
   if (deny) return deny;
   const body = await request.json().catch(() => null);
   if (!body?.site || !body?.key || !body?.lang)

package/dist/endpoints/lists.js

@@ -4,7 +4,9 @@ import {
 } from "../chunk-VGRG5DN7.js";
 import {
   makeListsRoutes
-} from "../chunk-DIV2FFYX.js";
+} from "../chunk-5R3I5RLT.js";
+import "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-X6ZFFGIA.js";
 import "../chunk-VL6FO446.js";
 import "../chunk-7IA5B5CF.js";
@@ -18,6 +20,7 @@ function getRoutes() {
     projectRoot: rt.projectRoot,
     schemasPath: rt.schemasPath,
     secret: rt.secret,
+    auth: rt.auth,
     defaultLocale: rt.defaultLocale
   });
 }

package/dist/endpoints/publish.js

@@ -1,6 +1,10 @@
 import {
   runPublish
 } from "../chunk-5RCLBWRH.js";
+import {
+  guardRequest
+} from "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-U7V53JX7.js";
 
 // src/endpoints/publish.ts
@@ -14,13 +18,11 @@ async function POST({ request }) {
     publishRepo,
     publishGithubToken,
     publishMode,
-    secret
+    secret,
+    auth
   } = getCanciaRuntime();
-  if (secret) {
-    const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-    if (token !== secret)
-      return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-  }
+  const deny = (await guardRequest(request, { secret, auth })).deny;
+  if (deny) return deny;
   const hook = deployHook ?? process.env.CANCIA_DEPLOY_HOOK;
   const ghToken = publishGithubToken ?? process.env.CANCIA_GITHUB_TOKEN?.trim();
   return runPublish({

package/dist/endpoints/schemas.js

@@ -1,8 +1,10 @@
 import {
   makeSchemasRoute
-} from "../chunk-ONKCUTPU.js";
+} from "../chunk-DOFLZ7KG.js";
+import "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-VL6FO446.js";
-import "../chunk-YGJ3JHXF.js";
+import "../chunk-QQEUCOXQ.js";
 import "../chunk-KHCFVVYV.js";
 
 // src/endpoints/schemas.ts
@@ -12,7 +14,8 @@ async function GET({ request }) {
   const route = makeSchemasRoute({
     projectRoot: rt.projectRoot,
     schemasPath: rt.schemasPath,
-    secret: rt.secret
+    secret: rt.secret,
+    auth: rt.auth
   });
   return route(request);
 }

package/dist/endpoints/upload.js

@@ -1,17 +1,18 @@
 import {
-  detectImageType,
+  detectUploadType,
   isValidSite
-} from "../chunk-5IPHDIC6.js";
+} from "../chunk-RHFTQW4W.js";
+import {
+  guardRequest
+} from "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 
 // src/endpoints/upload.ts
 import { getCanciaRuntime } from "virtual:cancia/runtime";
 async function POST({ request }) {
-  const { uploadHandler, secret, maxUploadMB } = getCanciaRuntime();
-  if (secret) {
-    const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-    if (token !== secret)
-      return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-  }
+  const { uploadHandler, secret, maxUploadMB, auth } = getCanciaRuntime();
+  const deny = (await guardRequest(request, { secret, auth })).deny;
+  if (deny) return deny;
   const form = await request.formData().catch(() => null);
   const file = form?.get("file");
   const site = form?.get("site");
@@ -28,9 +29,9 @@ async function POST({ request }) {
       { status: 413 }
     );
   const buf = new Uint8Array(await file.arrayBuffer());
-  const detected = detectImageType(buf);
+  const detected = detectUploadType(buf);
   if (!detected)
-    return new Response(JSON.stringify({ error: "File type not allowed" }), { status: 415 });
+    return new Response(JSON.stringify({ error: "That file type is not supported. Use a JPEG, PNG, GIF, WebP, AVIF or PDF." }), { status: 415 });
   const url = await uploadHandler(file, site, detected);
   return new Response(JSON.stringify({ url }), {
     headers: { "Content-Type": "application/json" }

package/dist/{git-backed-DtiH52EI.d.ts → git-backed-CwTFfUS4.d.ts}

@@ -1,5 +1,5 @@
-import { C as CanciaStorage, a as CanciaStorageV2 } from './types-BMlLS-OS.js';
-import { G as GitHubCommitter, a as GitHubClient, F as FetchLike } from './github-client-Db0pIrqE.js';
+import { d as CanciaStorage, C as CanciaStorageV2 } from './types-CKzfz5iu.js';
+import { b as GitHubCommitter, G as GitHubClient, F as FetchLike } from './github-client-Db5EPcSL.js';
 
 declare function createJsonFileAdapter(filePath?: string): CanciaStorage;
 

package/dist/{github-client-Db0pIrqE.d.ts → github-client-Db5EPcSL.d.ts}

@@ -54,4 +54,4 @@ interface GitHubClient {
 }
 declare function createGitHubClient(opts: GitHubClientOptions): GitHubClient;
 
-export { type CommitFile as C, type FetchLike as F, type GitHubCommitter as G, type GitHubClient as a, type GitHubClientOptions as b, createGitHubClient as c };
+export { type CommitFile as C, type FetchLike as F, type GitHubClient as G, type GitHubClientOptions as a, type GitHubCommitter as b, createGitHubClient as c };

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 import { AstroIntegration } from 'astro';
-import { C as CanciaStorage, a as CanciaStorageV2 } from './types-BMlLS-OS.js';
-export { b as CanciaKVStore, c as CanciaListStore, d as CanciaPageStore, L as ListEntry, P as PageMeta, e as PageRecord, f as PageSEO, R as Rev, g as RevConflictError } from './types-BMlLS-OS.js';
-import { U as UploadHandler } from './upload-DwCGjXbz.js';
-export { m as makeLocalUploadHandler } from './upload-DwCGjXbz.js';
-import { G as GitHubCommitter } from './github-client-Db0pIrqE.js';
+import { d as CanciaStorage, C as CanciaStorageV2 } from './types-CKzfz5iu.js';
+export { a as CanciaKVStore, b as CanciaListStore, c as CanciaPageStore, L as ListEntry, P as PageMeta, e as PageRecord, f as PageSEO, R as Rev, g as RevConflictError } from './types-CKzfz5iu.js';
+import { U as UploadHandler, S as SendLoginEmail } from './email-BRK4WAO2.js';
+export { m as makeLocalUploadHandler } from './email-BRK4WAO2.js';
+import { b as GitHubCommitter } from './github-client-Db5EPcSL.js';
 export { CanciaLoaderOptions, canciaLoader } from './loader/index.js';
 export { FieldDescription, FieldMeta, FieldMetaBase, FieldWidget, ListDescription, ListSchema, SchemasModule, defineField, defineList, describeList } from './schema/index.js';
-export { G as GitBackedContentPaths, a as GitBackedControls, b as GitBackedOptions, c as GitBackedStorage, S as SqliteV2Options, d as closeSqliteAdapterV2, e as createGitBackedAdapter, f as createJsonFileAdapter, g as createJsonFileAdapterV2, h as createSQLiteAdapter, i as createSqliteAdapterV2 } from './git-backed-DtiH52EI.js';
+export { G as GitBackedContentPaths, a as GitBackedControls, b as GitBackedOptions, c as GitBackedStorage, S as SqliteV2Options, d as closeSqliteAdapterV2, e as createGitBackedAdapter, f as createJsonFileAdapter, g as createJsonFileAdapterV2, h as createSQLiteAdapter, i as createSqliteAdapterV2 } from './git-backed-CwTFfUS4.js';
 export { z } from 'zod';
 import 'astro/loaders';
 import './portable-text-D74aIuHn.js';
@@ -139,6 +139,32 @@ interface CanciaIntegrationOptions {
      * Use for public demos only — anyone can edit if this is enabled.
      */
     public?: boolean;
+    /**
+     * Email addresses allowed to sign in (042).
+     *
+     * Setting this switches the site to magic-link login: the client asks for a
+     * link, proves they own the address, and gets a session cookie. It also
+     * TURNS OFF the legacy `?cancia=<token>` URL login for humans — that token
+     * is a permanent password in a URL, and once a real login exists there is no
+     * reason to keep accepting it from a person. `CANCIA_TOKEN` stays valid as a
+     * machine credential for the build-time content fetch.
+     *
+     * Leaving it unset preserves the pre-042 behaviour exactly, so upgrading the
+     * package never changes how an existing deployment authenticates.
+     *
+     *     cancia({ editors: ["client@theirsite.com"] })
+     *
+     * Adding someone is a config change plus a redeploy — the right friction for
+     * granting write access to a live site.
+     */
+    editors?: string[];
+    /**
+     * Send the login email. Defaults to Loops when LOOPS_API_KEY and
+     * CANCIA_LOGIN_TID are set, and otherwise logs the link to the server
+     * console (which is also the dev behaviour — no email vendor is needed to
+     * work on the CMS locally).
+     */
+    sendLoginEmail?: SendLoginEmail;
     /**
      * v2 storage adapter (KV + pages + lists). When omitted, Cancia builds a
      * JSON-file v2 adapter automatically at <projectRoot>/.cancia/. List/page