@cancia/astro 0.11.0 → 0.12.0

package/dist/chunk-4PYVIIOO.js

@@ -0,0 +1,25 @@
+import {
+  authorizeRequest
+} from "./chunk-6GUOGDWO.js";
+
+// src/auth/guard.ts
+var unauthorized = () => new Response(JSON.stringify({ error: "Unauthorized" }), {
+  status: 401,
+  headers: { "Content-Type": "application/json" }
+});
+async function guardRequest(request, cfg) {
+  if (!cfg.secret && !cfg.auth) {
+    return { deny: null, email: null };
+  }
+  const result = await authorizeRequest({
+    request,
+    secret: cfg.secret,
+    auth: cfg.auth
+  });
+  if (!result.ok) return { deny: unauthorized(), email: null };
+  return { deny: null, email: result.email };
+}
+
+export {
+  guardRequest
+};

package/dist/{chunk-GD37XVES.js → chunk-5R3I5RLT.js}

@@ -1,3 +1,6 @@
+import {
+  guardRequest
+} from "./chunk-4PYVIIOO.js";
 import {
   loadListSchema
 } from "./chunk-VL6FO446.js";
@@ -23,13 +26,8 @@ function getSite(request) {
 function getLocale(request) {
   return new URL(request.url).searchParams.get("locale");
 }
-function checkAuth(request, secret) {
-  if (!secret) return null;
-  const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-  if (token !== secret) {
-    return json({ error: "Unauthorized" }, 401);
-  }
-  return null;
+async function checkAuth(request, secret, auth) {
+  return (await guardRequest(request, { secret, auth })).deny;
 }
 function json(body, status = 200) {
   return new Response(JSON.stringify(body), {
@@ -45,7 +43,7 @@ function makeListsRoutes(ctx) {
     if (!ctx.storageV2) {
       return json({ error: "Storage v2 not configured", code: "NO_STORAGE_V2" }, 503);
     }
-    const deny = checkAuth(request, ctx.secret);
+    const deny = await checkAuth(request, ctx.secret, ctx.auth);
     if (deny) return deny;
     const parsed = parseListPath(request.url);
     if (!parsed) return json({ error: "Bad request" }, 400);

package/dist/chunk-6GUOGDWO.js

@@ -0,0 +1,172 @@
+// src/auth/cookie.ts
+var SESSION_COOKIE = "cancia_session";
+function serialiseSessionCookie(value, opts = {}) {
+  const parts = [
+    `${SESSION_COOKIE}=${value}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${opts.maxAgeSeconds ?? 60 * 60 * 24 * 30}`
+  ];
+  if (opts.secure !== false) parts.push("Secure");
+  return parts.join("; ");
+}
+function clearSessionCookie(opts = {}) {
+  const parts = [
+    `${SESSION_COOKIE}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    "Max-Age=0"
+  ];
+  if (opts.secure !== false) parts.push("Secure");
+  return parts.join("; ");
+}
+function readSessionCookie(request) {
+  const header = request.headers.get("cookie");
+  if (!header) return void 0;
+  const values = [];
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    if (pair.slice(0, eq).trim() !== SESSION_COOKIE) continue;
+    const value = pair.slice(eq + 1).trim();
+    if (value !== "") values.push(value);
+  }
+  return values.length > 0 ? values[values.length - 1] : void 0;
+}
+function isSecureRequest(request) {
+  const proto = request.headers.get("x-forwarded-proto");
+  if (proto) return proto.split(",")[0].trim() === "https";
+  try {
+    const url = new URL(request.url);
+    if (url.protocol === "https:") return true;
+    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") return false;
+  } catch {
+  }
+  return true;
+}
+
+// src/auth/tokens.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+var TOKEN_BYTES = 32;
+function mintToken() {
+  return randomBytes(TOKEN_BYTES).toString("base64url");
+}
+function hashToken(raw) {
+  return createHash("sha256").update(raw, "utf8").digest("hex");
+}
+function safeEqual(a, b) {
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  if (bufA.length !== bufB.length) {
+    timingSafeEqual(bufA, bufA);
+    return false;
+  }
+  return timingSafeEqual(bufA, bufB);
+}
+function normaliseEmail(email) {
+  return email.trim().toLowerCase();
+}
+
+// src/auth/magic-link.ts
+var LOGIN_TOKEN_TTL_MS = 15 * 60 * 1e3;
+var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var SESSION_TOUCH_AFTER_MS = 24 * 60 * 60 * 1e3;
+async function requestLoginLink(store, site, rawEmail, now = Date.now()) {
+  const email = normaliseEmail(rawEmail);
+  if (!await store.isEditor(site, email)) {
+    return { token: null, email };
+  }
+  const token = mintToken();
+  await store.createLoginToken(site, {
+    hash: hashToken(token),
+    email,
+    expiresAt: new Date(now + LOGIN_TOKEN_TTL_MS).toISOString()
+  });
+  return { token, email };
+}
+var FAILED = { sessionToken: null, email: null, expiresAt: null };
+async function redeemLoginToken(store, site, rawToken, now = Date.now()) {
+  if (!rawToken) return FAILED;
+  const record = await store.consumeLoginToken(site, hashToken(rawToken));
+  if (!record) return FAILED;
+  if (Date.parse(record.expiresAt) <= now) return FAILED;
+  if (!await store.isEditor(site, record.email)) return FAILED;
+  const sessionToken = mintToken();
+  const expiresAt = new Date(now + SESSION_TTL_MS).toISOString();
+  await store.createSession(site, {
+    id: hashToken(sessionToken),
+    email: record.email,
+    createdAt: new Date(now).toISOString(),
+    expiresAt
+  });
+  return { sessionToken, email: record.email, expiresAt };
+}
+var INVALID = { valid: false, email: null };
+async function verifySession(store, site, rawToken, now = Date.now()) {
+  if (!rawToken) return INVALID;
+  const id = hashToken(rawToken);
+  const session = await store.getSession(site, id);
+  if (!session) return INVALID;
+  if (Date.parse(session.expiresAt) <= now) {
+    await store.deleteSession(site, id);
+    return INVALID;
+  }
+  if (!await store.isEditor(site, session.email)) {
+    await store.deleteSession(site, id);
+    return INVALID;
+  }
+  const elapsed = now - Date.parse(session.createdAt);
+  const remaining = Date.parse(session.expiresAt) - now;
+  if (elapsed > 0 && remaining < SESSION_TTL_MS - SESSION_TOUCH_AFTER_MS) {
+    const renewedExpiresAt = new Date(now + SESSION_TTL_MS).toISOString();
+    await store.touchSession(site, id, renewedExpiresAt);
+    return { valid: true, email: session.email, renewedExpiresAt };
+  }
+  return { valid: true, email: session.email };
+}
+async function revokeSession(store, site, rawToken) {
+  if (!rawToken) return;
+  await store.deleteSession(site, hashToken(rawToken));
+}
+
+// src/auth/authorize.ts
+var DENY = { ok: false, email: null };
+async function authorizeRequest(cfg) {
+  const { request, secret, auth, editorsConfigured } = cfg;
+  if (auth) {
+    const raw = readSessionCookie(request);
+    if (raw) {
+      const verdict = await verifySession(auth.store, auth.site, raw, cfg.now);
+      if (verdict.valid) {
+        return {
+          ok: true,
+          email: verdict.email,
+          renewedExpiresAt: verdict.renewedExpiresAt
+        };
+      }
+    }
+  }
+  const header = request.headers.get("Authorization");
+  if (header && secret) {
+    const token = header.replace("Bearer ", "").trim();
+    if (safeEqual(token, secret)) {
+      return { ok: true, email: null };
+    }
+  }
+  return DENY;
+}
+
+export {
+  serialiseSessionCookie,
+  clearSessionCookie,
+  readSessionCookie,
+  isSecureRequest,
+  normaliseEmail,
+  SESSION_TTL_MS,
+  requestLoginLink,
+  redeemLoginToken,
+  revokeSession,
+  authorizeRequest
+};

package/dist/chunk-DEI3FBNY.js

@@ -0,0 +1,65 @@
+import {
+  handleLoginCallback,
+  handleLoginRequest,
+  handleLogout,
+  handleSessionCheck,
+  resolveLoginEmailSender
+} from "./chunk-XZCXWILA.js";
+import {
+  createRateLimiter
+} from "./chunk-ECPYHIAW.js";
+import {
+  authorizeRequest
+} from "./chunk-6GUOGDWO.js";
+
+// src/endpoints/auth-magic.ts
+import { getCanciaRuntime } from "virtual:cancia/runtime";
+var limiter = createRateLimiter();
+var notConfigured = () => new Response(JSON.stringify({ error: "Magic-link login is not configured for this site." }), {
+  status: 404,
+  headers: { "Content-Type": "application/json" }
+});
+function ctxFrom(rt) {
+  if (!rt.auth) return null;
+  return {
+    store: rt.auth.store,
+    site: rt.auth.site,
+    sendEmail: resolveLoginEmailSender(rt.sendLoginEmail),
+    limiter
+  };
+}
+async function requestLink({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleLoginRequest(request, ctx, new URL(request.url).origin);
+}
+async function callback({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleLoginCallback(request, ctx);
+}
+async function logout({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleLogout(request, ctx);
+}
+async function session({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleSessionCheck(
+    request,
+    ctx,
+    () => authorizeRequest({ request, secret: rt.secret, auth: rt.auth })
+  );
+}
+
+export {
+  requestLink,
+  callback,
+  logout,
+  session
+};

package/dist/{chunk-T2GDBQJ7.js → chunk-DOFLZ7KG.js}

@@ -1,3 +1,6 @@
+import {
+  guardRequest
+} from "./chunk-4PYVIIOO.js";
 import {
   loadSchemas
 } from "./chunk-VL6FO446.js";
@@ -14,12 +17,8 @@ function json(body, status = 200) {
 }
 function makeSchemasRoute(ctx) {
   return async function schemasRoute(request) {
-    if (ctx.secret) {
-      const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-      if (token !== ctx.secret) {
-        return json({ error: "Unauthorized" }, 401);
-      }
-    }
+    const deny = (await guardRequest(request, { secret: ctx.secret, auth: ctx.auth })).deny;
+    if (deny) return deny;
     const schemas = await loadSchemas(ctx.projectRoot, ctx.schemasPath);
     const descriptions = {};
     for (const [name, schema] of Object.entries(schemas)) {

package/dist/{chunk-GJIX7MWC.js → chunk-ECPYHIAW.js}

@@ -5,7 +5,12 @@ function createRateLimiter() {
   return /* @__PURE__ */ new Map();
 }
 function getIp(req) {
-  return req.headers.get("x-forwarded-for")?.split(",")[0].trim() ?? req.headers.get("x-real-ip") ?? "unknown";
+  const forwarded = req.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const hops = forwarded.split(",").map((h) => h.trim()).filter(Boolean);
+    if (hops.length > 0) return hops[hops.length - 1];
+  }
+  return req.headers.get("x-real-ip") ?? "unknown";
 }
 function isRateLimited(limiter, ip, now = Date.now()) {
   const bucket = limiter.get(ip);
@@ -51,5 +56,8 @@ async function runAuth(cfg) {
 
 export {
   createRateLimiter,
+  getIp,
+  isRateLimited,
+  recordFailure,
   runAuth
 };

package/dist/{chunk-TUZNTXZR.js → chunk-R7VA3Z5N.js}

@@ -67,12 +67,18 @@ function canciaLoader(opts) {
     async load(ctx) {
       latestCtx = ctx;
       const projectRoot = opts.projectRoot ?? process.cwd();
+      const detectedDb = !opts.storage && !opts.db && existsSync(join2(projectRoot, "cancia.db"));
       const storage = opts.storage ?? resolveReadStorage(
-        opts.db ? { kind: opts.db.kind === "sqlite" ? "sqlite-v2" : "json-file", dbPath: opts.db.path } : void 0,
+        opts.db ? { kind: opts.db.kind === "sqlite" ? "sqlite-v2" : "json-file", dbPath: opts.db.path } : detectedDb ? { kind: "sqlite-v2" } : void 0,
         projectRoot
       );
       const { lists } = storage;
-      const usingJsonFile = !opts.storage && opts.db?.kind !== "sqlite";
+      if (detectedDb) {
+        ctx.logger.info(
+          `cancia: reading list "${opts.list}" from cancia.db (detected). Pass db: { kind: "json-file" } if that is not what you want.`
+        );
+      }
+      const usingJsonFile = !opts.storage && opts.db?.kind !== "sqlite" && !detectedDb;
       await syncOnce(
         ctx,
         lists,

package/dist/{chunk-ZPXMPLQU.js → chunk-VF3EXXEM.js}

@@ -2,6 +2,9 @@ import {
   detectUploadType,
   isValidSite
 } from "./chunk-RHFTQW4W.js";
+import {
+  guardRequest
+} from "./chunk-4PYVIIOO.js";
 import {
   createGitBackedAdapter
 } from "./chunk-XINNLVZP.js";
@@ -11,6 +14,115 @@ import {
   createSqliteAdapterV2
 } from "./chunk-S5YLB6P3.js";
 
+// src/auth/sqlite-store.ts
+import { createRequire } from "module";
+import { mkdirSync } from "fs";
+import { dirname } from "path";
+var require2 = createRequire(import.meta.url);
+var connections = /* @__PURE__ */ new Map();
+function openAuthDB(dbPath) {
+  const cached = connections.get(dbPath);
+  if (cached) return cached;
+  const Database = require2("better-sqlite3");
+  if (dbPath !== ":memory:") mkdirSync(dirname(dbPath), { recursive: true });
+  const db = new Database(dbPath);
+  db.pragma("journal_mode = WAL");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS editors (
+      site TEXT NOT NULL, email TEXT NOT NULL, last_seen_at TEXT,
+      PRIMARY KEY (site, email)
+    );
+    CREATE TABLE IF NOT EXISTS sessions (
+      site TEXT NOT NULL, id TEXT NOT NULL, email TEXT NOT NULL,
+      created_at TEXT NOT NULL, expires_at TEXT NOT NULL,
+      PRIMARY KEY (site, id)
+    );
+    CREATE TABLE IF NOT EXISTS login_tokens (
+      site TEXT NOT NULL, hash TEXT NOT NULL, email TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      PRIMARY KEY (site, hash)
+    );
+  `);
+  connections.set(dbPath, db);
+  return db;
+}
+function createSqliteAuthStore(opts) {
+  const db = openAuthDB(opts.dbPath);
+  const insertEditor = db.prepare(
+    `INSERT INTO editors (site, email, last_seen_at) VALUES (?, ?, NULL)
+     ON CONFLICT(site, email) DO NOTHING`
+  );
+  const deleteOtherEditors = db.prepare("DELETE FROM editors WHERE site=?");
+  const selectEditor = db.prepare("SELECT email FROM editors WHERE site=? AND email=?");
+  const insertToken = db.prepare(
+    `INSERT INTO login_tokens (site, hash, email, expires_at) VALUES (?, ?, ?, ?)
+     ON CONFLICT(site, hash) DO NOTHING`
+  );
+  const selectToken = db.prepare(
+    "SELECT hash, email, expires_at FROM login_tokens WHERE site=? AND hash=?"
+  );
+  const deleteToken = db.prepare("DELETE FROM login_tokens WHERE site=? AND hash=?");
+  const insertSession = db.prepare(
+    "INSERT INTO sessions (site, id, email, created_at, expires_at) VALUES (?, ?, ?, ?, ?)"
+  );
+  const selectSession = db.prepare(
+    "SELECT id, email, created_at, expires_at FROM sessions WHERE site=? AND id=?"
+  );
+  const touchStmt = db.prepare("UPDATE sessions SET expires_at=? WHERE site=? AND id=?");
+  const deleteSessionStmt = db.prepare("DELETE FROM sessions WHERE site=? AND id=?");
+  const purgeTokens = db.prepare("DELETE FROM login_tokens WHERE site=? AND expires_at<=?");
+  const purgeSessions = db.prepare("DELETE FROM sessions WHERE site=? AND expires_at<=?");
+  const seedTx = db.transaction((site, emails) => {
+    deleteOtherEditors.run(site);
+    for (const email of emails) insertEditor.run(site, email);
+  });
+  const consumeTx = db.transaction((site, hash) => {
+    const row = selectToken.get(site, hash);
+    if (!row) return void 0;
+    deleteToken.run(site, hash);
+    return row;
+  });
+  return {
+    async seedEditors(site, emails) {
+      seedTx(site, emails);
+    },
+    async isEditor(site, email) {
+      return selectEditor.get(site, email) !== void 0;
+    },
+    async createLoginToken(site, rec) {
+      insertToken.run(site, rec.hash, rec.email, rec.expiresAt);
+    },
+    async consumeLoginToken(site, hash) {
+      const row = consumeTx(site, hash);
+      if (!row) return null;
+      return { hash: row.hash, email: row.email, expiresAt: row.expires_at };
+    },
+    async createSession(site, rec) {
+      insertSession.run(site, rec.id, rec.email, rec.createdAt, rec.expiresAt);
+    },
+    async getSession(site, id) {
+      const row = selectSession.get(site, id);
+      if (!row) return null;
+      return {
+        id: row.id,
+        email: row.email,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at
+      };
+    },
+    async touchSession(site, id, expiresAt) {
+      touchStmt.run(expiresAt, site, id);
+    },
+    async deleteSession(site, id) {
+      deleteSessionStmt.run(site, id);
+    },
+    async purgeExpired(site, now) {
+      purgeTokens.run(site, now);
+      purgeSessions.run(site, now);
+    }
+  };
+}
+
 // src/routes/upload.ts
 import { writeFile, mkdir } from "fs/promises";
 import { join } from "path";
@@ -27,14 +139,10 @@ function makeLocalUploadHandler(opts) {
     return `${publicUrlBase}/${site}/${name}`;
   };
 }
-function makeUploadRoute(uploadHandler, secret, maxMB = 10) {
+function makeUploadRoute(uploadHandler, secret, maxMB = 10, auth) {
   return async ({ request }) => {
-    if (secret) {
-      const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-      if (token !== secret) {
-        return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-      }
-    }
+    const deny = (await guardRequest(request, { secret, auth })).deny;
+    if (deny) return deny;
     const form = await request.formData().catch(() => null);
     const file = form?.get("file");
     const site = form?.get("site");
@@ -188,6 +296,18 @@ function buildRuntimeFromBaked(baked) {
   const storageV2 = buildStorageV2(baked, projectRoot);
   const storage = storageV2 ? storageV2.kv : lazyJsonFileAdapter(projectRoot);
   const uploadHandler = buildUploadHandler(baked, projectRoot);
+  const site = baked.site ?? "default";
+  const auth = baked.editors?.length ? {
+    store: createSqliteAuthStore({
+      dbPath: baked.authDbPath ? resolveDbPath(baked.authDbPath, projectRoot) : `${projectRoot}/cancia.db`
+    }),
+    site
+  } : void 0;
+  if (auth) {
+    auth.store.seedEditors(site, baked.editors.map((e) => e.trim().toLowerCase())).catch((err) => {
+      console.error(`[cancia] could not seed editors: ${err?.message ?? err}`);
+    });
+  }
   return {
     storage,
     storageV2,
@@ -196,6 +316,8 @@ function buildRuntimeFromBaked(baked) {
     defaultLocale: baked.defaultLocale,
     locales: baked.locales,
     secret,
+    site,
+    auth,
     uploadHandler,
     deployHook,
     deployHookToken,
@@ -269,6 +391,7 @@ export {
   makeLocalUploadHandler,
   makeUploadRoute,
   makeR2UploadHandler,
+  createSqliteAuthStore,
   setBakedConfig,
   setCanciaRuntime,
   __resetRuntimeForTests,

package/dist/chunk-XZCXWILA.js

@@ -0,0 +1,145 @@
+import {
+  createRateLimiter,
+  getIp,
+  isRateLimited,
+  recordFailure
+} from "./chunk-ECPYHIAW.js";
+import {
+  SESSION_TTL_MS,
+  clearSessionCookie,
+  isSecureRequest,
+  normaliseEmail,
+  readSessionCookie,
+  redeemLoginToken,
+  requestLoginLink,
+  revokeSession,
+  serialiseSessionCookie
+} from "./chunk-6GUOGDWO.js";
+
+// src/auth/email.ts
+var LOOPS_API_URL = "https://app.loops.so/api/v1/transactional";
+var consoleLoginEmail = async ({ to, url }) => {
+  console.log(
+    `
+  \x1B[36m[cancia]\x1B[0m login link for \x1B[1m${to}\x1B[0m:
+  ${url}
+`
+  );
+};
+var loopsLoginEmail = async ({ to, url }) => {
+  const apiKey = process.env.LOOPS_API_KEY;
+  const transactionalId = process.env.CANCIA_LOGIN_TID;
+  if (!apiKey || !transactionalId) {
+    throw new Error(
+      "Loops login email needs LOOPS_API_KEY and CANCIA_LOGIN_TID in the server environment."
+    );
+  }
+  const res = await fetch(LOOPS_API_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`
+    },
+    body: JSON.stringify({
+      email: to,
+      transactionalId,
+      dataVariables: { loginUrl: url }
+    })
+  });
+  if (!res.ok) {
+    throw new Error(`Loops login email failed (${res.status})`);
+  }
+};
+function resolveLoginEmailSender(explicit) {
+  if (explicit) return explicit;
+  if (process.env.LOOPS_API_KEY && process.env.CANCIA_LOGIN_TID) return loopsLoginEmail;
+  return consoleLoginEmail;
+}
+
+// src/auth/handlers.ts
+var json = (body, status, headers = {}) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "Content-Type": "application/json", ...headers }
+});
+var NEUTRAL_ACK = { ok: true, message: "If that address can edit this site, a link is on its way." };
+function looksLikeEmail(value) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) && value.length <= 254;
+}
+async function handleLoginRequest(request, ctx, origin) {
+  const limiter = ctx.limiter ?? createRateLimiter();
+  const now = ctx.now ?? Date.now();
+  const ip = getIp(request);
+  if (isRateLimited(limiter, ip, now)) {
+    return json({ error: "Too many attempts. Try again in a minute." }, 429);
+  }
+  let email;
+  try {
+    const body = await request.json();
+    email = body?.email;
+  } catch {
+    return json({ error: "Invalid request body" }, 400);
+  }
+  if (!email || !looksLikeEmail(email.trim())) {
+    return json({ error: "Enter a valid email address." }, 400);
+  }
+  const normalised = normaliseEmail(email);
+  if (isRateLimited(limiter, `email:${normalised}`, now)) {
+    return json(NEUTRAL_ACK, 200);
+  }
+  recordFailure(limiter, ip, now);
+  recordFailure(limiter, `email:${normalised}`, now);
+  const { token } = await requestLoginLink(ctx.store, ctx.site, normalised, now);
+  if (token) {
+    const url = `${origin}/?cancia_login=${encodeURIComponent(token)}`;
+    void ctx.sendEmail({ to: normalised, url, site: ctx.site }).catch((err) => {
+      console.error(
+        `[cancia] failed to send login email: ${err instanceof Error ? err.message : String(err)}`
+      );
+    });
+  }
+  void ctx.store.purgeExpired(ctx.site, new Date(now).toISOString()).catch(() => {
+  });
+  return json(NEUTRAL_ACK, 200);
+}
+async function handleLoginCallback(request, ctx) {
+  const now = ctx.now ?? Date.now();
+  let token;
+  try {
+    const body = await request.json();
+    token = body?.token;
+  } catch {
+    return json({ error: "Invalid request body" }, 400);
+  }
+  const result = await redeemLoginToken(ctx.store, ctx.site, token ?? "", now);
+  if (!result.sessionToken) {
+    return json({ error: "That link is invalid or has expired. Request a new one." }, 401);
+  }
+  return json(
+    { ok: true, email: result.email },
+    200,
+    {
+      "Set-Cookie": serialiseSessionCookie(result.sessionToken, {
+        secure: isSecureRequest(request),
+        maxAgeSeconds: Math.floor(SESSION_TTL_MS / 1e3)
+      })
+    }
+  );
+}
+async function handleLogout(request, ctx) {
+  await revokeSession(ctx.store, ctx.site, readSessionCookie(request));
+  return json({ ok: true }, 200, {
+    "Set-Cookie": clearSessionCookie({ secure: isSecureRequest(request) })
+  });
+}
+async function handleSessionCheck(request, ctx, authorize) {
+  const verdict = await authorize();
+  return json({ authenticated: verdict.ok, email: verdict.email }, 200);
+}
+
+export {
+  resolveLoginEmailSender,
+  handleLoginRequest,
+  handleLoginCallback,
+  handleLogout,
+  handleSessionCheck
+};