@krantho/api 0.0.0-stage → 1.0.0

package/dist/document-seo.js

@@ -0,0 +1,41 @@
+import { canGetContent } from '@krantho/persistence';
+import { documentSeoConfig } from '@krantho/seo-shared';
+import { changedByFromAuth } from './permissions.js';
+import { saveDocument } from './save-document.js';
+export function documentOfSeoId(id) {
+    if (!id.startsWith('doc:'))
+        return null;
+    const slash = id.indexOf('/', 4);
+    return slash > 4 && slash < id.length - 1
+        ? { collection: id.slice(4, slash), slug: id.slice(slash + 1) }
+        : null;
+}
+export async function documentSeo(ctx, id, locale) {
+    const target = documentOfSeoId(id);
+    if (!target || !canGetContent(ctx.adapter))
+        return null;
+    const document = await ctx.adapter.getContent(target.collection, target.slug, locale);
+    return document && document.meta.locale === (locale ?? ctx.config.site.defaultLocale)
+        ? { document, config: documentSeoConfig(document.metadata) }
+        : null;
+}
+/** Authored SEO is a draft document edit, with its lock, validation and version check. */
+export async function saveDocumentSeo(ctx, document, config, expectedVersion, changedBy = changedByFromAuth(ctx.auth)) {
+    const metadata = { ...document.metadata };
+    if (config)
+        metadata['seo'] = config;
+    else
+        delete metadata['seo'];
+    return saveDocument(ctx, {
+        collection: document.meta.collection,
+        slug: document.meta.slug,
+        locale: document.meta.locale,
+        fields: document.fields,
+        body: document.body,
+        metadata,
+        isNew: false,
+        expectedVersion,
+        changedBy,
+    });
+}
+//# sourceMappingURL=document-seo.js.map

package/dist/document-seo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-seo.js","sourceRoot":"","sources":["../src/document-seo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAA2B,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAG1E,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAChC,OAAO,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC;QACvC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE;QAC/D,CAAC,CAAC,IAAI,CAAA;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,EAAU,EACV,MAA2B;IAK3B,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACrF,OAAO,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;QACnF,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAC5D,CAAC,CAAC,IAAI,CAAA;AACV,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,QAAyB,EACzB,MAA4B,EAC5B,eAAuB,EACvB,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;IAEvC,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;IACzC,IAAI,MAAM;QAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,MAA4C,CAAA;;QACrE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3B,OAAO,YAAY,CAAC,GAAG,EAAE;QACvB,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;QACpC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;QACxB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;QAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ;QACR,KAAK,EAAE,KAAK;QACZ,eAAe;QACf,SAAS;KACV,CAAC,CAAA;AACJ,CAAC"}

package/dist/group-by-collection.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Items grouped by the collection they belong to, in the order of `names`: every name has a
+ * group, empty when no item belongs to it. Items keep the order they came in.
+ */
+export declare function groupByCollection<T>(items: readonly T[], names: readonly string[], collectionOf: (item: T) => string): Map<string, T[]>;
+//# sourceMappingURL=group-by-collection.d.ts.map

package/dist/group-by-collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-by-collection.d.ts","sourceRoot":"","sources":["../src/group-by-collection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAChC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAIlB"}

package/dist/group-by-collection.js

@@ -0,0 +1,11 @@
+/**
+ * Items grouped by the collection they belong to, in the order of `names`: every name has a
+ * group, empty when no item belongs to it. Items keep the order they came in.
+ */
+export function groupByCollection(items, names, collectionOf) {
+    const groups = new Map(names.map((name) => [name, []]));
+    for (const item of items)
+        groups.get(collectionOf(item))?.push(item);
+    return groups;
+}
+//# sourceMappingURL=group-by-collection.js.map

package/dist/group-by-collection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-by-collection.js","sourceRoot":"","sources":["../src/group-by-collection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAmB,EACnB,KAAwB,EACxB,YAAiC;IAEjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAc,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACpE,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACpE,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/handlers/apply-metadata-defaults.d.ts

@@ -0,0 +1,4 @@
+import type { ApiHandler } from '../types.js';
+/** Preview first; committing materializes values and pins provenance in a draft revision. */
+export declare const applyDocumentDefaults: ApiHandler;
+//# sourceMappingURL=apply-metadata-defaults.d.ts.map

package/dist/handlers/apply-metadata-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-metadata-defaults.d.ts","sourceRoot":"","sources":["../../src/handlers/apply-metadata-defaults.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAc,UAAU,EAA2B,MAAM,aAAa,CAAA;AAgGlF,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,EAAE,UAmCnC,CAAA"}

package/dist/handlers/apply-metadata-defaults.js

@@ -0,0 +1,108 @@
+import { canGetContent } from '@krantho/persistence';
+import { applyMetadataDefaults, validateDocument } from '@krantho/schema';
+import { getActiveContract } from '../merged-schema.js';
+import { changedByFromAuth, requireRole } from '../permissions.js';
+import { saveDocument } from '../save-document.js';
+import { formatZodErrors, validateCollectionParam, validateRequestBody } from '../validators.js';
+const reply = (status, body) => ({ status, body });
+/** Read and check the request: role, collections, both documents in one locale */
+async function defaultsTarget(req, ctx) {
+    const denied = requireRole(ctx.auth, 'editor');
+    if (denied)
+        return denied;
+    const checked = validateCollectionParam(req.params['collection'], ctx);
+    if (!checked.isValid)
+        return checked.response;
+    const body = validateRequestBody(req.body);
+    if (!body.isValid)
+        return body.response;
+    if (!canGetContent(ctx.adapter))
+        return reply(501, { error: 'Adapter cannot read documents' });
+    const input = body.body;
+    const locale = typeof input['locale'] === 'string' ? input['locale'] : ctx.config.site.defaultLocale;
+    const sourceCollection = typeof input['sourceCollection'] === 'string' ? input['sourceCollection'] : '';
+    const sourceSlug = typeof input['sourceSlug'] === 'string' ? input['sourceSlug'] : '';
+    if (!ctx.contentConfig.collections.has(sourceCollection))
+        return reply(404, { error: 'Default collection not found' });
+    const source = await ctx.adapter.getContent(sourceCollection, sourceSlug, locale);
+    const current = await ctx.adapter.getContent(checked.collection, req.params['slug'] ?? '', locale);
+    if (!source || !current || source.meta.locale !== locale || current.meta.locale !== locale)
+        return reply(404, { error: 'Document not found' });
+    const contract = await getActiveContract(checked.collectionDef, ctx.adapter);
+    return { collection: checked.collection, current, source, contract, input };
+}
+/** The declared groups to fill: the ones asked for that the source shares by definition */
+function slotsToApply(target) {
+    const { contract, source, input } = target;
+    const asked = input['slots'];
+    if (asked !== undefined &&
+        (!Array.isArray(asked) ||
+            asked.some((slot) => typeof slot !== 'string' || !Object.hasOwn(contract.metadata, slot))))
+        return reply(400, { error: 'Choose declared metadata groups' });
+    return Object.keys(contract.metadata).filter((slot) => (asked === undefined || asked.includes(slot)) &&
+        source.contract?.metadata[slot]?.id === contract.metadata[slot]?.id);
+}
+/** Commit the previewed defaults as a draft, pinning the source version they came from */
+async function commitDefaults(ctx, target, applied) {
+    const { current, source, input } = target;
+    if (input['sourceVersion'] !== source.meta.version)
+        return reply(409, {
+            error: 'Shared defaults changed since the preview. Review them again.',
+            sourceVersion: source.meta.version,
+        });
+    if (typeof input['_version'] !== 'number')
+        return reply(400, { error: 'A document version is required to apply defaults' });
+    const provenance = {
+        collection: source.meta.collection,
+        slug: source.meta.slug,
+        locale: source.meta.locale,
+        version: source.meta.version,
+        paths: applied.paths,
+        values: applied.values,
+    };
+    const saved = await saveDocument(ctx, {
+        collection: target.collection,
+        slug: current.meta.slug,
+        locale: current.meta.locale,
+        isNew: false,
+        fields: current.fields,
+        body: current.body,
+        metadata: applied.metadata,
+        expectedVersion: input['_version'],
+        changedBy: changedByFromAuth(ctx.auth),
+        defaults: [...current.defaults, provenance],
+    });
+    return saved.ok ? reply(200, saved) : saved.response;
+}
+/** Preview first; committing materializes values and pins provenance in a draft revision. */
+export const applyDocumentDefaults = async (req, ctx) => {
+    const target = await defaultsTarget(req, ctx);
+    if ('status' in target)
+        return target;
+    const slots = slotsToApply(target);
+    if (!Array.isArray(slots))
+        return slots;
+    const { current, source, contract, input } = target;
+    const applied = applyMetadataDefaults(current.metadata, source.metadata, slots, current.defaults.filter((entry) => entry.collection === source.meta.collection &&
+        entry.slug === source.meta.slug &&
+        entry.locale === source.meta.locale));
+    const validation = validateDocument(contract, {
+        fields: current.fields,
+        body: current.body,
+        metadata: applied.metadata,
+    });
+    if (!validation.success)
+        return reply(422, {
+            error: 'Defaults do not satisfy this document',
+            details: formatZodErrors(validation.error.issues),
+        });
+    if (input['apply'] !== true || applied.paths.length === 0)
+        return reply(200, {
+            metadata: applied.metadata,
+            paths: applied.paths,
+            version: current.meta.version,
+            sourceVersion: source.meta.version,
+        });
+    return commitDefaults(ctx, target, applied);
+};
+//# sourceMappingURL=apply-metadata-defaults.js.map

package/dist/handlers/apply-metadata-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-metadata-defaults.js","sourceRoot":"","sources":["../../src/handlers/apply-metadata-defaults.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAwB,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAWhG,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,IAAa,EAAe,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;AAEhF,kFAAkF;AAClF,KAAK,UAAU,cAAc,CAC3B,GAAe,EACf,GAAe;IAEf,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAA;IACtE,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAA;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;IACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAA;IAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;IACvF,MAAM,gBAAgB,GACpB,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IACjF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;IAClG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;QACxF,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5E,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC7E,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,MAAsB;IAC1C,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAE5F,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC1C,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,KAAK,KAAK,SAAS,IAAK,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,CACtE,CAAA;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,cAAc,CAC3B,GAAe,EACf,MAAsB,EACtB,OAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;IACzC,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO;QAChD,OAAO,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,EAAE,+DAA+D;YACtE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAA;IACJ,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC,CAAA;IAClF,MAAM,UAAU,GAAsB;QACpC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;QAClC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;QAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;QACpC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;QACvB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QAC3B,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC;QAClC,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QACtC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;KAC5C,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAA;AACtD,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAe,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC7C,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;IACnD,MAAM,OAAO,GAAG,qBAAqB,CACnC,OAAO,CAAC,QAAQ,EAChB,MAAM,CAAC,QAAQ,EACf,KAAK,EACL,OAAO,CAAC,QAAQ,CAAC,MAAM,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU;QAC3C,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI;QAC/B,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CACtC,CACF,CAAA;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,CAAC,OAAO;QACrB,OAAO,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,EAAE,uCAAuC;YAC9C,OAAO,EAAE,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;SAClD,CAAC,CAAA;IACJ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACvD,OAAO,KAAK,CAAC,GAAG,EAAE;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;YAC7B,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;SACnC,CAAC,CAAA;IACJ,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC,CAAA"}

package/dist/handlers/auth-callback.d.ts

@@ -0,0 +1,4 @@
+import type { ApiHandler } from '../types.js';
+/** GET /api/auth/callback — OIDC callback, exchange code, provision user, set cookies */
+export declare const authCallback: ApiHandler;
+//# sourceMappingURL=auth-callback.d.ts.map

package/dist/handlers/auth-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-callback.d.ts","sourceRoot":"","sources":["../../src/handlers/auth-callback.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAA2B,MAAM,aAAa,CAAA;AA+MtE,yFAAyF;AACzF,eAAO,MAAM,YAAY,EAAE,UAqD1B,CAAA"}

package/dist/handlers/auth-callback.js

@@ -0,0 +1,217 @@
+import { issueTokenPair } from '../auth-tokens.js';
+import { exchangeCode, getDiscovery, verifyIdToken } from '../oidc.js';
+import { clearOidcStateCookie, oidcStateCookieName, openOidcState } from '../oidc-state.js';
+import { assertRole } from '../permissions.js';
+import { parseCookie } from '../validators.js';
+/** Read an `email_verified` claim — a boolean, or the string some providers send */
+function readEmailVerified(value) {
+    if (value === true || value === 'true')
+        return true;
+    if (value === false || value === 'false')
+        return false;
+    return undefined;
+}
+/**
+ * Extract an identity from the verified ID token claims, falling back to the
+ * userinfo endpoint (GET with the access token as Bearer) only when the ID
+ * token carries no email — some providers (e.g. Zitadel) leave it out.
+ * Returns null if no email can be obtained.
+ */
+async function extractIdentity(claims, tokens, discovery) {
+    let email = claims.email;
+    let name = claims.name;
+    let emailVerified = readEmailVerified(claims.email_verified);
+    if (!email && tokens.access_token && discovery.userinfo_endpoint) {
+        try {
+            const userinfoRes = await fetch(discovery.userinfo_endpoint, {
+                headers: { Authorization: `Bearer ${tokens.access_token}` },
+            });
+            if (userinfoRes.ok) {
+                const userinfo = (await userinfoRes.json());
+                email = typeof userinfo['email'] === 'string' ? userinfo['email'] : undefined;
+                emailVerified = readEmailVerified(userinfo['email_verified']);
+                if (!name) {
+                    name = typeof userinfo['name'] === 'string' ? userinfo['name'] : undefined;
+                }
+            }
+        }
+        catch {
+            // Userinfo fetch failed — fall through; caller will redirect with an error
+        }
+    }
+    if (!email)
+        return null;
+    return {
+        email,
+        name: name ?? email,
+        emailVerified,
+        oidcSubject: claims.sub,
+        oidcIssuer: claims.iss,
+    };
+}
+/** Whether an email appears in `auth.oidc.adminEmails` (case-insensitive) */
+function isAdminEmail(email, configuredAdminEmails) {
+    const adminEmails = configuredAdminEmails.map((e) => e.trim().toLowerCase()).filter(Boolean);
+    return adminEmails.includes(email.toLowerCase());
+}
+/**
+ * Resolve an OIDC identity to a krantho user, creating one when signup is open
+ * — or, with signup closed, when the email is listed in `auth.oidc.adminEmails`
+ * and the provider has not marked it unverified. That bootstrap lets the first
+ * admin in on an empty user table. Returns `closed` when no user may be
+ * created and `deactivated` for a deactivated match — the caller turns both
+ * into user-facing errors.
+ */
+async function resolveOrCreateUser(identity, authAdapter, oidc) {
+    // OIDC identity is the primary lookup; email is the secondary (for users
+    // linking a new provider to an existing krantho account).
+    let user = await authAdapter.getUserByOidc(identity.oidcIssuer, identity.oidcSubject);
+    if (!user) {
+        user = await authAdapter.getUserByEmail(identity.email);
+        if (user) {
+            await authAdapter.updateUser(user.id, {
+                oidcSubject: identity.oidcSubject,
+                oidcIssuer: identity.oidcIssuer,
+            });
+        }
+    }
+    if (!user) {
+        const adminBootstrap = isAdminEmail(identity.email, oidc.adminEmails) && identity.emailVerified !== false;
+        if (oidc.signup === 'closed' && !adminBootstrap)
+            return { kind: 'closed' };
+        user = await authAdapter.createUser({
+            email: identity.email,
+            name: identity.name,
+            roles: [assertRole(oidc.newUserRole, 'auth.oidc.newUserRole')],
+            oidcSubject: identity.oidcSubject,
+            oidcIssuer: identity.oidcIssuer,
+        });
+    }
+    if (!user.isActive)
+        return { kind: 'deactivated' };
+    return { kind: 'ok', user };
+}
+/**
+ * Promote the user to Studio if their email appears in `auth.oidc.adminEmails`.
+ *
+ * Returns the (possibly refreshed) user record, or null if the promotion
+ * update happened but the re-fetch failed — that's a storage-layer bug the
+ * caller treats as an error.
+ */
+async function maybePromoteToAdmin(user, email, authAdapter, configuredAdminEmails) {
+    if (!isAdminEmail(email, configuredAdminEmails) || user.roles.includes('admin')) {
+        return user;
+    }
+    await authAdapter.updateUser(user.id, { roles: ['admin'] });
+    return authAdapter.getUser(user.id);
+}
+/**
+ * Exchange the code, verify the ID token against the pending sign-in, and
+ * provision the user. Returns the session cookies, or an error message for
+ * the Studio login screen.
+ */
+async function completeSignIn(code, pending, client, headers) {
+    const { auth, issuerUrl, clientId, authAdapter } = client;
+    const discovery = await getDiscovery(issuerUrl);
+    const tokens = await exchangeCode(discovery.token_endpoint, {
+        code,
+        redirectUri: client.redirectUri,
+        clientId,
+        clientSecret: auth.oidc.clientSecret,
+        codeVerifier: pending.codeVerifier,
+    });
+    const claims = await verifyIdToken(tokens.id_token, {
+        issuerUrl,
+        clientId,
+        jwksUri: discovery.jwks_uri,
+        nonce: pending.nonce,
+    });
+    const identity = await extractIdentity(claims, tokens, discovery);
+    if (!identity)
+        return { error: 'OIDC provider did not return email claim' };
+    const resolved = await resolveOrCreateUser(identity, authAdapter, auth.oidc);
+    if (resolved.kind === 'closed')
+        return { error: 'User not authorized. Contact an administrator.' };
+    if (resolved.kind === 'deactivated') {
+        return { error: 'Account deactivated. Contact an administrator.' };
+    }
+    const promoted = await maybePromoteToAdmin(resolved.user, identity.email, authAdapter, auth.oidc.adminEmails);
+    if (!promoted)
+        return { error: 'User not found after promotion' };
+    const issued = await issueTokenPair({
+        user: {
+            id: promoted.id,
+            email: promoted.email ?? identity.email,
+            name: promoted.name ?? identity.name,
+            roles: promoted.roles,
+        },
+        jwtSecret: client.jwtSecret,
+        auth,
+        headers,
+        authAdapter,
+    });
+    return { cookies: issued.cookies };
+}
+/** GET /api/auth/callback — OIDC callback, exchange code, provision user, set cookies */
+export const authCallback = async (req, ctx) => {
+    const auth = ctx.config.auth;
+    if (auth.mode !== 'oidc') {
+        return { status: 400, body: { error: 'OIDC mode is not enabled' } };
+    }
+    const { issuer: issuerUrl, clientId, redirectUri } = auth.oidc;
+    const jwtSecret = auth.jwtSecret;
+    const authAdapter = ctx.authAdapter;
+    if (!issuerUrl || !clientId || !redirectUri || !jwtSecret || !authAdapter) {
+        return { status: 500, body: { error: 'OIDC not fully configured' } };
+    }
+    // Errors land on the Studio login screen, or answer 404 when Studio is
+    // gated; the pending sign-in is single-use, so every outcome clears its cookie
+    const clearState = clearOidcStateCookie(auth, req.headers);
+    const refuse = (message) => refuseSignIn(auth, message, clearState);
+    const code = req.query['code'];
+    const state = req.query['state'];
+    const error = req.query['error'];
+    if (error) {
+        const desc = req.query['error_description'] ?? error;
+        return refuse(`Authentication failed: ${desc}`);
+    }
+    if (!code || !state) {
+        return refuse('Missing code or state parameter');
+    }
+    const sealed = parseCookie(req.headers?.['cookie'], oidcStateCookieName(auth.session));
+    const pending = openOidcState(sealed, jwtSecret);
+    if (!pending || pending.state !== state) {
+        return refuse('Invalid or expired state parameter');
+    }
+    try {
+        const client = { auth, issuerUrl, clientId, redirectUri, jwtSecret, authAdapter };
+        const result = await completeSignIn(code, pending, client, req.headers);
+        if ('error' in result)
+            return refuse(result.error);
+        return {
+            status: 302,
+            body: null,
+            headers: { Location: pending.returnTo },
+            cookies: [clearState, ...result.cookies],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'OIDC authentication failed';
+        return refuse(message);
+    }
+};
+/**
+ * Answer a sign-in that did not complete. With Studio gated
+ * (`auth.oidc.studioEntry` is `redirect`) the answer is 404, so Studio's
+ * existence is not revealed; the reason is logged for the operator. Otherwise
+ * the Studio sign-in page shows the error.
+ */
+function refuseSignIn(auth, errorMessage, clearState) {
+    if (auth.oidc.studioEntry === 'redirect') {
+        console.warn(`[auth] Sign-in refused: ${errorMessage}`);
+        return { status: 404, body: { error: 'Not found' }, cookies: [clearState] };
+    }
+    const url = `/studio/?error=${encodeURIComponent(errorMessage)}`;
+    return { status: 302, body: null, headers: { Location: url }, cookies: [clearState] };
+}
+//# sourceMappingURL=auth-callback.js.map

package/dist/handlers/auth-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-callback.js","sourceRoot":"","sources":["../../src/handlers/auth-callback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEtE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAe9C,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACnD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IACtD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAqB,EACrB,MAA+D,EAC/D,SAAqD;IAErD,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IACxB,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;IACtB,IAAI,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAE5D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE;gBAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;aAC5D,CAAC,CAAA;YACF,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAA4B,CAAA;gBACtE,KAAK,GAAG,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC7E,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,GAAG,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC5E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACL,KAAK;QACL,IAAI,EAAE,IAAI,IAAI,KAAK;QACnB,aAAa;QACb,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,UAAU,EAAE,MAAM,CAAC,GAAG;KACvB,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,KAAa,EAAE,qBAAwC;IAC3E,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5F,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAChC,QAAsB,EACtB,WAAyB,EACzB,IAAyB;IAEzB,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;IAErF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACvD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBACpC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,cAAc,GAClB,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAA;QACpF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAE1E,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;YAClC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;YAC9D,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAClD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAgB,EAChB,KAAa,EACb,WAAyB,EACzB,qBAAwC;IAExC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,qBAAqB,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAW,EAAE,CAAC,CAAA;IACrE,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACrC,CAAC;AAYD;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,OAAyB,EACzB,MAAkB,EAClB,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,cAAc,EAAE;QAC1D,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;QACpC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE;QAClD,SAAS;QACT,QAAQ;QACR,OAAO,EAAE,SAAS,CAAC,QAAQ;QAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAA;IAE3E,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5E,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAA;IAClG,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAA;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,KAAK,EACd,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,WAAW,CACtB,CAAA;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;IAEjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;YACvC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YACpC,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;QACD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI;QACJ,OAAO;QACP,WAAW;KACZ,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,YAAY,GAAe,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAA;IAE5B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAA;IACrE,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;IAEnC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,CAAA;IACtE,CAAC;IAED,uEAAuE;IACvE,+EAA+E;IAC/E,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,CAAC,OAAe,EAAe,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IAExF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEhC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAA;QACpD,OAAO,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACtF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,oCAAoC,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;QACjF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;QACvE,IAAI,OAAO,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAElD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YACvC,OAAO,EAAE,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;SACzC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAA;QACjF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAiB,EAAE,YAAoB,EAAE,UAAkB;IAC/E,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,2BAA2B,YAAY,EAAE,CAAC,CAAA;QACvD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAA;IAC7E,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAA;IAChE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAA;AACvF,CAAC"}

package/dist/handlers/auth-capabilities.d.ts

@@ -0,0 +1,4 @@
+import type { ApiHandler } from '../types.js';
+/** GET /api/auth/capabilities — public, returns auth mode and capabilities */
+export declare const authCapabilities: ApiHandler;
+//# sourceMappingURL=auth-capabilities.d.ts.map

package/dist/handlers/auth-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-capabilities.d.ts","sourceRoot":"","sources":["../../src/handlers/auth-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,UAkB9B,CAAA"}

package/dist/handlers/auth-capabilities.js

@@ -0,0 +1,19 @@
+/** GET /api/auth/capabilities — public, returns auth mode and capabilities */
+export const authCapabilities = async (_req, ctx) => {
+    const mode = ctx.config.auth.mode;
+    return {
+        status: 200,
+        body: {
+            auth_mode: mode,
+            login_required: mode !== 'none',
+            capabilities: {
+                password_management: false,
+                role_management: mode !== 'none',
+                self_registration: false,
+                user_management: mode !== 'none' && ctx.authAdapter !== undefined,
+                oidc_providers: mode === 'oidc' ? [{ name: 'OIDC Provider', login_url: '/api/auth/login/oidc' }] : [],
+            },
+        },
+    };
+};
+//# sourceMappingURL=auth-capabilities.js.map

package/dist/handlers/auth-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-capabilities.js","sourceRoot":"","sources":["../../src/handlers/auth-capabilities.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;IAEjC,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,IAAI,KAAK,MAAM;YAC/B,YAAY,EAAE;gBACZ,mBAAmB,EAAE,KAAK;gBAC1B,eAAe,EAAE,IAAI,KAAK,MAAM;gBAChC,iBAAiB,EAAE,KAAK;gBACxB,eAAe,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;gBACjE,cAAc,EACZ,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;aACxF;SACF;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/auth-login.d.ts

@@ -0,0 +1,4 @@
+import type { ApiHandler } from '../types.js';
+/** POST /api/auth/login — validate token, create session with JWT + refresh token */
+export declare const authLogin: ApiHandler;
+//# sourceMappingURL=auth-login.d.ts.map

package/dist/handlers/auth-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.d.ts","sourceRoot":"","sources":["../../src/handlers/auth-login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,qFAAqF;AACrF,eAAO,MAAM,SAAS,EAAE,UAmEvB,CAAA"}

package/dist/handlers/auth-login.js

@@ -0,0 +1,60 @@
+import { issueTokenPair } from '../auth-tokens.js';
+import { assertRole } from '../permissions.js';
+/** POST /api/auth/login — validate token, create session with JWT + refresh token */
+export const authLogin = async (req, ctx) => {
+    const auth = ctx.config.auth;
+    if (auth.mode === 'none') {
+        return { status: 200, body: { identity: 'anonymous', mode: 'none' } };
+    }
+    const body = req.body;
+    const token = typeof body?.['token'] === 'string' ? body['token'] : undefined;
+    if (!token) {
+        return { status: 400, body: { error: 'Token is required' } };
+    }
+    if (auth.mode === 'token') {
+        if (token !== auth.token.secret) {
+            return { status: 401, body: { error: 'Invalid token' } };
+        }
+        if (!auth.jwtSecret) {
+            return { status: 500, body: { error: 'JWT secret not configured' } };
+        }
+        const tokenRole = assertRole(auth.token.role, 'auth.token.role');
+        const tokenEmail = auth.token.email;
+        // Find or create the token mode user
+        let user = ctx.authAdapter ? await ctx.authAdapter.getUserByEmail(tokenEmail) : null;
+        if (!user && ctx.authAdapter) {
+            user = await ctx.authAdapter.createUser({
+                email: tokenEmail,
+                name: 'Token Admin',
+                roles: [tokenRole],
+            });
+        }
+        const userId = user?.id ?? 'token-user';
+        const roles = user?.roles ?? [tokenRole];
+        const tokenUser = {
+            id: userId,
+            email: tokenEmail,
+            name: user?.name ?? 'Token Admin',
+            roles,
+        };
+        const tokens = await issueTokenPair({
+            user: tokenUser,
+            jwtSecret: auth.jwtSecret,
+            auth,
+            headers: req.headers,
+            authAdapter: ctx.authAdapter,
+        });
+        return {
+            status: 200,
+            body: {
+                identity: tokenEmail,
+                mode: 'token',
+                roles,
+                name: user?.name ?? 'Token Admin',
+            },
+            cookies: tokens.cookies,
+        };
+    }
+    return { status: 400, body: { error: `Login not supported for mode: ${auth.mode}` } };
+};
+//# sourceMappingURL=auth-login.js.map

package/dist/handlers/auth-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.js","sourceRoot":"","sources":["../../src/handlers/auth-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C,qFAAqF;AACrF,MAAM,CAAC,MAAM,SAAS,GAAe,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAA;IAE5B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAA;IAC5D,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAE7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAA;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAA;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,CAAA;QACtE,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAA;QAEnC,qCAAqC;QACrC,IAAI,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAEpF,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;gBACtC,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAC,SAAS,CAAC;aACnB,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,YAAY,CAAA;QACvC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,CAAA;QAExC,MAAM,SAAS,GAAG;YAChB,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa;YACjC,KAAK;SACN,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI;YACJ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAA;QAEF,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,OAAO;gBACb,KAAK;gBACL,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa;aAClC;YACD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iCAAiC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAA;AACvF,CAAC,CAAA"}

package/dist/handlers/auth-logout.d.ts

@@ -0,0 +1,4 @@
+import type { ApiHandler } from '../types.js';
+/** POST /api/auth/logout — clear cookies, delete refresh token, return SSO logout URL */
+export declare const authLogout: ApiHandler;
+//# sourceMappingURL=auth-logout.d.ts.map

package/dist/handlers/auth-logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-logout.d.ts","sourceRoot":"","sources":["../../src/handlers/auth-logout.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAG7C,yFAAyF;AACzF,eAAO,MAAM,UAAU,EAAE,UAkCxB,CAAA"}

package/dist/handlers/auth-logout.js

@@ -0,0 +1,40 @@
+import { clearSessionCookies } from '../auth-tokens.js';
+import { refreshCookieName } from '../cookies.js';
+import { hashRefreshToken } from '../jwt.js';
+import { getDiscovery } from '../oidc.js';
+import { parseCookie } from '../validators.js';
+/** POST /api/auth/logout — clear cookies, delete refresh token, return SSO logout URL */
+export const authLogout = async (req, ctx) => {
+    const auth = ctx.config.auth;
+    // Delete refresh token from database if possible
+    if (ctx.authAdapter) {
+        const refreshToken = parseCookie(req.headers?.['cookie'], refreshCookieName(auth.session));
+        if (refreshToken) {
+            const tokenHash = hashRefreshToken(refreshToken, auth.jwtSecret ?? '');
+            const record = await ctx.authAdapter.getRefreshTokenByHash(tokenHash);
+            if (record) {
+                await ctx.authAdapter.deleteRefreshToken(record.id);
+            }
+        }
+    }
+    // Build OIDC end-session URL for SSO logout
+    let ssoLogoutUrl = null;
+    if (auth.mode === 'oidc' && auth.oidc.issuer) {
+        try {
+            const discovery = await getDiscovery(auth.oidc.issuer);
+            if (discovery.end_session_endpoint) {
+                const params = new URLSearchParams({ post_logout_redirect_uri: auth.oidc.postLogoutUri });
+                ssoLogoutUrl = `${discovery.end_session_endpoint}?${params.toString()}`;
+            }
+        }
+        catch {
+            // Discovery failed — proceed without SSO logout
+        }
+    }
+    return {
+        status: 200,
+        body: { message: 'Logged out', ssoLogoutUrl },
+        cookies: clearSessionCookies(auth, req.headers),
+    };
+};
+//# sourceMappingURL=auth-logout.js.map

package/dist/handlers/auth-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-logout.js","sourceRoot":"","sources":["../../src/handlers/auth-logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,yFAAyF;AACzF,MAAM,CAAC,MAAM,UAAU,GAAe,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAA;IAE5B,iDAAiD;IACjD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1F,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAA;YACrE,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,YAAY,GAAkB,IAAI,CAAA;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtD,IAAI,SAAS,CAAC,oBAAoB,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAA;gBACzF,YAAY,GAAG,GAAG,SAAS,CAAC,oBAAoB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;YACzE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE;QAC7C,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;KAChD,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/auth-me.d.ts

@@ -0,0 +1,4 @@
+import type { ApiHandler } from '../types.js';
+/** GET /api/auth/me — return current user from JWT cookie or Bearer token */
+export declare const authMe: ApiHandler;
+//# sourceMappingURL=auth-me.d.ts.map

package/dist/handlers/auth-me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-me.d.ts","sourceRoot":"","sources":["../../src/handlers/auth-me.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAG7C,6EAA6E;AAC7E,eAAO,MAAM,MAAM,EAAE,UAuDpB,CAAA"}