@notionx/core 0.1.0

package/dist/auth/index.js

@@ -0,0 +1,1011 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/util/env.ts
+import { env } from "cloudflare:workers";
+var workerEnv = env;
+
+// src/platform/runtime.ts
+function cacheRequestForKey(key) {
+  return new Request(key, { method: "GET" });
+}
+function createCloudflarePublicCacheAdapter(cache2) {
+  return {
+    kind: "cloudflare-cache",
+    async match(key) {
+      return await cache2.match(cacheRequestForKey(key)) ?? null;
+    },
+    put(key, response) {
+      return cache2.put(cacheRequestForKey(key), response);
+    },
+    delete(key) {
+      return cache2.delete(cacheRequestForKey(key));
+    }
+  };
+}
+function createCloudflareKeyValueCacheAdapter(namespace) {
+  return {
+    kind: "workers-kv",
+    async get(key, options) {
+      return await namespace.get(key, {
+        type: "json",
+        cacheTtl: options?.cacheTtl
+      });
+    },
+    async put(key, value, options) {
+      await namespace.put(key, JSON.stringify(value), {
+        expirationTtl: options?.expirationTtl,
+        metadata: options?.metadata
+      });
+    },
+    delete(key) {
+      return namespace.delete(key);
+    },
+    async list(options) {
+      const result = await namespace.list({
+        prefix: options?.prefix,
+        limit: options?.limit,
+        cursor: options?.cursor
+      });
+      return {
+        keys: result.keys.map((key) => ({ name: key.name })),
+        cursor: result.list_complete ? void 0 : result.cursor,
+        listComplete: result.list_complete
+      };
+    }
+  };
+}
+function r2ObjectToStoredObject(object) {
+  return {
+    body: object.body,
+    size: object.size,
+    etag: object.etag,
+    contentType: object.httpMetadata?.contentType
+  };
+}
+function createCloudflareRuntimePlatform(env2, options) {
+  const database = env2.DB ? {
+    kind: "d1",
+    prepare(query) {
+      return env2.DB.prepare(query);
+    },
+    async batch(statements) {
+      return await env2.DB.batch(
+        statements
+      );
+    }
+  } : null;
+  const objectStorage = env2.ASSETS_BUCKET ? {
+    kind: "r2",
+    async get(key) {
+      const object = await env2.ASSETS_BUCKET?.get(key);
+      return object ? r2ObjectToStoredObject(object) : null;
+    },
+    async put(key, value, options2) {
+      await env2.ASSETS_BUCKET?.put(key, value, {
+        httpMetadata: {
+          contentType: options2?.contentType,
+          cacheControl: options2?.cacheControl
+        },
+        customMetadata: options2?.metadata
+      });
+    },
+    async delete(key) {
+      await env2.ASSETS_BUCKET?.delete(key);
+    },
+    async list(options2) {
+      const listed = await env2.ASSETS_BUCKET?.list({
+        prefix: options2?.prefix,
+        limit: options2?.limit
+      });
+      return listed?.objects.map((object) => ({
+        key: object.key,
+        size: object.size,
+        uploaded: object.uploaded
+      })) ?? [];
+    }
+  } : null;
+  const imageTransformer = env2.IMAGES ? {
+    kind: "cloudflare-images",
+    async transform(body, options2) {
+      const result = await env2.IMAGES.input(body).transform(options2.width ? { width: options2.width } : {}).output({
+        format: options2.format,
+        quality: options2.quality
+      });
+      return {
+        body: result.image(),
+        contentType: result.contentType(),
+        response: () => result.response()
+      };
+    }
+  } : null;
+  const keyValueCache = env2.CONTENT_CACHE ? createCloudflareKeyValueCacheAdapter(env2.CONTENT_CACHE) : null;
+  return {
+    id: "cloudflare-workers",
+    database,
+    objectStorage,
+    imageTransformer,
+    keyValueCache,
+    publicCache: options?.publicCache ? createCloudflarePublicCacheAdapter(options.publicCache) : null
+  };
+}
+
+// src/platform/cloudflare-runtime.ts
+function getDefaultCloudflareCache() {
+  const globalWithCaches = globalThis;
+  return globalWithCaches.caches?.default ?? null;
+}
+function getRuntimePlatform() {
+  return createCloudflareRuntimePlatform(workerEnv, {
+    publicCache: getDefaultCloudflareCache()
+  });
+}
+
+// src/platform/current.ts
+function getRuntimePlatform2() {
+  return getRuntimePlatform();
+}
+function getDatabase() {
+  const platform = getRuntimePlatform2();
+  const database = platform.database;
+  if (!database) {
+    throw new Error(`SQL database adapter not configured for ${platform.id}`);
+  }
+  return database;
+}
+
+// src/auth/auth.ts
+function notImplemented(method) {
+  throw new Error(
+    `createAuth: ${method} is not implemented yet. It will be wired up in Task 3.2 (move auth internals).`
+  );
+}
+function createAuth(config) {
+  const getRuntime = () => getRuntimePlatform2();
+  void config;
+  return {
+    async requireViewer(_request) {
+      void getRuntime();
+      notImplemented("requireViewer");
+    },
+    async requireRole(_request, _role) {
+      void getRuntime();
+      notImplemented("requireRole");
+    },
+    async listUsers() {
+      void getRuntime();
+      notImplemented("listUsers");
+    },
+    async setUserRole(_userId, _role) {
+      void getRuntime();
+      notImplemented("setUserRole");
+    },
+    async checkRateLimit(_key, _limit, _windowMs) {
+      void getRuntime();
+      notImplemented("checkRateLimit");
+    },
+    async verifyTurnstile(_token, _ip) {
+      void getRuntime();
+      notImplemented("verifyTurnstile");
+    }
+  };
+}
+
+// src/auth/user-session.ts
+import { cookies } from "next/headers";
+
+// src/auth/passwords.ts
+var HASH_PREFIX = "pbkdf2_sha256";
+var PBKDF2_ITERATIONS = 1e5;
+var SALT_BYTES = 16;
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function base64ToBytes(input) {
+  const bin = atob(input);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+}
+async function deriveKey(password, salt, iterations) {
+  const normalizedSalt = Uint8Array.from(salt);
+  const baseKey = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const derived = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      hash: "SHA-256",
+      salt: normalizedSalt,
+      iterations
+    },
+    baseKey,
+    256
+  );
+  return new Uint8Array(derived);
+}
+async function constantTimeEqual(left, right) {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let i = 0; i < left.length; i++) {
+    diff |= left[i] ^ right[i];
+  }
+  return diff === 0;
+}
+async function hashPassword(password) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+  const derived = await deriveKey(password, salt, PBKDF2_ITERATIONS);
+  return [
+    HASH_PREFIX,
+    String(PBKDF2_ITERATIONS),
+    bytesToBase64(salt),
+    bytesToBase64(derived)
+  ].join("$");
+}
+function validatePasswordStrength(password) {
+  if (password.length < 8) return "\u5BC6\u7801\u81F3\u5C11\u9700\u8981 8 \u4F4D";
+  if (!/[a-zA-Z]/.test(password) || !/\d/.test(password)) {
+    return "\u5BC6\u7801\u9700\u8981\u540C\u65F6\u5305\u542B\u5B57\u6BCD\u548C\u6570\u5B57";
+  }
+  return null;
+}
+async function verifyPassword(password, storedHash) {
+  const [prefix, iterationsStr, saltB64, hashB64] = storedHash.split("$");
+  if (prefix !== HASH_PREFIX || !iterationsStr || !saltB64 || !hashB64) {
+    return false;
+  }
+  const iterations = Number(iterationsStr);
+  if (!Number.isFinite(iterations) || iterations <= 0) return false;
+  const salt = base64ToBytes(saltB64);
+  const expected = base64ToBytes(hashB64);
+  const derived = await deriveKey(password, salt, iterations);
+  return constantTimeEqual(derived, expected);
+}
+
+// src/internal/admin/settings.ts
+import { cache } from "react";
+
+// src/internal/admin/schema-guard.ts
+var DEFAULT_TURNSTILE_PUBLIC_CONFIG = {
+  enabled: false,
+  siteKey: null,
+  secretConfigured: false
+};
+function isSchemaDriftError(error) {
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  return message.includes("no such column") || message.includes("no such table");
+}
+function buildTurnstilePublicConfig(settings, envLike) {
+  const envSiteKey = envLike.TURNSTILE_SITE_KEY?.trim() || null;
+  const siteKey = settings.turnstile_site_key?.trim() || envSiteKey || null;
+  const secretConfigured = Boolean(envLike.TURNSTILE_SECRET_KEY?.trim());
+  const enabled = (settings.turnstile_enabled === 1 || Boolean(envSiteKey)) && Boolean(siteKey) && secretConfigured;
+  return {
+    enabled,
+    siteKey,
+    secretConfigured
+  };
+}
+
+// src/internal/admin/settings.ts
+var DEFAULT_ADMIN_EMAIL = "zhaofilms@gmail.com";
+function rowToSettings(r) {
+  return {
+    site_title: r.site_title,
+    google_enabled: r.google_enabled === 1 ? 1 : 0,
+    google_client_id: r.google_client_id,
+    google_client_secret: r.google_client_secret,
+    google_updated_at: r.google_updated_at,
+    turnstile_enabled: r.turnstile_enabled === 1 ? 1 : 0,
+    turnstile_site_key: r.turnstile_site_key,
+    turnstile_updated_at: r.turnstile_updated_at,
+    admin_email: r.admin_email,
+    updated_at: r.updated_at
+  };
+}
+var getAppSettingsCached = cache(async () => {
+  const row = await getDatabase().prepare(
+    `SELECT site_title, google_enabled, google_client_id, google_client_secret,
+            google_updated_at, turnstile_enabled, turnstile_site_key,
+            turnstile_updated_at, admin_email, updated_at
+       FROM app_settings WHERE id = 1`
+  ).first();
+  if (!row) {
+    return {
+      site_title: "vinext Blog",
+      google_enabled: 0,
+      google_client_id: null,
+      google_client_secret: null,
+      google_updated_at: null,
+      turnstile_enabled: 0,
+      turnstile_site_key: null,
+      turnstile_updated_at: null,
+      admin_email: DEFAULT_ADMIN_EMAIL,
+      updated_at: ""
+    };
+  }
+  return rowToSettings(row);
+});
+async function getAppSettings() {
+  return getAppSettingsCached();
+}
+async function getTurnstilePublicConfig() {
+  try {
+    const s = await getAppSettings();
+    return buildTurnstilePublicConfig(s, workerEnv);
+  } catch (error) {
+    if (isSchemaDriftError(error)) {
+      console.error(
+        "[settings] turnstile config unavailable due to schema drift; falling back to disabled state",
+        error
+      );
+      return { ...DEFAULT_TURNSTILE_PUBLIC_CONFIG };
+    }
+    throw error;
+  }
+}
+
+// src/internal/admin/admin.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+async function isAdminEmail(email) {
+  if (!email) return false;
+  const settings = await getAppSettings();
+  return normalizeEmail(email) === normalizeEmail(settings.admin_email);
+}
+
+// src/auth/users.ts
+function normalizeEmail2(email) {
+  return email.trim().toLowerCase();
+}
+async function defaultRoleFor(email) {
+  return await isAdminEmail(email) ? "admin" : "user";
+}
+function normalizeUserRole(role) {
+  if (role === "admin" || role === "vip") return role;
+  return "user";
+}
+function createRandomToken() {
+  return [...crypto.getRandomValues(new Uint8Array(24))].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function userToSession(user) {
+  return {
+    uid: user.id,
+    email: user.email,
+    name: user.name,
+    picture: user.picture,
+    rev: user.session_rev ?? 0
+  };
+}
+async function upsertGoogleUser(input) {
+  const db = getDatabase();
+  const email = normalizeEmail2(input.email);
+  const existing = await db.prepare(
+    `SELECT * FROM users WHERE google_sub = ? OR email = ? LIMIT 1`
+  ).bind(input.googleSub, email).first();
+  if (existing) {
+    await db.prepare(
+      `UPDATE users
+       SET email = ?, name = ?, picture = ?, google_sub = ?, email_verified = 1,
+           email_verify_token = NULL, email_verify_expires_at = NULL,
+           last_seen_at = datetime('now')
+       WHERE id = ?`
+    ).bind(email, input.name, input.picture, input.googleSub, existing.id).run();
+  } else {
+    const role = await defaultRoleFor(email);
+    await db.prepare(
+      `INSERT INTO users (
+        email, name, picture, google_sub, email_verified, role, last_seen_at
+      ) VALUES (?, ?, ?, ?, 1, ?, datetime('now'))`
+    ).bind(email, input.name, input.picture, input.googleSub, role).run();
+  }
+  if (await isAdminEmail(email)) {
+    await db.prepare(
+      `UPDATE users SET role = 'admin' WHERE email = ?`
+    ).bind(email).run();
+  }
+  const user = await getUserByEmail(email);
+  if (!user) throw new Error("User upsert failed");
+  return user;
+}
+async function createEmailUser(input) {
+  const email = normalizeEmail2(input.email);
+  const existing = await getUserByEmail(email);
+  if (existing) {
+    return { ok: false, reason: "exists" };
+  }
+  const passwordHash = await hashPassword(input.password);
+  const verifyToken = createRandomToken();
+  const verifyExpiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24).toISOString();
+  const role = await defaultRoleFor(email);
+  const db = getDatabase();
+  await db.prepare(
+    `INSERT INTO users (
+      email, password_hash, email_verified, email_verify_token,
+      email_verify_expires_at, role, last_seen_at
+    ) VALUES (?, ?, 0, ?, ?, ?, datetime('now'))`
+  ).bind(email, passwordHash, verifyToken, verifyExpiresAt, role).run();
+  if (role === "admin") {
+    await db.prepare(
+      `UPDATE users SET role = 'admin' WHERE email = ?`
+    ).bind(email).run();
+  }
+  const user = await getUserByEmail(email);
+  if (!user) throw new Error("User creation failed");
+  return { ok: true, user, verifyToken };
+}
+async function verifyEmailUser(token) {
+  const user = await getDatabase().prepare(
+    `SELECT * FROM users WHERE email_verify_token = ?`
+  ).bind(token).first();
+  if (!user || !user.email_verify_expires_at) return null;
+  if (new Date(user.email_verify_expires_at).getTime() < Date.now()) {
+    return null;
+  }
+  await getDatabase().prepare(
+    `UPDATE users
+     SET email_verified = 1,
+         email_verify_token = NULL,
+         email_verify_expires_at = NULL,
+         last_seen_at = datetime('now')
+     WHERE id = ?`
+  ).bind(user.id).run();
+  return getUserByEmail(user.email);
+}
+async function issueVerificationToken(email) {
+  const user = await getUserByEmail(email);
+  if (!user) return { ok: false, reason: "not_found" };
+  if (!user.password_hash) return { ok: false, reason: "no_password" };
+  if (user.email_verified) return { ok: false, reason: "already_verified" };
+  const verifyToken = createRandomToken();
+  const verifyExpiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24).toISOString();
+  await getDatabase().prepare(
+    `UPDATE users
+     SET email_verify_token = ?, email_verify_expires_at = ?
+     WHERE id = ?`
+  ).bind(verifyToken, verifyExpiresAt, user.id).run();
+  const updated = await getUserByEmail(email);
+  if (!updated) return { ok: false, reason: "not_found" };
+  return { ok: true, token: verifyToken, user: updated };
+}
+async function issuePasswordResetToken(email) {
+  const user = await getUserByEmail(email);
+  if (!user || !user.password_hash) {
+    return { ok: false, reason: "not_found" };
+  }
+  if (!user.email_verified) {
+    return { ok: false, reason: "unverified" };
+  }
+  const resetToken = createRandomToken();
+  const resetExpiresAt = new Date(Date.now() + 1e3 * 60 * 60).toISOString();
+  await getDatabase().prepare(
+    `UPDATE users
+     SET password_reset_token = ?, password_reset_expires_at = ?
+     WHERE id = ?`
+  ).bind(resetToken, resetExpiresAt, user.id).run();
+  const updated = await getUserByEmail(email);
+  if (!updated) return { ok: false, reason: "not_found" };
+  return { ok: true, token: resetToken, user: updated };
+}
+async function resetPasswordWithToken(input) {
+  const user = await getDatabase().prepare(
+    `SELECT * FROM users WHERE password_reset_token = ?`
+  ).bind(input.token).first();
+  if (!user || !user.password_reset_expires_at) {
+    return { ok: false, reason: "invalid" };
+  }
+  if (new Date(user.password_reset_expires_at).getTime() < Date.now()) {
+    return { ok: false, reason: "invalid" };
+  }
+  const passwordHash = await hashPassword(input.password);
+  await getDatabase().prepare(
+    `UPDATE users
+     SET password_hash = ?,
+         password_reset_token = NULL,
+         password_reset_expires_at = NULL,
+         session_rev = session_rev + 1,
+         last_seen_at = datetime('now')
+     WHERE id = ?`
+  ).bind(passwordHash, user.id).run();
+  const updated = await getUserById(user.id);
+  if (!updated) return { ok: false, reason: "invalid" };
+  return { ok: true, user: updated };
+}
+async function changeUserPassword(input) {
+  const user = await getUserById(input.userId);
+  if (!user || !user.password_hash) {
+    return { ok: false, reason: "no_password" };
+  }
+  const matches = await verifyPassword(
+    input.currentPassword,
+    user.password_hash
+  );
+  if (!matches) {
+    return { ok: false, reason: "invalid" };
+  }
+  const passwordHash = await hashPassword(input.newPassword);
+  await getDatabase().prepare(
+    `UPDATE users
+     SET password_hash = ?,
+         session_rev = session_rev + 1,
+         last_seen_at = datetime('now')
+     WHERE id = ?`
+  ).bind(passwordHash, user.id).run();
+  const updated = await getUserById(user.id);
+  if (!updated) return { ok: false, reason: "invalid" };
+  return { ok: true, user: updated };
+}
+async function authenticateEmailUser(input) {
+  const email = normalizeEmail2(input.email);
+  const user = await getUserByEmail(email);
+  if (!user || !user.password_hash) {
+    return { ok: false, reason: "invalid" };
+  }
+  const matches = await verifyPassword(input.password, user.password_hash);
+  if (!matches) {
+    return { ok: false, reason: "invalid" };
+  }
+  if (!user.email_verified) {
+    return { ok: false, reason: "unverified" };
+  }
+  await getDatabase().prepare(
+    `UPDATE users SET last_seen_at = datetime('now') WHERE id = ?`
+  ).bind(user.id).run();
+  return { ok: true, user: { ...user, email } };
+}
+async function getUserByEmail(email) {
+  return await getDatabase().prepare(`SELECT * FROM users WHERE email = ?`).bind(normalizeEmail2(email)).first();
+}
+async function getUserById(id) {
+  return await getDatabase().prepare(`SELECT * FROM users WHERE id = ?`).bind(id).first();
+}
+async function listUsers(limit = 100) {
+  const { results } = await getDatabase().prepare(
+    `SELECT * FROM users ORDER BY created_at DESC LIMIT ?`
+  ).bind(limit).all();
+  return results || [];
+}
+async function listUsersWithPostCounts(limit = 100) {
+  const { results } = await getDatabase().prepare(
+    `SELECT u.*,
+            (SELECT COUNT(*) FROM posts p WHERE p.owner_email = u.email) AS post_count
+       FROM users u
+      ORDER BY u.created_at DESC
+      LIMIT ?`
+  ).bind(limit).all();
+  return results || [];
+}
+async function revokeUserSessions(userId) {
+  const user = await getUserById(userId);
+  if (!user) return false;
+  await getDatabase().prepare(
+    `UPDATE users SET session_rev = session_rev + 1 WHERE id = ?`
+  ).bind(userId).run();
+  return true;
+}
+async function setUserRole(userId, role) {
+  const user = await getUserById(userId);
+  if (!user) return { ok: false, reason: "not_found" };
+  if (await isAdminEmail(user.email)) {
+    return { ok: false, reason: "is_admin" };
+  }
+  await getDatabase().prepare(
+    `UPDATE users
+        SET role = ?,
+            last_seen_at = datetime('now')
+      WHERE id = ?`
+  ).bind(role, userId).run();
+  const updated = await getUserById(userId);
+  if (!updated) return { ok: false, reason: "not_found" };
+  return { ok: true, user: updated };
+}
+async function deleteUserAccount(userId) {
+  const user = await getUserById(userId);
+  if (!user) return { ok: false, reason: "not_found" };
+  if (await isAdminEmail(user.email)) {
+    return { ok: false, reason: "is_admin" };
+  }
+  const settings = await getAppSettings();
+  const adminEmail = settings.admin_email;
+  const db = getDatabase();
+  await db.batch([
+    db.prepare(
+      `UPDATE posts SET owner_email = ? WHERE owner_email = ?`
+    ).bind(adminEmail, user.email),
+    db.prepare(`DELETE FROM users WHERE id = ?`).bind(userId)
+  ]);
+  return { ok: true, email: user.email };
+}
+
+// src/auth/user-session.ts
+var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+var USER_COOKIE_NAME = "vinext_user_session";
+var ADMIN_COOKIE_NAME = "vinext_admin_session";
+var USER_COOKIE = USER_COOKIE_NAME;
+var ADMIN_COOKIE = ADMIN_COOKIE_NAME;
+function getAdminPassword() {
+  let fromWorker;
+  try {
+    const mod = __require("cloudflare:workers");
+    fromWorker = mod.env?.ADMIN_PASSWORD;
+  } catch {
+    fromWorker = void 0;
+  }
+  if (fromWorker) return fromWorker;
+  return process.env.ADMIN_PASSWORD ?? "vinext-admin-2026";
+}
+async function hmac(secret, message) {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(message));
+  return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function constantTimeEqual2(a, b) {
+  const aBytes = new TextEncoder().encode(a);
+  const bBytes = new TextEncoder().encode(b);
+  if (aBytes.length !== bBytes.length) return false;
+  let diff = 0;
+  for (let i = 0; i < aBytes.length; i++) {
+    diff |= aBytes[i] ^ bBytes[i];
+  }
+  return diff === 0;
+}
+async function signPayload(payload) {
+  return hmac(getAdminPassword(), payload);
+}
+function utf8ToBase64(s) {
+  const bytes = new TextEncoder().encode(s);
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function base64ToUtf8(b64) {
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+}
+async function signUserToken(user) {
+  const exp = Math.floor(Date.now() / 1e3) + SESSION_TTL_SECONDS;
+  const payload = { ...user, exp };
+  const json = JSON.stringify(payload);
+  const b64 = utf8ToBase64(json);
+  const sig = await signPayload(b64);
+  return `${b64}.${sig}`;
+}
+async function setUserSessionCookie(user) {
+  const token = await signUserToken(user);
+  const jar = await cookies();
+  jar.set(USER_COOKIE_NAME, token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_TTL_SECONDS
+  });
+}
+async function verifyUserToken(token) {
+  if (!token) return null;
+  const parts = token.split(".");
+  if (parts.length !== 2) return null;
+  const [b64, sig] = parts;
+  const expected = await signPayload(b64);
+  if (!await constantTimeEqual2(sig, expected)) return null;
+  try {
+    const json = base64ToUtf8(b64);
+    const payload = JSON.parse(json);
+    if (payload.exp < Math.floor(Date.now() / 1e3)) return null;
+    const dbUser = await getUserById(payload.uid);
+    if (!dbUser) return null;
+    if (dbUser.email !== payload.email) return null;
+    const tokenRev = payload.rev ?? 0;
+    const dbRev = dbUser.session_rev ?? 0;
+    if (tokenRev !== dbRev) return null;
+    return {
+      uid: payload.uid,
+      email: payload.email,
+      name: payload.name,
+      picture: payload.picture,
+      rev: dbRev
+    };
+  } catch {
+    return null;
+  }
+}
+async function getCurrentUser() {
+  const jar = await cookies();
+  const token = jar.get(USER_COOKIE_NAME)?.value;
+  return verifyUserToken(token);
+}
+async function clearUserSessionCookie() {
+  const jar = await cookies();
+  jar.set(USER_COOKIE_NAME, "", { path: "/", maxAge: 0 });
+}
+async function signAdminToken() {
+  const password = getAdminPassword();
+  const exp = Math.floor(Date.now() / 1e3) + SESSION_TTL_SECONDS;
+  const payload = `ok.${exp}`;
+  const sig = await hmac(password, payload);
+  return `${payload}.${sig}`;
+}
+async function verifyAdminToken(token) {
+  if (!token) return false;
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  const [flag, expStr, sig] = parts;
+  if (flag !== "ok") return false;
+  const exp = Number(expStr);
+  if (!Number.isFinite(exp) || exp < Math.floor(Date.now() / 1e3)) return false;
+  const password = getAdminPassword();
+  const expected = await hmac(password, `${flag}.${exp}`);
+  return constantTimeEqual2(sig, expected);
+}
+async function checkPassword(input) {
+  const expected = getAdminPassword();
+  return constantTimeEqual2(input, expected);
+}
+async function setSessionCookie() {
+  const token = await signAdminToken();
+  const jar = await cookies();
+  jar.set(ADMIN_COOKIE_NAME, token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_TTL_SECONDS
+  });
+}
+async function clearSessionCookie() {
+  const jar = await cookies();
+  jar.set(ADMIN_COOKIE_NAME, "", { path: "/", maxAge: 0 });
+}
+function getAdminEmailFromEnv() {
+  let fromWorker;
+  try {
+    const mod = __require("cloudflare:workers");
+    fromWorker = mod.env?.ADMIN_EMAIL;
+  } catch {
+    fromWorker = void 0;
+  }
+  return (fromWorker || "zhaofilms@gmail.com").toLowerCase();
+}
+async function getAuthViewer() {
+  const jar = await cookies();
+  if (await verifyAdminToken(jar.get(ADMIN_COOKIE_NAME)?.value)) {
+    return {
+      email: getAdminEmailFromEnv(),
+      user: null,
+      role: "admin",
+      isAdmin: true,
+      isVip: true,
+      canViewVipContent: true
+    };
+  }
+  const user = await verifyUserToken(jar.get(USER_COOKIE_NAME)?.value);
+  if (!user) return null;
+  const dbUser = await getUserById(user.uid);
+  if (!dbUser) return null;
+  const role = dbUser.role === "admin" || dbUser.role === "vip" ? dbUser.role : "user";
+  const isAdmin = role === "admin";
+  const isVip = role === "vip" || isAdmin;
+  return {
+    email: user.email,
+    user,
+    role,
+    isAdmin,
+    isVip,
+    canViewVipContent: isVip
+  };
+}
+async function isAuthenticated() {
+  const jar = await cookies();
+  if (await verifyAdminToken(jar.get(ADMIN_COOKIE_NAME)?.value)) return true;
+  if (await verifyUserToken(jar.get(USER_COOKIE_NAME)?.value)) return true;
+  return false;
+}
+
+// src/auth/rate-limit.ts
+var WINDOW_MS = 15 * 60 * 1e3;
+var MAX_EMAIL_ATTEMPTS = 5;
+var MAX_IP_ATTEMPTS = 30;
+function scopeKey(kind, bucket, identifier) {
+  const normalized = bucket === "email" ? identifier.trim().toLowerCase() : identifier.trim();
+  return `${kind}:${bucket}:${normalized}`;
+}
+async function readScope(scope) {
+  return getDatabase().prepare(
+    `SELECT attempts, window_start FROM auth_rate_limits WHERE scope = ?`
+  ).bind(scope).first();
+}
+async function checkScoped(kind, bucket, identifier, maxAttempts) {
+  const scope = scopeKey(kind, bucket, identifier);
+  const row = await readScope(scope);
+  const now = Date.now();
+  if (!row) return { ok: true };
+  if (now - row.window_start >= WINDOW_MS) return { ok: true };
+  if (row.attempts >= maxAttempts) {
+    const retryAfterSec = Math.ceil(
+      (row.window_start + WINDOW_MS - now) / 1e3
+    );
+    return {
+      ok: false,
+      retryAfterSec: Math.max(retryAfterSec, 1),
+      scope: bucket
+    };
+  }
+  return { ok: true };
+}
+async function checkAuthRateLimit(kind, email) {
+  return checkScoped(kind, "email", email, MAX_EMAIL_ATTEMPTS);
+}
+async function enforceAuthRateLimits(kind, ctx) {
+  if (ctx.email) {
+    const emailLimit = await checkScoped(
+      kind,
+      "email",
+      ctx.email,
+      MAX_EMAIL_ATTEMPTS
+    );
+    if (!emailLimit.ok) return emailLimit;
+  }
+  if (ctx.ip) {
+    const ipLimit = await checkScoped(kind, "ip", ctx.ip, MAX_IP_ATTEMPTS);
+    if (!ipLimit.ok) return ipLimit;
+  }
+  return { ok: true };
+}
+async function recordScoped(kind, bucket, identifier) {
+  const scope = scopeKey(kind, bucket, identifier);
+  const now = Date.now();
+  const row = await readScope(scope);
+  if (!row || now - row.window_start >= WINDOW_MS) {
+    await getDatabase().prepare(
+      `INSERT INTO auth_rate_limits (scope, attempts, window_start)
+       VALUES (?, 1, ?)
+       ON CONFLICT(scope) DO UPDATE SET attempts = 1, window_start = excluded.window_start`
+    ).bind(scope, now).run();
+    return;
+  }
+  await getDatabase().prepare(
+    `UPDATE auth_rate_limits SET attempts = attempts + 1 WHERE scope = ?`
+  ).bind(scope).run();
+}
+async function recordAuthFailures(kind, ctx) {
+  if (ctx.email) await recordScoped(kind, "email", ctx.email);
+  if (ctx.ip) await recordScoped(kind, "ip", ctx.ip);
+}
+async function recordAuthFailure(kind, email) {
+  await recordScoped(kind, "email", email);
+}
+async function clearScoped(kind, bucket, identifier) {
+  await getDatabase().prepare(`DELETE FROM auth_rate_limits WHERE scope = ?`).bind(scopeKey(kind, bucket, identifier)).run();
+}
+async function clearAuthRateLimits(kind, ctx) {
+  if (ctx.email) await clearScoped(kind, "email", ctx.email);
+  if (ctx.ip) await clearScoped(kind, "ip", ctx.ip);
+}
+async function clearAuthRateLimit(kind, email) {
+  await clearScoped(kind, "email", email);
+}
+
+// src/auth/turnstile.ts
+var SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+async function getTurnstileRuntimeConfig() {
+  const pub = await getTurnstilePublicConfig();
+  const secretKey = workerEnv.TURNSTILE_SECRET_KEY?.trim();
+  if (!pub.enabled || !pub.siteKey || !secretKey) return null;
+  return { enabled: true, siteKey: pub.siteKey, secretKey };
+}
+async function verifyTurnstileToken(token, remoteIp) {
+  const config = await getTurnstileRuntimeConfig();
+  if (!config) {
+    console.error("[DEBUG-TURNSTILE] runtime config missing", {
+      tokenLength: token.length,
+      remoteIpPresent: Boolean(remoteIp)
+    });
+    return { ok: true };
+  }
+  if (!token) {
+    console.error("[DEBUG-TURNSTILE] missing token", {
+      siteKeySuffix: config.siteKey.slice(-6),
+      remoteIpPresent: Boolean(remoteIp)
+    });
+    return { ok: false, codes: ["missing-input-response"] };
+  }
+  const body = new URLSearchParams();
+  body.set("secret", config.secretKey);
+  body.set("response", token);
+  if (remoteIp) body.set("remoteip", remoteIp);
+  const res = await fetch(SITEVERIFY_URL, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!res.ok) {
+    console.error("[DEBUG-TURNSTILE] siteverify http error", {
+      siteKeySuffix: config.siteKey.slice(-6),
+      tokenLength: token.length,
+      status: res.status
+    });
+    return { ok: false, codes: [`http-${res.status}`] };
+  }
+  const data = await res.json();
+  if (data.success) return { ok: true };
+  console.error("[DEBUG-TURNSTILE] siteverify failed", {
+    siteKeySuffix: config.siteKey.slice(-6),
+    tokenLength: token.length,
+    codes: data["error-codes"] ?? ["verification-failed"]
+  });
+  return { ok: false, codes: data["error-codes"] ?? ["verification-failed"] };
+}
+async function verifyTurnstileFromForm(formData, remoteIp) {
+  const token = String(formData.get("cf-turnstile-response") ?? "").trim();
+  console.error("[DEBUG-TURNSTILE] form token read", {
+    tokenLength: token.length,
+    remoteIpPresent: Boolean(remoteIp)
+  });
+  const result = await verifyTurnstileToken(token, remoteIp);
+  return result.ok ? { ok: true } : { ok: false };
+}
+export {
+  ADMIN_COOKIE,
+  USER_COOKIE,
+  authenticateEmailUser,
+  changeUserPassword,
+  checkAuthRateLimit,
+  checkPassword,
+  clearAuthRateLimit,
+  clearAuthRateLimits,
+  clearSessionCookie,
+  clearUserSessionCookie,
+  createAuth,
+  createEmailUser,
+  deleteUserAccount,
+  enforceAuthRateLimits,
+  getAuthViewer,
+  getCurrentUser,
+  getTurnstileRuntimeConfig,
+  getUserByEmail,
+  getUserById,
+  hashPassword,
+  isAuthenticated,
+  issuePasswordResetToken,
+  issueVerificationToken,
+  listUsers,
+  listUsersWithPostCounts,
+  normalizeUserRole,
+  recordAuthFailure,
+  recordAuthFailures,
+  resetPasswordWithToken,
+  revokeUserSessions,
+  setSessionCookie,
+  setUserRole,
+  setUserSessionCookie,
+  signUserToken,
+  upsertGoogleUser,
+  userToSession,
+  validatePasswordStrength,
+  verifyEmailUser,
+  verifyPassword,
+  verifyTurnstileFromForm,
+  verifyTurnstileToken,
+  verifyUserToken
+};
+//# sourceMappingURL=index.js.map