@setzkasten-cms/astro-admin 1.4.2 → 1.5.0

package/dist/chunk-KENFINT4.js

@@ -0,0 +1,76 @@
+// src/api-routes/_session-signing.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SEPARATOR = ".";
+function base64urlEncode(input) {
+  const buf = typeof input === "string" ? Buffer.from(input, "utf-8") : input;
+  return buf.toString("base64url");
+}
+function base64urlDecode(input) {
+  if (!/^[A-Za-z0-9_-]+$/.test(input)) return null;
+  try {
+    return Buffer.from(input, "base64url");
+  } catch {
+    return null;
+  }
+}
+function hmac(payload, secret) {
+  return createHmac("sha256", secret).update(payload).digest();
+}
+function signSession(session, secret) {
+  if (typeof secret !== "string" || secret.trim().length === 0) {
+    throw new Error("signSession: missing secret");
+  }
+  const json = JSON.stringify(session);
+  const payloadB64 = base64urlEncode(json);
+  const sigB64 = hmac(payloadB64, secret).toString("base64url");
+  return `${payloadB64}${SEPARATOR}${sigB64}`;
+}
+function verifySessionCookie(raw, secret, now = Date.now()) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (typeof secret !== "string" || secret.trim().length === 0) {
+    return { ok: false, reason: "malformed" };
+  }
+  const segments = raw.split(SEPARATOR);
+  if (segments.length !== 2) return { ok: false, reason: "malformed" };
+  const [payloadB64, sigB64] = segments;
+  if (!payloadB64 || !sigB64) return { ok: false, reason: "malformed" };
+  const expected = hmac(payloadB64, secret);
+  const actual = base64urlDecode(sigB64);
+  if (!actual) return { ok: false, reason: "malformed" };
+  if (actual.length !== expected.length) return { ok: false, reason: "bad-signature" };
+  if (!timingSafeEqual(actual, expected)) return { ok: false, reason: "bad-signature" };
+  const payloadBuf = base64urlDecode(payloadB64);
+  if (!payloadBuf) return { ok: false, reason: "malformed" };
+  let parsed;
+  try {
+    parsed = JSON.parse(payloadBuf.toString("utf-8"));
+  } catch {
+    return { ok: false, reason: "invalid-payload" };
+  }
+  if (!isAuthSessionShape(parsed)) {
+    return { ok: false, reason: "invalid-payload" };
+  }
+  if (typeof parsed.expiresAt !== "number" || !Number.isFinite(parsed.expiresAt)) {
+    return { ok: false, reason: "missing-expiry" };
+  }
+  if (parsed.expiresAt <= now) {
+    return { ok: false, reason: "expired" };
+  }
+  return { ok: true, value: parsed };
+}
+function isAuthSessionShape(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  if (!v.user || typeof v.user !== "object") return false;
+  const u = v.user;
+  if (typeof u.email !== "string" || u.email.length === 0) return false;
+  if (u.role !== "admin" && u.role !== "editor") return false;
+  return true;
+}
+
+export {
+  signSession,
+  verifySessionCookie
+};

package/dist/chunk-ONP6BRZO.js

@@ -0,0 +1,47 @@
+// src/api-routes/_dev-session-secret.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+var DEV_SECRET_DIR = ".setzkasten";
+var DEV_SECRET_FILE = "dev-secret";
+var cachedSecret = null;
+function ensureDevSessionSecret() {
+  if (cachedSecret) return cachedSecret;
+  const dir = join(process.cwd(), DEV_SECRET_DIR);
+  const file = join(dir, DEV_SECRET_FILE);
+  if (existsSync(file)) {
+    const content = readFileSync(file, "utf-8").trim();
+    if (content.length >= 32) {
+      cachedSecret = content;
+      return content;
+    }
+  }
+  mkdirSync(dir, { recursive: true });
+  const fresh = randomBytes(32).toString("hex");
+  try {
+    writeFileSync(file, `${fresh}
+`, { flag: "wx", mode: 384 });
+  } catch (cause) {
+    if (cause?.code === "EEXIST") {
+      const content = readFileSync(file, "utf-8").trim();
+      if (content.length >= 32) {
+        cachedSecret = content;
+        return content;
+      }
+    }
+    throw cause;
+  }
+  console.warn(
+    `[setzkasten] Generated dev session secret at ${file} (mode 0600). Set SETZKASTEN_SESSION_SECRET in production. Delete the file to rotate.`
+  );
+  cachedSecret = fresh;
+  return fresh;
+}
+function __setDevSessionSecretForTests(secret) {
+  cachedSecret = secret;
+}
+
+export {
+  ensureDevSessionSecret,
+  __setDevSessionSecretForTests
+};

package/dist/{chunk-INIWFKQ3.js → chunk-Q5HV47DW.js}

@@ -1,3 +1,9 @@
+import {
+  resolveSessionSecret
+} from "./chunk-QVCW6EF3.js";
+import {
+  verifySessionCookie
+} from "./chunk-KENFINT4.js";
 import {
   resolveStorageConfig
 } from "./chunk-6UIKVKED.js";
@@ -10,17 +16,21 @@ import {
 } from "./chunk-45ARVNT3.js";
 import {
   resolveConfigRepoToken
-} from "./chunk-NKDATSPA.js";
+} from "./chunk-DP6RTINQ.js";
 import {
   withTrailers
 } from "./chunk-KH22FJO5.js";
 
+// src/api-routes/editors.ts
+import { validateEditorsUpdate } from "@setzkasten-cms/core";
+
 // src/api-routes/_auth-guard.ts
 import { canEditPage } from "@setzkasten-cms/auth";
 function parseSession(raw) {
   if (!raw) return null;
   try {
-    return JSON.parse(raw);
+    const result = verifySessionCookie(raw, resolveSessionSecret());
+    return result.ok ? result.value : null;
   } catch {
     return null;
   }
@@ -45,10 +55,9 @@ async function guardPageAccess(session, pageKey, fullConfig, request) {
   if (!session) return new Response("Unauthorized", { status: 401 });
   const editorsLookup = await resolveDynamicEditors();
   if (!editorsLookup.ok) {
-    return new Response(
-      `Forbidden: editor permissions unavailable (${editorsLookup.error})`,
-      { status: 503 }
-    );
+    return new Response(`Forbidden: editor permissions unavailable (${editorsLookup.error})`, {
+      status: 503
+    });
   }
   if (!canEditPage(session, pageKey, editorsLookup.editors)) {
     return new Response("Forbidden: you do not have access to this page", { status: 403 });
@@ -65,13 +74,15 @@ async function guardWebsiteAccess(session, request) {
   const website = await resolveCurrentWebsite(request);
   if (!website.ok) return null;
   const allowed = website.value.allowedEmails;
-  if (!allowed || allowed.length === 0) return null;
-  if (!allowed.includes(session.user.email)) {
+  if (!allowed || allowed.length === 0) {
     return new Response(
-      `Forbidden: not allowed on website "${website.value.id}"`,
+      `Forbidden: website "${website.value.id}" has no editor allow-list \u2014 add the editor's email to allowedEmails or grant admin role`,
       { status: 403 }
     );
   }
+  if (!allowed.includes(session.user.email)) {
+    return new Response(`Forbidden: not allowed on website "${website.value.id}"`, { status: 403 });
+  }
   return null;
 }
 async function resolveDynamicEditors() {
@@ -96,7 +107,6 @@ async function resolveDynamicEditors() {
 }
 
 // src/api-routes/editors.ts
-import { validateEditorsUpdate } from "@setzkasten-cms/core";
 var EDITORS_FILE = (contentPath) => `${contentPath}/_editors.json`;
 function configRepoStorage() {
   const storage = resolveStorageConfig();
@@ -138,10 +148,7 @@ var PUT = async ({ request, cookies }) => {
   }
   const validation = validateEditorsUpdate(editors, session.user.email);
   if (!validation.ok) {
-    return Response.json(
-      { error: validation.message, code: validation.code },
-      { status: 400 }
-    );
+    return Response.json({ error: validation.message, code: validation.code }, { status: 400 });
   }
   const filePath = EDITORS_FILE(contentPath);
   const fileContent = JSON.stringify(editors, null, 2);
@@ -158,10 +165,11 @@ var PUT = async ({ request, cookies }) => {
     branch
   };
   if (existing) body.sha = existing;
-  const res = await fetch(
-    `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`,
-    { method: "PUT", headers, body: JSON.stringify(body) }
-  );
+  const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body)
+  });
   if (!res.ok) {
     const text = await res.text();
     return Response.json({ error: `GitHub write failed: ${text}` }, { status: 502 });
@@ -187,7 +195,13 @@ async function readEditorsFile(owner, repo, branch, contentPath, token) {
   return cachedFetch(key, 2 * 6e4, async () => {
     const res = await fetch(
       `https://api.github.com/repos/${owner}/${repo}/contents/${EDITORS_FILE(contentPath)}?ref=${branch}`,
-      { headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" } }
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28"
+        }
+      }
     );
     if (!res.ok) return null;
     const data = await res.json();

package/dist/chunk-QVCW6EF3.js

@@ -0,0 +1,26 @@
+import {
+  ensureDevSessionSecret
+} from "./chunk-ONP6BRZO.js";
+
+// src/api-routes/_session-secret.ts
+var MIN_SECRET_LENGTH = 32;
+function resolveSessionSecret() {
+  const fromEnv = process.env.SETZKASTEN_SESSION_SECRET;
+  if (typeof fromEnv === "string" && fromEnv.trim().length >= MIN_SECRET_LENGTH) {
+    return fromEnv.trim();
+  }
+  const fromBuild = globalThis.__SETZKASTEN_BUILD_CONFIG__;
+  if (typeof fromBuild?.sessionSecret === "string" && fromBuild.sessionSecret.trim().length >= MIN_SECRET_LENGTH) {
+    return fromBuild.sessionSecret.trim();
+  }
+  if (process.env.NODE_ENV === "production") {
+    throw new Error(
+      "SETZKASTEN_SESSION_SECRET is missing or too short (need \u226532 chars). Generate one with `openssl rand -hex 32` and set it as an env var."
+    );
+  }
+  return ensureDevSessionSecret();
+}
+
+export {
+  resolveSessionSecret
+};