@setzkasten-cms/astro-admin 1.4.6 → 1.5.0

package/dist/{chunk-INIWFKQ3.js → chunk-Q5HV47DW.js}

@@ -1,3 +1,9 @@
+import {
+  resolveSessionSecret
+} from "./chunk-QVCW6EF3.js";
+import {
+  verifySessionCookie
+} from "./chunk-KENFINT4.js";
 import {
   resolveStorageConfig
 } from "./chunk-6UIKVKED.js";
@@ -10,17 +16,21 @@ import {
 } from "./chunk-45ARVNT3.js";
 import {
   resolveConfigRepoToken
-} from "./chunk-NKDATSPA.js";
+} from "./chunk-DP6RTINQ.js";
 import {
   withTrailers
 } from "./chunk-KH22FJO5.js";
 
+// src/api-routes/editors.ts
+import { validateEditorsUpdate } from "@setzkasten-cms/core";
+
 // src/api-routes/_auth-guard.ts
 import { canEditPage } from "@setzkasten-cms/auth";
 function parseSession(raw) {
   if (!raw) return null;
   try {
-    return JSON.parse(raw);
+    const result = verifySessionCookie(raw, resolveSessionSecret());
+    return result.ok ? result.value : null;
   } catch {
     return null;
   }
@@ -45,10 +55,9 @@ async function guardPageAccess(session, pageKey, fullConfig, request) {
   if (!session) return new Response("Unauthorized", { status: 401 });
   const editorsLookup = await resolveDynamicEditors();
   if (!editorsLookup.ok) {
-    return new Response(
-      `Forbidden: editor permissions unavailable (${editorsLookup.error})`,
-      { status: 503 }
-    );
+    return new Response(`Forbidden: editor permissions unavailable (${editorsLookup.error})`, {
+      status: 503
+    });
   }
   if (!canEditPage(session, pageKey, editorsLookup.editors)) {
     return new Response("Forbidden: you do not have access to this page", { status: 403 });
@@ -65,13 +74,15 @@ async function guardWebsiteAccess(session, request) {
   const website = await resolveCurrentWebsite(request);
   if (!website.ok) return null;
   const allowed = website.value.allowedEmails;
-  if (!allowed || allowed.length === 0) return null;
-  if (!allowed.includes(session.user.email)) {
+  if (!allowed || allowed.length === 0) {
     return new Response(
-      `Forbidden: not allowed on website "${website.value.id}"`,
+      `Forbidden: website "${website.value.id}" has no editor allow-list \u2014 add the editor's email to allowedEmails or grant admin role`,
       { status: 403 }
     );
   }
+  if (!allowed.includes(session.user.email)) {
+    return new Response(`Forbidden: not allowed on website "${website.value.id}"`, { status: 403 });
+  }
   return null;
 }
 async function resolveDynamicEditors() {
@@ -96,7 +107,6 @@ async function resolveDynamicEditors() {
 }
 
 // src/api-routes/editors.ts
-import { validateEditorsUpdate } from "@setzkasten-cms/core";
 var EDITORS_FILE = (contentPath) => `${contentPath}/_editors.json`;
 function configRepoStorage() {
   const storage = resolveStorageConfig();
@@ -138,10 +148,7 @@ var PUT = async ({ request, cookies }) => {
   }
   const validation = validateEditorsUpdate(editors, session.user.email);
   if (!validation.ok) {
-    return Response.json(
-      { error: validation.message, code: validation.code },
-      { status: 400 }
-    );
+    return Response.json({ error: validation.message, code: validation.code }, { status: 400 });
   }
   const filePath = EDITORS_FILE(contentPath);
   const fileContent = JSON.stringify(editors, null, 2);
@@ -158,10 +165,11 @@ var PUT = async ({ request, cookies }) => {
     branch
   };
   if (existing) body.sha = existing;
-  const res = await fetch(
-    `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`,
-    { method: "PUT", headers, body: JSON.stringify(body) }
-  );
+  const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body)
+  });
   if (!res.ok) {
     const text = await res.text();
     return Response.json({ error: `GitHub write failed: ${text}` }, { status: 502 });
@@ -187,7 +195,13 @@ async function readEditorsFile(owner, repo, branch, contentPath, token) {
   return cachedFetch(key, 2 * 6e4, async () => {
     const res = await fetch(
       `https://api.github.com/repos/${owner}/${repo}/contents/${EDITORS_FILE(contentPath)}?ref=${branch}`,
-      { headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" } }
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28"
+        }
+      }
     );
     if (!res.ok) return null;
     const data = await res.json();

package/dist/chunk-QVCW6EF3.js

@@ -0,0 +1,26 @@
+import {
+  ensureDevSessionSecret
+} from "./chunk-ONP6BRZO.js";
+
+// src/api-routes/_session-secret.ts
+var MIN_SECRET_LENGTH = 32;
+function resolveSessionSecret() {
+  const fromEnv = process.env.SETZKASTEN_SESSION_SECRET;
+  if (typeof fromEnv === "string" && fromEnv.trim().length >= MIN_SECRET_LENGTH) {
+    return fromEnv.trim();
+  }
+  const fromBuild = globalThis.__SETZKASTEN_BUILD_CONFIG__;
+  if (typeof fromBuild?.sessionSecret === "string" && fromBuild.sessionSecret.trim().length >= MIN_SECRET_LENGTH) {
+    return fromBuild.sessionSecret.trim();
+  }
+  if (process.env.NODE_ENV === "production") {
+    throw new Error(
+      "SETZKASTEN_SESSION_SECRET is missing or too short (need \u226532 chars). Generate one with `openssl rand -hex 32` and set it as an env var."
+    );
+  }
+  return ensureDevSessionSecret();
+}
+
+export {
+  resolveSessionSecret
+};