@startup-api/cloudflare 0.0.1

package/src/handlers/admin.ts

@@ -0,0 +1,144 @@
+import { StartupAPIEnv } from '../StartupAPIEnv';
+import { CookieManager } from '../CookieManager';
+import { getUserFromSession, checkAndClearStaleSession, isAdmin, parseCookies, getActiveProviders } from './utils';
+import { Plan } from '../billing/Plan';
+import { UserProfileSchema } from '../schemas/user';
+import { SystemAccountSchema, MemberSchema } from '../schemas/account';
+import { ImpersonateSchema } from '../schemas/admin';
+
+export async function handleAdmin(
+  request: Request,
+  env: StartupAPIEnv,
+  usersPath: string,
+  cookieManager: CookieManager,
+): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user || !isAdmin(user, env)) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Forbidden', { status: 403 }));
+  }
+
+  const url = new URL(request.url);
+  const path = url.pathname.replace(usersPath + 'admin', '');
+
+  if (path === '/' || path === '') {
+    url.pathname = '/users/admin/';
+    const newRequest = new Request(url.toString(), request);
+    newRequest.headers.set('x-skip-worker', 'true');
+    const response = await env.ASSETS.fetch(newRequest);
+    if (!response.ok) return response;
+
+    let html = await response.text();
+    html = html.replace(/\{\{ssr:([a-z0-9_]+)\}\}/g, (match, key) => {
+      const replacements: Record<string, string> = {
+        plans_json: JSON.stringify(Plan.getAll()).replace(/"/g, '&quot;'),
+        providers: getActiveProviders(env).join(','),
+      };
+      return replacements[key] !== undefined ? replacements[key] : match;
+    });
+
+    return new Response(html, {
+      headers: { 'Content-Type': 'text/html' },
+    });
+  }
+
+  const systemStub = env.SYSTEM.get(env.SYSTEM.idFromName('global'));
+
+  if (path.startsWith('/api/')) {
+    try {
+      const apiPath = path.replace('/api/', '');
+      const parts = apiPath.split('/');
+
+      if (parts[0] === 'users') {
+        if (parts.length === 1 && request.method === 'GET') {
+          return Response.json(await systemStub.listUsers(url.searchParams.get('q') || undefined));
+        }
+        if (parts.length === 2) {
+          const userId = parts[1];
+          if (request.method === 'GET') return Response.json(await systemStub.getUser(userId));
+          if (request.method === 'DELETE') return Response.json(await systemStub.deleteUser(userId));
+          if (request.method === 'PATCH' || request.method === 'PUT') {
+            const data = await request.json();
+            const validatedData = UserProfileSchema.partial().parse(data);
+            return Response.json(await systemStub.updateUser(userId, validatedData));
+          }
+        }
+        if (parts.length === 3 && parts[2] === 'memberships' && request.method === 'GET') {
+          const userId = parts[1];
+          return Response.json(await systemStub.getUserMemberships(userId));
+        }
+      } else if (parts[0] === 'accounts') {
+        if (parts.length === 1) {
+          if (request.method === 'GET') return Response.json(await systemStub.listAccounts(url.searchParams.get('q') || undefined));
+          if (request.method === 'POST') {
+            const data = await request.json();
+            const validatedData = SystemAccountSchema.parse(data);
+            return Response.json(await systemStub.registerAccount(validatedData));
+          }
+        }
+        if (parts.length === 2) {
+          const accountId = parts[1];
+          if (request.method === 'GET') return Response.json(await systemStub.getAccount(accountId));
+          if (request.method === 'PUT') {
+            const data = await request.json();
+            const validatedData = SystemAccountSchema.partial().parse(data);
+            return Response.json(await systemStub.updateAccount(accountId, validatedData));
+          }
+          if (request.method === 'DELETE') return Response.json(await systemStub.deleteAccount(accountId));
+        }
+        if (parts.length >= 3 && parts[2] === 'members') {
+          const accountId = parts[1];
+          const accountStub = env.ACCOUNT.get(env.ACCOUNT.idFromString(accountId));
+          if (parts.length === 3) {
+            if (request.method === 'GET') return Response.json(await accountStub.getMembers());
+            if (request.method === 'POST') {
+              const data = await request.json();
+              const { user_id, role } = MemberSchema.parse(data);
+              return Response.json(await accountStub.addMember(user_id, role));
+            }
+          } else if (parts.length === 4 && request.method === 'DELETE') {
+            return Response.json(await accountStub.removeMember(parts[3]));
+          }
+        }
+      } else if (parts[0] === 'impersonate' && request.method === 'POST') {
+        const body = await request.json();
+        const data = ImpersonateSchema.parse(body);
+        const user_id = data.user_id || data.userId;
+        if (!user_id) return new Response('Missing user_id', { status: 400 });
+
+        if (user_id === user.id) {
+          return new Response('Cannot impersonate yourself', { status: 400 });
+        }
+
+        const userDOId = env.USER.idFromString(user_id);
+        const userStub = env.USER.get(userDOId);
+        const session = await userStub.createSession({ provider: 'admin-impersonation', impersonator: user.id });
+
+        const cookieHeader = request.headers.get('Cookie');
+        const cookies = parseCookies(cookieHeader || '');
+        const currentSessionEncrypted = cookies['session_id'];
+
+        const headers = new Headers();
+        const newSessionIdEncrypted = await cookieManager.encrypt(`${session.sessionId}:${user_id}`);
+        headers.set('Set-Cookie', `session_id=${newSessionIdEncrypted}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+        if (currentSessionEncrypted) {
+          const backupSession = await cookieManager.decrypt(currentSessionEncrypted);
+          if (backupSession) {
+            const backupSessionEncrypted = await cookieManager.encrypt(backupSession);
+            headers.append('Set-Cookie', `backup_session_id=${backupSessionEncrypted}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+          }
+        }
+
+        return Response.json({ success: true }, { headers });
+      }
+
+      return new Response('Not Found', { status: 404 });
+    } catch (e) {
+      return new Response(e instanceof Error ? e.message : String(e), { status: 400 });
+    }
+  }
+
+  url.pathname = '/users/admin' + path;
+  const newRequest = new Request(url.toString(), request);
+  newRequest.headers.set('x-skip-worker', 'true');
+  return env.ASSETS.fetch(newRequest);
+}

package/src/handlers/auth.ts

@@ -0,0 +1,54 @@
+import { StartupAPIEnv } from '../StartupAPIEnv';
+import { CookieManager } from '../CookieManager';
+import { parseCookies } from './utils';
+
+export async function handleLogout(
+  request: Request,
+  env: StartupAPIEnv,
+  url: URL,
+  usersPath: string,
+  cookieManager: CookieManager,
+): Promise<Response> {
+  const cookieHeader = request.headers.get('Cookie');
+  if (cookieHeader) {
+    const cookies = parseCookies(cookieHeader);
+    const sessionCookieEncrypted = cookies['session_id'];
+
+    if (sessionCookieEncrypted) {
+      const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
+      if (sessionCookie && sessionCookie.includes(':')) {
+        const [sessionId, doId] = sessionCookie.split(':');
+        try {
+          const id = env.USER.idFromString(doId);
+          const stub = env.USER.get(id);
+          await stub.deleteSession(sessionId);
+        } catch (_e) {
+          console.error('Error deleting session:', _e);
+          // Continue to clear cookie even if DO call fails
+        }
+      }
+    }
+  }
+
+  const headers = new Headers();
+  headers.set('Set-Cookie', 'session_id=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0');
+
+  let redirectUrl = '/';
+  const returnUrl = url.searchParams.get('return_url');
+  if (returnUrl) {
+    const origin = env.AUTH_ORIGIN && env.AUTH_ORIGIN !== '' ? env.AUTH_ORIGIN : url.origin;
+    try {
+      const parsedReturn = new URL(returnUrl, origin);
+      if (parsedReturn.origin === origin) {
+        redirectUrl = parsedReturn.toString();
+      }
+    } catch (_e) {
+      if (returnUrl.startsWith('/')) {
+        redirectUrl = returnUrl;
+      }
+    }
+  }
+
+  headers.set('Location', redirectUrl);
+  return new Response(null, { status: 302, headers });
+}

package/src/handlers/ssr.ts

@@ -0,0 +1,274 @@
+import { StartupAPIEnv } from '../StartupAPIEnv';
+import { CookieManager } from '../CookieManager';
+import { getUserFromSession, checkAndClearStaleSession, isAdmin, getActiveProviders } from './utils';
+import { Plan } from '../billing/Plan';
+
+export async function handleSSR(
+  request: Request,
+  env: StartupAPIEnv,
+  url: URL,
+  usersPath: string,
+  cookieManager: CookieManager,
+): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, Response.redirect(url.origin + '/', 302));
+  }
+
+  const { id: doId, sessionId: _sessionId, profile: initialProfile, credential } = user;
+
+  try {
+    const id = env.USER.idFromString(doId);
+    const userStub = env.USER.get(id);
+
+    // Get HTML from assets
+    const assetUrl = new URL(url.toString());
+    assetUrl.pathname = url.pathname.replace(usersPath, '/users/');
+    const assetRequest = new Request(assetUrl.toString(), request);
+    assetRequest.headers.set('x-skip-worker', 'true');
+    let assetResponse = await env.ASSETS.fetch(assetRequest);
+
+    // Follow one level of redirect if needed (e.g. for canonical URLs)
+    if (assetResponse.status === 301 || assetResponse.status === 302) {
+      const location = assetResponse.headers.get('Location');
+      if (location) {
+        const followUrl = new URL(location, assetUrl.toString());
+        const followRequest = new Request(followUrl.toString(), request);
+        followRequest.headers.set('x-skip-worker', 'true');
+        assetResponse = await env.ASSETS.fetch(followRequest);
+      }
+    }
+
+    if (!assetResponse.ok) {
+      return assetResponse;
+    }
+
+    let html = await assetResponse.text();
+
+    const data: any = {
+      valid: true,
+      profile: { ...initialProfile },
+      credential,
+    };
+
+    const image = await userStub.getImage('avatar');
+    if (image) {
+      const usersPathNormalized = usersPath.endsWith('/') ? usersPath : usersPath + '/';
+      data.profile.picture = usersPathNormalized + 'me/avatar';
+    } else {
+      data.profile.picture = null;
+    }
+
+    data.is_admin = isAdmin({ id: doId, profile: data.profile, credential }, env);
+
+    // Fetch memberships to find current account
+    const memberships = await userStub.getMemberships();
+    const currentMembership = memberships.find((m: any) => m.is_current) || memberships[0];
+
+    // Fetch credentials
+    const credentials = await userStub.listCredentials();
+
+    let account = null;
+    let accountMembers = null;
+    if (currentMembership) {
+      const accountId = env.ACCOUNT.idFromString(currentMembership.account_id);
+      const accountStub = env.ACCOUNT.get(accountId);
+      const accountInfo = await accountStub.getInfo();
+      const billing = await accountStub.getBillingInfo();
+      account = {
+        ...accountInfo,
+        billing,
+        id: currentMembership.account_id,
+        role: currentMembership.role,
+      };
+      // Fetch members only if it's the accounts page or if needed
+      if (url.pathname.endsWith('/accounts.html') || url.pathname.endsWith('/accounts')) {
+        accountMembers = await accountStub.getMembers();
+      }
+    }
+
+    // Prepare SSR values
+    const replacements: Record<string, string> = {
+      plans_json: JSON.stringify(Plan.getAll()).replace(/"/g, '&quot;'),
+      providers: getActiveProviders(env).join(','),
+      profile_json: JSON.stringify(data).replace(/"/g, '&quot;'),
+      credentials_json: JSON.stringify(credentials).replace(/"/g, '&quot;'),
+      profile_name: data.profile.name || 'Anonymous',
+      profile_id: doId,
+      profile_email: data.profile.email || '',
+      profile_picture: data.profile.picture || '',
+      profile_picture_display: data.profile.picture ? 'display: block;' : 'display: none;',
+      profile_placeholder_display: data.profile.picture ? 'display: none;' : 'display: flex;',
+      profile_remove_btn_display: data.profile.picture ? 'display: flex;' : 'display: none;',
+      profile_provider_label: data.profile.provider
+        ? `(from ${data.profile.provider.charAt(0).toUpperCase() + data.profile.provider.slice(1)})`
+        : '',
+      nav_account_display: account && (account.role === 1 || data.is_admin) ? 'display: block;' : 'display: none;',
+      credentials_list_html: renderCredentialsList(credentials, data.credential?.provider),
+      link_credentials_html: renderLinkCredentialsList(getActiveProviders(env), url.href),
+    };
+
+    if (account) {
+      replacements['account_json'] = JSON.stringify(account).replace(/"/g, '&quot;');
+      replacements['account_name'] = account.name || 'Account';
+      replacements['account_id'] = account.id;
+
+      const allPlans = Plan.getAll();
+      if (allPlans.length <= 1) {
+        replacements['account_plan_name'] = '';
+      } else {
+        replacements['account_plan_name'] = account.billing?.plan_details?.name || account.billing?.state?.plan_slug || 'free';
+      }
+
+      const accountAvatar = await env.ACCOUNT.get(env.ACCOUNT.idFromString(account.id)).getImage('avatar');
+      const usersPathNormalized = usersPath.endsWith('/') ? usersPath : usersPath + '/';
+      const accountPicture = accountAvatar ? `${usersPathNormalized}api/me/accounts/${account.id}/avatar` : null;
+
+      replacements['account_picture'] = accountPicture || '';
+      replacements['account_picture_display'] = accountPicture ? 'display: block;' : 'display: none;';
+      replacements['account_placeholder_display'] = accountPicture ? 'display: none;' : 'display: flex;';
+      replacements['account_remove_btn_display'] = accountPicture ? 'display: flex;' : 'display: none;';
+
+      const isAccountAdmin = account.role === 1 || data.is_admin;
+      replacements['account_info_section_display'] = isAccountAdmin ? 'display: block;' : 'display: none;';
+      replacements['account_members_section_display'] = isAccountAdmin ? 'display: block;' : 'display: none;';
+
+      if (accountMembers) {
+        replacements['account_members_json'] = JSON.stringify(accountMembers).replace(/"/g, '&quot;');
+        replacements['account_members_list_html'] = renderAccountMembersList(accountMembers, doId);
+      } else {
+        replacements['account_members_json'] = '[]';
+        replacements['account_members_list_html'] = '<p>Loading members...</p>';
+      }
+    } else {
+      replacements['account_json'] = 'null';
+      replacements['account_name'] = '';
+      replacements['account_id'] = '';
+      replacements['account_plan_name'] = '';
+      replacements['account_picture'] = '';
+      replacements['account_picture_display'] = 'display: none;';
+      replacements['account_placeholder_display'] = 'display: flex;';
+      replacements['account_remove_btn_display'] = 'display: none;';
+      replacements['account_info_section_display'] = 'display: none;';
+      replacements['account_members_section_display'] = 'display: none;';
+      replacements['account_members_json'] = '[]';
+      replacements['account_members_list_html'] = '';
+    }
+
+    html = renderSSR(html, replacements);
+
+    return new Response(html, {
+      headers: {
+        'Content-Type': 'text/html',
+      },
+    });
+  } catch (e) {
+    console.error('[handleSSR] Error:', e instanceof Error ? e.message : String(e), e instanceof Error ? e.stack : '');
+    return new Response(`Error rendering page: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+  }
+}
+
+function renderSSR(html: string, replacements: Record<string, string>): string {
+  return html.replace(/\{\{ssr:([a-z0-9_]+)\}\}/g, (match, key) => {
+    return replacements[key] !== undefined ? replacements[key] : match;
+  });
+}
+
+function renderCredentialsList(credentials: any[], currentProvider?: string): string {
+  if (!credentials || credentials.length === 0) {
+    return '<p>No credentials linked.</p>';
+  }
+
+  return credentials
+    .map((c) => {
+      const isCurrent = c.provider === currentProvider;
+      return `
+      <div class="credential-item ${isCurrent ? 'active' : ''}">
+        <div class="credential-info">
+          <div class="provider-icon">
+            ${getProviderIcon(c.provider)}
+          </div>
+          <div>
+            <div style="font-weight: 600;">
+              ${c.provider.charAt(0).toUpperCase() + c.provider.slice(1)}
+              ${isCurrent ? '<span class="current-badge">logged in</span>' : ''}
+            </div>
+            <div style="font-size: 0.8rem; color: #666;">${c.email || c.subject_id}</div>
+          </div>
+        </div>
+        <button class="remove-btn" onclick="removeCredential('${c.provider}')" ${isCurrent || credentials.length === 1 ? 'disabled title="' + (isCurrent ? 'Cannot remove the method you are currently logged in with' : 'Cannot remove your last login method') + '"' : ''}>
+          Remove
+        </button>
+      </div>
+    `;
+    })
+    .join('');
+}
+
+function getProviderIcon(provider: string): string {
+  if (provider === 'google') {
+    return '<svg viewBox="0 0 24 24" width="24" height="24"><path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4"/><path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853"/><path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l3.66-2.84z" fill="#FBBC05"/><path d="M12 5.38c1.62 0 3.06.56 4.21 1.66l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335"/></svg>';
+  } else if (provider === 'twitch') {
+    return '<svg viewBox="0 0 24 24" width="24" height="24" class="twitch-icon"><path d="M11.571 4.714h1.715v5.143H11.57zm4.715 0H18v5.143h-1.714zM6 0L1.714 4.286v15.428h5.143V24l4.286-4.286h3.428L22.286 12V0zm14.571 11.143l-3.428 3.428h-3.429l-3 3v-3H6.857V1.714h13.714z" fill="currentColor"/></svg>';
+  }
+  return '';
+}
+
+function renderLinkCredentialsList(providers: string[], returnUrl?: string): string {
+  if (providers.length === 0) {
+    return '';
+  }
+
+  const query = returnUrl ? `?return_url=${encodeURIComponent(returnUrl)}` : '';
+
+  return providers
+    .map((provider) => {
+      return `
+      <a href="/users/auth/${provider}${query}" class="link-account-btn ${provider}">
+        ${getProviderIcon(provider).replace('width="24" height="24"', 'width="20" height="20"')}
+        ${provider.charAt(0).toUpperCase() + provider.slice(1)}
+      </a>
+    `;
+    })
+    .join('');
+}
+
+function renderAccountMembersList(members: any[], currentUserId: string): string {
+  if (!members || members.length === 0) {
+    return '<p>No members found.</p>';
+  }
+
+  return members
+    .map((m) => {
+      const isSelf = m.user_id === currentUserId;
+      const avatarContent = m.picture
+        ? `<img src="${m.picture}" class="member-avatar" alt="${m.name}" />`
+        : `<div class="member-avatar">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"></path>
+                <circle cx="12" cy="7" r="4"></circle>
+            </svg>
+           </div>`;
+
+      return `
+      <div class="member-item">
+        <div class="member-info">
+          ${avatarContent}
+          <div class="member-details">
+            <div class="member-name" title="${m.name}${isSelf ? ' (You)' : ''}">${m.name} ${isSelf ? '(You)' : ''}</div>
+            <div class="member-role">
+              <select onchange="updateRole('${m.user_id}', this.value)" ${isSelf ? 'disabled title="You cannot change your own role"' : ''} class="role-select">
+                <option value="0" ${m.role === 0 ? 'selected' : ''}>Member</option>
+                <option value="1" ${m.role === 1 ? 'selected' : ''}>Admin</option>
+              </select>
+            </div>
+          </div>
+        </div>
+        <button class="remove-btn" onclick="removeMember('${m.user_id}')" ${isSelf ? 'disabled title="You cannot remove yourself"' : ''}>
+          Remove
+        </button>
+      </div>
+    `;
+    })
+    .join('');
+}

package/src/handlers/user.ts

@@ -0,0 +1,168 @@
+import { StartupAPIEnv } from '../StartupAPIEnv';
+import { CookieManager } from '../CookieManager';
+import { getUserFromSession, checkAndClearStaleSession, parseCookies, isAdmin } from './utils';
+import { Plan } from '../billing/Plan';
+import { UserProfileSchema } from '../schemas/user';
+import { DeleteCredentialSchema } from '../schemas/credential';
+
+const DEFAULT_USERS_PATH = '/users/';
+
+export async function handleMe(request: Request, env: StartupAPIEnv, cookieManager: CookieManager): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  const { id: doId, profile: initialProfile, credential } = user;
+
+  try {
+    const id = env.USER.idFromString(doId);
+    const userStub = env.USER.get(id);
+
+    const data: any = {
+      valid: true,
+      profile: { ...initialProfile },
+      credential,
+      plans: Plan.getAll(),
+    };
+
+    const image = await userStub.getImage('avatar');
+    if (image) {
+      const usersPath = env.USERS_PATH || DEFAULT_USERS_PATH;
+      data.profile.picture = usersPath + 'me/avatar';
+    } else {
+      data.profile.picture = null;
+    }
+
+    data.is_admin = isAdmin({ id: doId, profile: data.profile, credential }, env);
+
+    const cookieHeader = request.headers.get('Cookie') || '';
+    const cookies = parseCookies(cookieHeader);
+    data.is_impersonated = !!cookies['backup_session_id'];
+
+    // Fetch credentials
+    data.credentials = await userStub.listCredentials();
+
+    // Fetch memberships to find current account
+    const memberships = await userStub.getMemberships();
+    const currentMembership = memberships.find((m: any) => m.is_current) || memberships[0];
+
+    if (currentMembership) {
+      const accountId = env.ACCOUNT.idFromString(currentMembership.account_id);
+      const accountStub = env.ACCOUNT.get(accountId);
+      const accountInfo = await accountStub.getInfo();
+      const billing = await accountStub.getBillingInfo();
+      data.account = {
+        ...accountInfo,
+        billing,
+        id: currentMembership.account_id,
+        role: currentMembership.role,
+      };
+    }
+
+    return Response.json(data);
+  } catch (_e) {
+    return new Response('Unauthorized', { status: 401 });
+  }
+}
+
+export async function handleUpdateProfile(request: Request, env: StartupAPIEnv, cookieManager: CookieManager): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  try {
+    const profileData = await request.json();
+    const validatedData = UserProfileSchema.partial().parse(profileData);
+    const userStub = env.USER.get(env.USER.idFromString(user.id));
+    await userStub.updateProfile(validatedData);
+
+    return Response.json({ success: true });
+  } catch (e) {
+    return new Response(e instanceof Error ? e.message : String(e), { status: 400 });
+  }
+}
+
+export async function handleListCredentials(request: Request, env: StartupAPIEnv, cookieManager: CookieManager): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  const userStub = env.USER.get(env.USER.idFromString(user.id));
+  return Response.json(await userStub.listCredentials());
+}
+
+export async function handleDeleteCredential(request: Request, env: StartupAPIEnv, cookieManager: CookieManager): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  try {
+    const data = await request.json();
+    const { provider } = DeleteCredentialSchema.parse(data);
+    const userStub = env.USER.get(env.USER.idFromString(user.id));
+
+    return Response.json(await userStub.deleteCredential(provider));
+  } catch (e) {
+    return new Response(e instanceof Error ? e.message : String(e), { status: 400 });
+  }
+}
+
+export async function handleMeImage(request: Request, env: StartupAPIEnv, type: string, cookieManager: CookieManager): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  try {
+    const id = env.USER.idFromString(user.id);
+    const stub = env.USER.get(id);
+
+    if (request.method === 'PUT') {
+      const contentType = request.headers.get('Content-Type');
+      if (!contentType || !contentType.startsWith('image/')) {
+        return new Response('Invalid image type', { status: 400 });
+      }
+
+      const blob = await request.arrayBuffer();
+      if (blob.byteLength > 1024 * 1024) {
+        return new Response('Image too large (max 1MB)', { status: 400 });
+      }
+
+      await stub.storeImage(type, blob, contentType);
+      return Response.json({ success: true });
+    }
+
+    if (request.method === 'DELETE') {
+      await stub.deleteImage(type);
+      return Response.json({ success: true });
+    }
+
+    return handleUserImage(request, env, user.id, type, cookieManager);
+  } catch (e) {
+    console.error('[handleMeImage] Error:', e instanceof Error ? e.message : String(e), e instanceof Error ? e.stack : '');
+    return new Response(`Error fetching image: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+  }
+}
+
+export async function handleUserImage(
+  request: Request,
+  env: StartupAPIEnv,
+  userId: string,
+  type: string,
+  _cookieManager: CookieManager,
+): Promise<Response> {
+  try {
+    const id = env.USER.idFromString(userId);
+    const stub = env.USER.get(id);
+
+    const image = await stub.getImage(type);
+    if (!image) return new Response('Not Found', { status: 404 });
+    return new Response(image.value, { headers: { 'Content-Type': image.mime_type } });
+  } catch (_e) {
+    return new Response('Error fetching image', { status: 500 });
+  }
+}