@stelstone/server 0.26.0

package/src/routes.mjs

@@ -0,0 +1,737 @@
+/**
+ * Runtime-agnostic API routes for the Stelstone.
+ *
+ * Each route is `{ method, path, auth, handler }`:
+ *   - `path` uses Express-style `:param` placeholders.
+ *   - `auth` is `"public"` (no token required), `"any"` (any logged-in user),
+ *     or `"admin"` (admin role).
+ *   - `handler(ctx)` returns a `ResponseSpec`.
+ *
+ * Ctx shape (provided by the runtime shim):
+ *   {
+ *     params,                // route params
+ *     query,                 // parsed query object
+ *     body,                  // parsed JSON body (or null)
+ *     user,                  // cmsUser or null
+ *     header(name),          // request header lookup (case-insensitive)
+ *     env(name),             // env var lookup
+ *     adapters,              // { content, templates, cdnMedia, auth, build }
+ *     config,                // cms.config
+ *   }
+ *
+ * ResponseSpec:
+ *   { status?, json?, text?, redirect?, headers? }
+ */
+
+
+import { queryPages } from "./adapters/_shared.mjs";
+import { SERVER_VERSION } from "./version.mjs";
+import { readFormFields, fieldsError, formatMessage, clientIp } from "./core/forms.mjs";
+
+function ok(json) {
+  return { json };
+}
+
+function notFound(error = "Not found") {
+  return { status: 404, json: { error } };
+}
+
+function badRequest(error) {
+  return { status: 400, json: { error } };
+}
+
+/**
+ * Light structural validation for page payloads (PUT/POST).
+ * Returns an error string, or null when the payload looks sane.
+ * Not a schema check — just enough to keep malformed requests from
+ * writing broken JSON into a collection.
+ */
+function pageBodyError(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return "Body must be a JSON object";
+  if (body.slug !== undefined && typeof body.slug !== "string") return "slug must be a string";
+  if (body.meta !== undefined && (typeof body.meta !== "object" || Array.isArray(body.meta))) {
+    return "meta must be an object";
+  }
+  if (body.blocks !== undefined) {
+    if (!Array.isArray(body.blocks)) return "blocks must be an array";
+    for (const b of body.blocks) {
+      if (!b || typeof b !== "object" || typeof b.type !== "string") {
+        return "each block must be an object with a string type";
+      }
+    }
+  }
+  return null;
+}
+
+export const apiRoutes = [
+  // ── About ──────────────────────────────────────────────────────────────
+  {
+    method: "GET",
+    path: "/api/about",
+    auth: "public",
+    // Answers "what is actually running here?" in one request, instead of
+    // inferring it from file timestamps and bundle hashes. gitSha/buildTime
+    // are reported when the deployment supplies them.
+    // Reports only what this server can actually know. The admin UI and the
+    // block registry are separate packages resolved elsewhere, so their
+    // versions are supplied by the runtime that resolved them — or reported as
+    // null rather than guessed. On a Worker the SPA is served by the assets
+    // binding, which the CMS never sees, so null is the honest answer there.
+    handler: ({ env, runtime, adminUiVersion }) =>
+      ok({
+        serverVersion: SERVER_VERSION,
+        adminUiVersion: adminUiVersion ?? null,
+        // Declared by whoever constructed the handler, not sniffed: with
+        // nodejs_compat enabled a Worker also exposes process.versions.node,
+        // so feature detection reported "node" from inside a Worker.
+        runtime,
+        gitSha: env("CMS_GIT_SHA") ?? null,
+        buildTime: env("CMS_BUILD_TIME") ?? null,
+      }),
+  },
+
+  // ── Config ─────────────────────────────────────────────────────────────
+  {
+    method: "GET",
+    path: "/api/config",
+    auth: "public",
+    handler: ({ adapters }) => ok(adapters.publicConfig()),
+  },
+
+  {
+    method: "GET",
+    path: "/api/me",
+    auth: "any",
+    handler: ({ user }) => ok(user || { login: "admin", role: "admin" }),
+  },
+
+  // ── Collections ────────────────────────────────────────────────────────
+  {
+    method: "GET",
+    path: "/api/collections",
+    auth: "any",
+    handler: async ({ adapters }) => ok(await adapters.content.listCollections()),
+  },
+
+  {
+    // Every page's public path, for the `link` field's picker. Paths follow
+    // the ancestor-chain convention (an entry whose meta.parent names another
+    // entry's slug is served under it) — the same convention
+    // stelstone/redirects uses to generate redirects. A site with
+    // different routing overrides it with config.linkPathOf({collection, data,
+    // all}) — a server-side function, so it never has to survive JSON.
+    method: "GET",
+    path: "/api/links",
+    auth: "any",
+    handler: async ({ adapters, config }) => {
+      const collections = await adapters.content.listCollections();
+      const all = [];
+      for (const { name } of collections) {
+        const pages = (await adapters.content.listPages(name)) ?? [];
+        for (const page of pages) {
+          const data = await adapters.content.readPage(name, page.file);
+          if (data) all.push({ collection: name, file: page.file, data });
+        }
+      }
+
+      const bySlug = new Map(all.map((e) => [e.data.slug, e]));
+      const defaultPathOf = (entry) => {
+        const parts = [entry.data.slug];
+        const seen = new Set([entry.data.slug]);
+        let cur = entry;
+        while (true) {
+          const parentSlug = cur.data.meta?.parent;
+          if (!parentSlug || seen.has(parentSlug)) break;
+          const parent = bySlug.get(parentSlug);
+          if (!parent) break;
+          parts.unshift(parent.data.slug);
+          seen.add(parentSlug);
+          cur = parent;
+        }
+        return `/${parts.join("/")}/`;
+      };
+      const pathOf = typeof config.linkPathOf === "function"
+        ? (e) => config.linkPathOf({ collection: e.collection, data: e.data, all })
+        : defaultPathOf;
+
+      const links = all
+        .map((e) => ({
+          label: e.data.meta?.title || e.data.meta?.name || e.data.slug,
+          path: pathOf(e),
+          collection: e.collection,
+          file: e.file,
+        }))
+        .filter((l) => typeof l.path === "string" && l.path.startsWith("/"))
+        .sort((a, b) => a.path.localeCompare(b.path));
+      return ok(links);
+    },
+  },
+
+  {
+    method: "GET",
+    path: "/api/collections/:collection",
+    auth: "any",
+    handler: async ({ adapters, config, params, query }) => {
+      const col = params.collection;
+      // ?sortField and ?sortDir override the collection's static sort config
+      const sortConfig = query.sortField
+        ? { field: query.sortField, direction: query.sortDir === "desc" ? "desc" : "asc" }
+        : (config.collections?.[col]?.sort ?? null);
+      const pages = await adapters.content.listPages(col, sortConfig);
+      if (pages === null) return notFound();
+
+      // Parse pagination params
+      const rawPerPage = query.perPage ?? query.per_page;
+      const perPage = rawPerPage === "all" ? "all" : Math.max(1, parseInt(rawPerPage, 10) || 20);
+      const page = Math.max(1, parseInt(query.page, 10) || 1);
+      const search = query.search ?? "";
+
+      // Build active filters from f_* query keys
+      const filters = {};
+      for (const [k, v] of Object.entries(query)) {
+        if (k.startsWith("f_") && v) filters[k.slice(2)] = v;
+      }
+
+      const colConfig = config.collections?.[col];
+      const searchFields = (colConfig?.listFields ?? [{ key: "title" }, { key: "lang" }, { key: "slug" }]).map((f) => f.key);
+      const filterKeys = (colConfig?.filters ?? []).map((f) => f.key);
+
+      const { items, total, facets } = queryPages(pages, { page, perPage, search, searchFields, filterKeys, filters });
+      return ok({ items, total, page, perPage, facets });
+    },
+  },
+
+  {
+    method: "GET",
+    path: "/api/collections/:collection/:file",
+    auth: "any",
+    handler: async ({ adapters, params }) => {
+      const data = await adapters.content.readPage(params.collection, params.file);
+      if (!data) return notFound();
+      // The version token travels as an ETag so the editor can send it back as
+      // If-Match when saving, turning a silent overwrite into a 412.
+      const version = await adapters.content.versionOf?.(params.collection, params.file);
+      return version ? { json: data, headers: { ETag: `"${version}"` } } : ok(data);
+    },
+  },
+
+  {
+    method: "PUT",
+    path: "/api/collections/:collection/:file",
+    auth: "any",
+    handler: async ({ adapters, params, body, header }) => {
+      const bodyErr = pageBodyError(body);
+      if (bodyErr) return badRequest(bodyErr);
+
+      const ifMatch = header("if-match");
+      const expectedVersion = ifMatch ? ifMatch.replace(/^W\//, "").replace(/"/g, "") : undefined;
+
+      try {
+        await adapters.content.writePage(params.collection, params.file, body, { expectedVersion });
+      } catch (err) {
+        if (err.status === 412) {
+          return {
+            status: 412,
+            json: {
+              error: "This entry changed since you loaded it. Reload to see the current version.",
+            },
+          };
+        }
+        throw err;
+      }
+
+      const version = await adapters.content.versionOf?.(params.collection, params.file);
+      return version ? { json: { ok: true }, headers: { ETag: `"${version}"` } } : ok({ ok: true });
+    },
+  },
+
+  {
+    method: "POST",
+    path: "/api/collections/:collection",
+    auth: "any",
+    handler: async ({ adapters, params, body }) => {
+      const bodyErr = pageBodyError(body);
+      if (bodyErr) return badRequest(bodyErr);
+      try {
+        const result = await adapters.content.createPage(params.collection, body);
+        return ok({ ok: true, file: result.file });
+      } catch (err) {
+        if (err.status >= 400 && err.status < 500) {
+          return { status: err.status, json: { error: err.message } };
+        }
+        throw err;
+      }
+    },
+  },
+
+  {
+    method: "DELETE",
+    path: "/api/collections/:collection/:file",
+    auth: "admin",
+    handler: async ({ adapters, params }) => {
+      const okDel = await adapters.content.deletePage(params.collection, params.file);
+      if (!okDel) return notFound();
+      return ok({ ok: true });
+    },
+  },
+
+  {
+    method: "POST",
+    path: "/api/collections/:collection/:file/duplicate",
+    auth: "any",
+    handler: async ({ adapters, params }) => {
+      const result = await adapters.content.duplicatePage(params.collection, params.file);
+      if (!result) return notFound();
+      return ok({ ok: true, file: result.file });
+    },
+  },
+
+  // ── Preview URL ────────────────────────────────────────────────────────
+  // Resolves the preview URL for an entry. Supports both `config.previewUrl`
+  // (a function, called server-side with the page data) and the simpler
+  // `config.previewUrlPattern` (template string with {collection}/{slug}/{lang}).
+  {
+    method: "GET",
+    path: "/api/preview-url/:collection/:file",
+    auth: "any",
+    handler: async ({ adapters, params, config }) => {
+      const data = await adapters.content.readPage(params.collection, params.file);
+      if (!data) return notFound();
+
+      let url = null;
+      if (typeof config.previewUrl === "function") {
+        try {
+          url = config.previewUrl({ collection: params.collection, data });
+        } catch (err) {
+          return { status: 500, json: { error: `previewUrl(): ${err.message}` } };
+        }
+      } else if (config.previewUrlPattern) {
+        url = config.previewUrlPattern
+          .replace("{collection}", data.collection || params.collection)
+          .replace("{slug}", data.slug || "")
+          .replace("{lang}", data.lang || "");
+      }
+      return ok({ url });
+    },
+  },
+
+  // ── History ────────────────────────────────────────────────────────────
+  {
+    method: "GET",
+    path: "/api/history/:collection/:file",
+    auth: "any",
+    handler: async ({ adapters, params }) => {
+      try {
+        return ok(await adapters.content.listHistory(params.collection, params.file));
+      } catch (err) {
+        return { status: 500, json: { error: err.message } };
+      }
+    },
+  },
+
+  {
+    method: "POST",
+    path: "/api/history/:collection/:file/:ts/restore",
+    auth: "any",
+    handler: async ({ adapters, params }) => {
+      try {
+        const okRestore = await adapters.content.restoreHistory(
+          params.collection,
+          params.file,
+          params.ts,
+        );
+        if (!okRestore) return notFound("Revision not found");
+        return ok({ ok: true });
+      } catch (err) {
+        return { status: 500, json: { error: err.message } };
+      }
+    },
+  },
+
+  // ── Templates ──────────────────────────────────────────────────────────
+  {
+    method: "GET",
+    path: "/api/templates",
+    auth: "any",
+    handler: async ({ adapters }) => ok(await adapters.templates.list()),
+  },
+
+  {
+    method: "GET",
+    path: "/api/templates/:slug",
+    auth: "any",
+    handler: async ({ adapters, params }) => {
+      const data = await adapters.templates.get(params.slug);
+      if (!data) return notFound();
+      return ok(data);
+    },
+  },
+
+  {
+    method: "POST",
+    path: "/api/templates",
+    auth: "any",
+    handler: async ({ adapters, body }) => {
+      const { name, blocks } = body || {};
+      if (!name || !blocks) return badRequest("name and blocks required");
+      const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+      await adapters.templates.put(slug, { name, blocks });
+      return ok({ ok: true, slug });
+    },
+  },
+
+  {
+    method: "DELETE",
+    path: "/api/templates/:slug",
+    auth: "admin",
+    handler: async ({ adapters, params }) => {
+      const okDel = await adapters.templates.delete(params.slug);
+      if (!okDel) return notFound();
+      return ok({ ok: true });
+    },
+  },
+
+  // ── Media ──────────────────────────────────────────────────────────────
+  {
+    method: "GET",
+    path: "/api/media/folders",
+    auth: "any",
+    handler: async ({ adapters }) => {
+      const denied = mediaTokenUnavailable(adapters);
+      if (denied) return denied;
+      try {
+        if (!adapters.cdnMedia) return notFound("Media CDN is not configured");
+        return ok(await adapters.cdnMedia.listFolders());
+      } catch (err) {
+        return mediaError(err);
+      }
+    },
+  },
+
+  {
+    method: "GET",
+    path: "/api/media/folder/:folder",
+    auth: "any",
+    handler: async ({ adapters, params, query }) => {
+      const denied = mediaTokenUnavailable(adapters);
+      if (denied) return denied;
+      try {
+        if (!adapters.cdnMedia) return notFound("Media CDN is not configured");
+        return ok(
+          await adapters.cdnMedia.listFolder(params.folder, {
+            page: parseInt(query.page) || 1,
+            perPage: parseInt(query.per_page) || 30,
+            search: query.search || "",
+          }),
+        );
+      } catch (err) {
+        return mediaError(err);
+      }
+    },
+  },
+
+  {
+    method: "POST",
+    path: "/api/media/upload",
+    auth: "any",
+    handler: async ({ adapters, body }) => {
+      const denied = mediaTokenUnavailable(adapters);
+      if (denied) return denied;
+      try {
+        if (!adapters.cdnMedia) return notFound("Media CDN is not configured");
+        return ok(await adapters.cdnMedia.upload(body));
+      } catch (err) {
+        return mediaError(err);
+      }
+    },
+  },
+
+  // ── Local assets ───────────────────────────────────────────────────────
+  // Only the Node runtime has a filesystem, so `localMedia` is absent in a
+  // Worker. Declaring the capability explicitly beats letting the route throw.
+  {
+    method: "GET",
+    path: "/api/assets",
+    auth: "any",
+    handler: async ({ adapters }) => {
+      if (!adapters.localMedia) return notFound("Local assets are not available in this runtime");
+      return ok(await adapters.localMedia.listGrouped());
+    },
+  },
+
+  {
+    method: "GET",
+    path: "/api/assets/:folder",
+    auth: "any",
+    handler: async ({ adapters, params }) => {
+      if (!adapters.localMedia) return notFound("Local assets are not available in this runtime");
+      return ok(await adapters.localMedia.listFolder(params.folder));
+    },
+  },
+
+  // ── Forms ──────────────────────────────────────────────────────────────
+  {
+    // Public form intake — the replacement for Netlify Forms on Worker
+    // deployments, and the same endpoint in local dev. Order of the gates
+    // matters: cheap and silent first (unknown form, honeypot), then limits,
+    // then the rate limiter, then the only expensive step (delivery).
+    method: "POST",
+    path: "/api/forms/:name",
+    auth: "public",
+    rawBody: true,
+    handler: async ({ adapters, config, params, request, env }) => {
+      const def = config.forms?.[params.name];
+      if (!def) return notFound("Unknown form");
+
+      const fields = await readFormFields(request);
+      if (!fields) return badRequest("Unreadable form body");
+      const limitErr = fieldsError(fields);
+      if (limitErr) return badRequest(limitErr);
+
+      // Bots fill every input. A filled honeypot gets a cheerful 200 — an
+      // error would only teach the bot which field to skip.
+      const honeypot = def.honeypot ?? "bot-field";
+      const wantsHtml = (request.headers.get("accept") ?? "").includes("text/html");
+      const success = () =>
+        wantsHtml && def.redirect ? { status: 303, redirect: def.redirect } : ok({ ok: true });
+      if (fields[honeypot]) return success();
+
+      if (def.turnstile) {
+        const secret = env(def.turnstileSecretEnv || "TURNSTILE_SECRET");
+        if (!secret) return { status: 503, json: { error: "Form verification is not configured" } };
+        const check = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            secret,
+            response: fields["cf-turnstile-response"] ?? "",
+          }),
+        });
+        const verdict = await check.json().catch(() => ({ success: false }));
+        if (!verdict.success) return badRequest("Verification failed — please retry");
+      }
+
+      const limiter = adapters.formLimiter;
+      if (limiter && !(await limiter.allow(`${params.name}:${clientIp(request)}`))) {
+        return { status: 429, json: { error: "Too many submissions — please wait a minute" } };
+      }
+
+      if (!adapters.mail?.configured) {
+        return {
+          status: 503,
+          json: { error: "Mail delivery is not configured — set config.mail and its API key" },
+        };
+      }
+
+      const subject =
+        typeof def.subject === "function"
+          ? def.subject(fields)
+          : def.subject || `Yeni form gönderimi: ${params.name}`;
+      const replyTo = def.replyTo ? fields[def.replyTo] : undefined;
+
+      try {
+        await adapters.mail.send({
+          to: def.to,
+          subject,
+          text: formatMessage(fields, { skip: [honeypot] }),
+          ...(replyTo ? { replyTo } : {}),
+        });
+      } catch (err) {
+        return { status: 502, json: { error: err.message } };
+      }
+      return success();
+    },
+  },
+
+  // ── Publish ────────────────────────────────────────────────────────────
+  {
+    method: "POST",
+    path: "/api/publish",
+    auth: "admin",
+    handler: async ({ adapters }) => {
+      try {
+        return ok(await adapters.content.publish());
+      } catch (err) {
+        return { status: 500, json: { ok: false, message: err.message } };
+      }
+    },
+  },
+
+  {
+    // Publish ONE record: only this record's file is committed, so another
+    // editor's half-finished draft never rides along. Backends where saving
+    // already publishes (github) answer 501 and the UI hides the action.
+    method: "POST",
+    path: "/api/collections/:collection/:file/publish",
+    auth: "admin",
+    handler: async ({ adapters, params }) => {
+      if (!adapters.content.capabilities?.perEntryPublish) {
+        return {
+          status: 501,
+          json: { ok: false, message: "This content backend publishes on save — there is nothing to publish per entry." },
+        };
+      }
+      try {
+        return ok(
+          await adapters.content.publish(null, {
+            entries: [{ collection: params.collection, file: params.file }],
+          }),
+        );
+      } catch (err) {
+        return { status: 500, json: { ok: false, message: err.message } };
+      }
+    },
+  },
+
+  {
+    method: "GET",
+    path: "/api/publish/status",
+    auth: "any",
+    handler: async ({ adapters }) => {
+      try {
+        return ok({
+          ...(await adapters.content.pendingChanges()),
+          perEntryPublish: !!adapters.content.capabilities?.perEntryPublish,
+        });
+      } catch (err) {
+        return { status: 500, json: { error: err.message } };
+      }
+    },
+  },
+
+  // ── Deploy ─────────────────────────────────────────────────────────────
+  {
+    method: "GET",
+    path: "/api/deploy/status",
+    auth: "any",
+    handler: async ({ adapters, query }) => {
+      if (!adapters.build.configured) return ok({ configured: false });
+      try {
+        return ok(
+          await adapters.build.getDeployStatus({ branch: query.branch, sha: query.sha }),
+        );
+      } catch (err) {
+        if (err.upstreamStatus) {
+          return { status: 502, json: { configured: true, error: err.message } };
+        }
+        return { status: 500, json: { configured: true, error: err.message } };
+      }
+    },
+  },
+];
+
+/**
+ * Media endpoints need the auth adapter to mint a CDN token. Ask the port
+ * whether it can, instead of calling and handling the exception as a 500.
+ */
+function mediaTokenUnavailable(adapters) {
+  if (adapters.auth.supports?.("mediaToken")) return null;
+  return {
+    status: 501,
+    json: {
+      error:
+        "This CMS is configured with an auth provider that cannot issue media tokens. " +
+        "Use the basic or github-oauth provider, or serve media through the CDN's own auth.",
+    },
+  };
+}
+
+function mediaError(err) {
+  const status = err.upstreamStatus || 500;
+  return {
+    status: status >= 400 && status < 600 ? status : 502,
+    json: { error: err.message },
+  };
+}
+
+/**
+ * GitHub OAuth login/callback routes — runtime-agnostic since they only need
+ * the env-var lookup and header access provided via ctx.
+ */
+export const oauthRoutes = [
+  {
+    method: "GET",
+    path: "/admin/oauth/login",
+    auth: "public",
+    handler: ({ config, env, header, adapters }) => {
+      const clientId = env(config.auth.githubClientIdEnv || "GITHUB_CLIENT_ID");
+      const proto = header("x-forwarded-proto") || "https";
+      const host = header("host");
+      const callbackUrl = `${proto}://${host}/admin/oauth/callback`;
+      const params = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: callbackUrl,
+        scope: "read:user",
+        state: adapters.auth.issueOAuthState(),
+      });
+      return { redirect: `https://github.com/login/oauth/authorize?${params}` };
+    },
+  },
+  {
+    method: "GET",
+    path: "/admin/oauth/callback",
+    auth: "public",
+    handler: async ({ config, env, header, query, adapters }) => {
+      const { code, state } = query;
+      if (!code) return { status: 400, text: "Missing code" };
+      if (!state || !adapters.auth.verifyOAuthState(state)) {
+        return { status: 400, text: "Invalid or expired OAuth state" };
+      }
+
+      const clientId = env(config.auth.githubClientIdEnv || "GITHUB_CLIENT_ID");
+      const clientSecret = env(config.auth.githubClientSecretEnv || "GITHUB_CLIENT_SECRET");
+      const proto = header("x-forwarded-proto") || "https";
+      const host = header("host");
+      const callbackUrl = `${proto}://${host}/admin/oauth/callback`;
+
+      const tokenRes = await fetch("https://github.com/login/oauth/access_token", {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/json" },
+        body: JSON.stringify({
+          client_id: clientId,
+          client_secret: clientSecret,
+          code,
+          redirect_uri: callbackUrl,
+        }),
+      });
+      const tokenData = await tokenRes.json();
+      if (!tokenData.access_token) {
+        return {
+          status: 401,
+          text: "GitHub OAuth failed: " + (tokenData.error_description || "unknown"),
+        };
+      }
+
+      const userRes = await fetch("https://api.github.com/user", {
+        headers: {
+          Authorization: `Bearer ${tokenData.access_token}`,
+          "User-Agent": "stelstone",
+        },
+      });
+      const user = await userRes.json();
+
+      const allowedLogins = config.auth.allowedLogins || [];
+      if (allowedLogins.length > 0 && !allowedLogins.includes(user.login)) {
+        return {
+          status: 403,
+          text: `GitHub user "${user.login}" is not authorised for this CMS.`,
+        };
+      }
+
+      const sessionToken = adapters.auth.issueSessionToken(
+        user.login,
+        user.name || user.login,
+      );
+      // Token travels in the URL fragment: fragments are never sent to servers
+      // and don't land in access logs or proxy logs (unlike ?token=).
+      return { redirect: `/admin/#token=${encodeURIComponent(sessionToken)}` };
+    },
+  },
+];
+
+/** All routes both runtimes mount. OAuth is conditional on auth.provider. */
+export function allRoutes(config) {
+  const routes = [...apiRoutes];
+  if (config.auth?.provider === "github-oauth") routes.push(...oauthRoutes);
+  return routes;
+}