decap-cms-oauth-astro 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Doruk Gezici
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,73 @@
+<div align="center">
+    <h1 align="center">decap-cms-oauth-astro</h1>
+    <p align="center">Astro integration for <a href="https://decapcms.org" target="_blank">Decap</a>/<a href="https://github.com/sveltia/sveltia-cms" target="_blank">Sveltia</a> CMS with custom OAuth backend</p>
+    <br/>
+</div>
+
+A integration plugin that mounts the Decap CMS (or any compatible CMS like Sveltia) admin dashboard and custom OAuth authentication backend routes to `/oauth`&`/oauth/callback` using GitHub as the provider.
+
+
+## Installation
+
+```bash
+npx astro add decap-cms-oauth-astro
+```
+
+
+## Usage
+
+1. Put your `config.yml` file in `public/admin/config.yml` (see [Decap CMS Docs](https://decapcms.org/docs/add-to-your-site/#configuration) for more info)
+    ```yml
+    backend:
+        name: github
+        repo: Foxie-404/decap-cms-oauth-astro # change this to your repo
+        branch: main # change this to your branch
+        site_domain: decap-cms-oauth-astro.vercel.app # change this to your domain
+        base_url: https://decap-cms-oauth-astro.vercel.app # change this to your prod URL
+        auth_endpoint: oauth # the oauth route provided by the integration
+    ```
+
+2. On GitHub, go to Settings > Developer Settings > OAuth apps > New OAuth app. Or use this [direct link](https://github.com/settings/applications/new).
+    **Homepage URL**: This must be the prod URL of your application.
+    **Authorization callback URL**: This must be the prod URL of your application followed by `/oauth/callback`.
+    **Homepage URL**: This must be the prod URL of your application.
+    **Authorization callback URL**: This must be the prod URL of your application followed by `/oauth/callback`.
+    Once registered, click on the **Generate a new client secret** button. The app’s **Client ID** and **Client Secret** will be displayed.
+    Then navigate to `https://github.com/apps/<app slug>/installations/new` to install it on the repo. You can scope the access tokens further if wanted - details on [this page](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app#using-the-web-application-flow-to-generate-a-user-access-token)
+    ```bash
+    curl -s 'https://api.github.com/repos/<owner>/<repo>' | jq .id
+    ```
+
+    You can then use this ID for the `OAUTH_GITHUB_REPO_ID` environment variable.
+
+4. Set env variables
+    ```bash
+    # GitHub OAuth App & GitHub App
+    OAUTH_GITHUB_CLIENT_ID=
+    OAUTH_GITHUB_CLIENT_SECRET=
+    # GitHub App only
+    OAUTH_GITHUB_REPO_ID=
+    ```
+
+
+## Custom Config Path
+
+By default, the integration looks for the Decap CMS configuration at `public/admin/config.yml`. You can customize this path using the `configPath` option:
+```js
+decapCmsOauth({
+    configPath: ".decap.yml" // Path relative to project root
+})
+```
+
+
+## Whitelist and Validation
+
+To ensure compatibility and security, only official Decap CMS fields are allowed in the configuration. These include: `backend`, `site_url`, `display_url`, `logo`, `logo_url`, `media_folder`, `public_folder`, `collections`, `publish_mode`, `show_preview_links`, `slug`, `local_backend`, `i18n`, `media_library`, `editor`, `search`, `locale`.
+
+The fields `backend` and `collections` are **required**. If they are missing or if the configuration file is invalid, the integration will throw an error to terminate the build process.
+
+
+## Acknowledgements
+
+- [astro-decap-cms-oauth](dorukgezici/astro-decap-cms-oauth)
+- [Decap CMS](https://decapcms.org/)

package/dist/decap-cms-oauth-astro.d.ts

@@ -0,0 +1,17 @@
+import { AstroIntegration } from 'astro';
+
+declare function decapCMS(options?: DecapCMSOptions): AstroIntegration;
+export default decapCMS;
+
+declare interface DecapCMSOptions {
+    configPath?: string;
+    decapCMSSrcUrl?: string;
+    decapCMSVersion?: string;
+    adminDisabled?: boolean;
+    adminRoute?: string;
+    enable?: boolean;
+    oauthLoginRoute?: string;
+    oauthCallbackRoute?: string;
+}
+
+export { }

package/dist/main.cjs

@@ -0,0 +1,148 @@
+(function(global, factory) {
+  typeof exports === "object" && typeof module !== "undefined" ? module.exports = factory(require("astro/config"), require("node:fs"), require("node:path"), require("node:url"), require("js-yaml")) : typeof define === "function" && define.amd ? define(["astro/config", "node:fs", "node:path", "node:url", "js-yaml"], factory) : (global = typeof globalThis !== "undefined" ? globalThis : global || self, global.DecapCMSOAuthAstro = factory(global.config, global.fs, global.path, global.node_url, global.yaml));
+})(this, function(config, fs, path, node_url, yaml) {
+  "use strict";
+  const defaultOptions = {
+    configPath: "public/admin/config.yml",
+    decapCMSSrcUrl: "",
+    decapCMSVersion: "3.3.3",
+    adminDisabled: false,
+    adminRoute: "/admin",
+    enable: true,
+    oauthLoginRoute: "/oauth",
+    oauthCallbackRoute: "/oauth/callback"
+  };
+  const WHITELIST = [
+    "backend",
+    "site_url",
+    "display_url",
+    "logo",
+    "logo_url",
+    "media_folder",
+    "public_folder",
+    "collections",
+    "publish_mode",
+    "show_preview_links",
+    "slug",
+    "local_backend",
+    "i18n",
+    "media_library",
+    "editor",
+    "search",
+    "locale"
+  ];
+  function decapCMS(options = {}) {
+    const {
+      configPath,
+      decapCMSSrcUrl,
+      decapCMSVersion,
+      adminDisabled,
+      adminRoute,
+      enable,
+      oauthLoginRoute,
+      oauthCallbackRoute
+    } = {
+      ...defaultOptions,
+      ...options
+    };
+    if (!(adminRoute == null ? void 0 : adminRoute.startsWith("/")) || !(oauthLoginRoute == null ? void 0 : oauthLoginRoute.startsWith("/")) || !(oauthCallbackRoute == null ? void 0 : oauthCallbackRoute.startsWith("/"))) {
+      throw new Error('`adminRoute`, `oauthLoginRoute` and `oauthCallbackRoute` options must start with "/"');
+    }
+    return {
+      name: "decap-cms-oauth-astro",
+      hooks: {
+        "astro:config:setup": async ({ injectRoute, updateConfig, config: config$1 }) => {
+          const env = { validateSecrets: true, schema: {} };
+          let validatedConfigYaml = "";
+          if (!adminDisabled) {
+            const rootDir = node_url.fileURLToPath(config$1.root);
+            let absoluteConfigPath = path.resolve(rootDir, configPath);
+            if (!fs.existsSync(absoluteConfigPath)) {
+              const fallbackPath = path.resolve(rootDir, "public/admin/config.yml");
+              if (fs.existsSync(fallbackPath)) {
+                absoluteConfigPath = fallbackPath;
+              } else {
+                throw new Error(`Decap CMS config file not found at ${configPath} or ${fallbackPath}`);
+              }
+            }
+            try {
+              const fileContent = fs.readFileSync(absoluteConfigPath, "utf8");
+              const parsedConfig = yaml.load(fileContent);
+              if (!parsedConfig.backend || !parsedConfig.collections) {
+                console.error("Decap CMS configuration is missing required fields: 'backend' or 'collections'. Admin dashboard will be disabled.");
+                return;
+              }
+              const filteredConfig = {};
+              for (const key of WHITELIST) {
+                if (key in parsedConfig) {
+                  filteredConfig[key] = parsedConfig[key];
+                }
+              }
+              validatedConfigYaml = yaml.dump(filteredConfig);
+            } catch (e) {
+              console.error(`Failed to parse Decap CMS config: ${e}`);
+              return;
+            }
+            injectRoute({
+              pattern: adminRoute,
+              entrypoint: "decap-cms-oauth-astro/src/admin.astro"
+            });
+            injectRoute({
+              pattern: `${adminRoute}/config.yml`,
+              entrypoint: "decap-cms-oauth-astro/src/config.ts"
+            });
+          }
+          if (enable) {
+            env.schema.OAUTH_GITHUB_CLIENT_ID = config.envField.string({
+              context: "server",
+              access: "secret"
+            });
+            env.schema.OAUTH_GITHUB_CLIENT_SECRET = config.envField.string({
+              context: "server",
+              access: "secret"
+            });
+            env.schema.OAUTH_GITHUB_REPO_ID = config.envField.string({
+              context: "server",
+              access: "secret",
+              optional: true,
+              default: ""
+            });
+            injectRoute({
+              pattern: oauthLoginRoute,
+              entrypoint: "decap-cms-oauth-astro/src/oauth/index.ts"
+            });
+            injectRoute({
+              pattern: oauthCallbackRoute,
+              entrypoint: "decap-cms-oauth-astro/src/oauth/callback.ts"
+            });
+          }
+          updateConfig({
+            env,
+            vite: {
+              plugins: [
+                {
+                  name: "decap-cms-config",
+                  resolveId(id) {
+                    if (id === "virtual:decap-cms-config") {
+                      return "\0virtual:decap-cms-config";
+                    }
+                  },
+                  load(id) {
+                    if (id === "\0virtual:decap-cms-config") {
+                      return `
+                                            export const configYaml = ${JSON.stringify(validatedConfigYaml)};
+                                            export const decapCMSSrcUrl = ${JSON.stringify(decapCMSSrcUrl)};
+                                            export const decapCMSVersion = ${JSON.stringify(decapCMSVersion)};
+                                        `;
+                    }
+                  }
+                }
+              ]
+            }
+          });
+        }
+      }
+    };
+  }
+  return decapCMS;
+});

package/dist/main.js

@@ -0,0 +1,150 @@
+import { envField } from "astro/config";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import yaml from "js-yaml";
+const defaultOptions = {
+  configPath: "public/admin/config.yml",
+  decapCMSSrcUrl: "",
+  decapCMSVersion: "3.3.3",
+  adminDisabled: false,
+  adminRoute: "/admin",
+  enable: true,
+  oauthLoginRoute: "/oauth",
+  oauthCallbackRoute: "/oauth/callback"
+};
+const WHITELIST = [
+  "backend",
+  "site_url",
+  "display_url",
+  "logo",
+  "logo_url",
+  "media_folder",
+  "public_folder",
+  "collections",
+  "publish_mode",
+  "show_preview_links",
+  "slug",
+  "local_backend",
+  "i18n",
+  "media_library",
+  "editor",
+  "search",
+  "locale"
+];
+function decapCMS(options = {}) {
+  const {
+    configPath,
+    decapCMSSrcUrl,
+    decapCMSVersion,
+    adminDisabled,
+    adminRoute,
+    enable,
+    oauthLoginRoute,
+    oauthCallbackRoute
+  } = {
+    ...defaultOptions,
+    ...options
+  };
+  if (!(adminRoute == null ? void 0 : adminRoute.startsWith("/")) || !(oauthLoginRoute == null ? void 0 : oauthLoginRoute.startsWith("/")) || !(oauthCallbackRoute == null ? void 0 : oauthCallbackRoute.startsWith("/"))) {
+    throw new Error('`adminRoute`, `oauthLoginRoute` and `oauthCallbackRoute` options must start with "/"');
+  }
+  return {
+    name: "decap-cms-oauth-astro",
+    hooks: {
+      "astro:config:setup": async ({ injectRoute, updateConfig, config }) => {
+        const env = { validateSecrets: true, schema: {} };
+        let validatedConfigYaml = "";
+        if (!adminDisabled) {
+          const rootDir = fileURLToPath(config.root);
+          let absoluteConfigPath = path.resolve(rootDir, configPath);
+          if (!fs.existsSync(absoluteConfigPath)) {
+            const fallbackPath = path.resolve(rootDir, "public/admin/config.yml");
+            if (fs.existsSync(fallbackPath)) {
+              absoluteConfigPath = fallbackPath;
+            } else {
+              throw new Error(`Decap CMS config file not found at ${configPath} or ${fallbackPath}`);
+            }
+          }
+          try {
+            const fileContent = fs.readFileSync(absoluteConfigPath, "utf8");
+            const parsedConfig = yaml.load(fileContent);
+            if (!parsedConfig.backend || !parsedConfig.collections) {
+              console.error("Decap CMS configuration is missing required fields: 'backend' or 'collections'. Admin dashboard will be disabled.");
+              return;
+            }
+            const filteredConfig = {};
+            for (const key of WHITELIST) {
+              if (key in parsedConfig) {
+                filteredConfig[key] = parsedConfig[key];
+              }
+            }
+            validatedConfigYaml = yaml.dump(filteredConfig);
+          } catch (e) {
+            console.error(`Failed to parse Decap CMS config: ${e}`);
+            return;
+          }
+          injectRoute({
+            pattern: adminRoute,
+            entrypoint: "decap-cms-oauth-astro/src/admin.astro"
+          });
+          injectRoute({
+            pattern: `${adminRoute}/config.yml`,
+            entrypoint: "decap-cms-oauth-astro/src/config.ts"
+          });
+        }
+        if (enable) {
+          env.schema.OAUTH_GITHUB_CLIENT_ID = envField.string({
+            context: "server",
+            access: "secret"
+          });
+          env.schema.OAUTH_GITHUB_CLIENT_SECRET = envField.string({
+            context: "server",
+            access: "secret"
+          });
+          env.schema.OAUTH_GITHUB_REPO_ID = envField.string({
+            context: "server",
+            access: "secret",
+            optional: true,
+            default: ""
+          });
+          injectRoute({
+            pattern: oauthLoginRoute,
+            entrypoint: "decap-cms-oauth-astro/src/oauth/index.ts"
+          });
+          injectRoute({
+            pattern: oauthCallbackRoute,
+            entrypoint: "decap-cms-oauth-astro/src/oauth/callback.ts"
+          });
+        }
+        updateConfig({
+          env,
+          vite: {
+            plugins: [
+              {
+                name: "decap-cms-config",
+                resolveId(id) {
+                  if (id === "virtual:decap-cms-config") {
+                    return "\0virtual:decap-cms-config";
+                  }
+                },
+                load(id) {
+                  if (id === "\0virtual:decap-cms-config") {
+                    return `
+                                            export const configYaml = ${JSON.stringify(validatedConfigYaml)};
+                                            export const decapCMSSrcUrl = ${JSON.stringify(decapCMSSrcUrl)};
+                                            export const decapCMSVersion = ${JSON.stringify(decapCMSVersion)};
+                                        `;
+                  }
+                }
+              }
+            ]
+          }
+        });
+      }
+    }
+  };
+}
+export {
+  decapCMS as default
+};

package/package.json

@@ -0,0 +1,58 @@
+{
+    "name": "decap-cms-oauth-astro",
+    "version": "0.1.1",
+    "description": "Add Decap CMS’s admin dashboard and a custom OAuth backend to your Astro project",
+    "keywords": [
+        "astro-integration",
+        "decap-cms",
+        "oauth"
+    ],
+    "license": "MIT",
+    "author": "Spr_Aachen",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/Foxie-404/decap-cms-oauth-astro.git"
+    },
+    "bugs": "https://github.com/Foxie-404/decap-cms-oauth-astro/issues",
+    "homepage": "https://github.com/Foxie-404/decap-cms-oauth-astro",
+    "type": "module",
+    "files": [
+        "dist",
+        "src",
+        "README.md"
+    ],
+    "main": "./dist/main.cjs",
+    "module": "./dist/main.js",
+    "types": "./dist/decap-cms-oauth-astro.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/decap-cms-oauth-astro.d.ts",
+            "import": "./dist/main.js",
+            "require": "./dist/main.cjs"
+        },
+        "./src/oauth/callback.ts": "./src/oauth/callback.ts",
+        "./src/oauth/index.ts": "./src/oauth/index.ts",
+        "./src/admin.astro": "./src/admin.astro",
+        "./src/config.ts": "./src/config.ts"
+    },
+    "scripts": {
+        "dev": "vite build --watch",
+        "build": "pnpm run sync && tsc && vite build",
+        "prepublishOnly": "pnpm run build",
+        "sync": "pnpm astro sync"
+    },
+    "devDependencies": {
+        "@types/js-yaml": "^4.0.9",
+        "@types/node": "^22.10.2",
+        "astro": "^5.0.5",
+        "typescript": "^5.7.2",
+        "vite": "^6.0.3",
+        "vite-plugin-dts": "^4.3.0"
+    },
+    "peerDependencies": {
+        "astro": "^5.0.0"
+    },
+    "dependencies": {
+        "js-yaml": "^4.1.1"
+    }
+}

package/src/admin.astro

@@ -0,0 +1,18 @@
+---
+import { decapCMSVersion, decapCMSSrcUrl } from "virtual:decap-cms-config";
+---
+
+<!doctype html>
+<html>
+    <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <meta name="robots" content="noindex" />
+        <link href={`${Astro.url.pathname.replace(/\/$/, "")}/config.yml`} type="text/yaml" rel="cms-config-url" />
+        <title>Content Manager</title>
+    </head>
+    <body>
+        <!-- Include the script that builds the page and powers Decap CMS -->
+        <script is:inline src={decapCMSSrcUrl ? decapCMSSrcUrl : `https://unpkg.com/decap-cms@^${decapCMSVersion}/dist/decap-cms.js`}></script>
+    </body>
+</html>

package/src/config.ts

@@ -0,0 +1,12 @@
+import type { APIRoute } from "astro";
+// @ts-ignore
+import { configYaml } from "virtual:decap-cms-config";
+
+
+export const GET: APIRoute = () => {
+    return new Response(configYaml, {
+        headers: {
+            "content-type": "text/yaml; charset=utf-8",
+        },
+    });
+};

package/src/env.d.ts

@@ -0,0 +1,7 @@
+/// <reference path="../.astro/types.d.ts" />
+
+declare module "virtual:decap-cms-config" {
+    export const configYaml: string;
+    export const decapCMSSrcUrl: string | undefined;
+    export const decapCMSVersion: string;
+}

package/src/main.ts

@@ -0,0 +1,185 @@
+import type { AstroConfig, AstroIntegration } from "astro";
+import { envField } from "astro/config";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import yaml from "js-yaml";
+
+
+export interface DecapCMSOptions {
+    configPath?: string;
+    decapCMSSrcUrl?: string;
+    decapCMSVersion?: string;
+    adminDisabled?: boolean;
+    adminRoute?: string;
+    enable?: boolean;
+    oauthLoginRoute?: string;
+    oauthCallbackRoute?: string;
+}
+const defaultOptions: DecapCMSOptions = {
+    configPath: "public/admin/config.yml",
+    decapCMSSrcUrl: "",
+    decapCMSVersion: "3.3.3",
+    adminDisabled: false,
+    adminRoute: "/admin",
+    enable: true,
+    oauthLoginRoute: "/oauth",
+    oauthCallbackRoute: "/oauth/callback",
+};
+
+const WHITELIST = [
+    "backend",
+    "site_url",
+    "display_url",
+    "logo",
+    "logo_url",
+    "media_folder",
+    "public_folder",
+    "collections",
+    "publish_mode",
+    "show_preview_links",
+    "slug",
+    "local_backend",
+    "i18n",
+    "media_library",
+    "editor",
+    "search",
+    "locale",
+];
+
+export default function decapCMS(options: DecapCMSOptions = {}): AstroIntegration {
+    const {
+        configPath,
+        decapCMSSrcUrl,
+        decapCMSVersion,
+        adminDisabled,
+        adminRoute,
+        enable,
+        oauthLoginRoute,
+        oauthCallbackRoute,
+    } = {
+        ...defaultOptions,
+        ...options,
+    };
+
+    if (!adminRoute?.startsWith("/") || !oauthLoginRoute?.startsWith("/") || !oauthCallbackRoute?.startsWith("/")) {
+        throw new Error('`adminRoute`, `oauthLoginRoute` and `oauthCallbackRoute` options must start with "/"');
+    }
+
+    return {
+        name: "decap-cms-oauth-astro",
+        hooks: {
+            "astro:config:setup": async ({ injectRoute, updateConfig, config }) => {
+                const env: AstroConfig["env"] = { validateSecrets: true, schema: {} };
+
+                let validatedConfigYaml = "";
+
+                if (!adminDisabled) {
+                    // Resolve config path
+                    const rootDir = fileURLToPath(config.root);
+                    let absoluteConfigPath = path.resolve(rootDir, configPath!);
+
+                    if (!fs.existsSync(absoluteConfigPath)) {
+                        const fallbackPath = path.resolve(rootDir, "public/admin/config.yml");
+                        if (fs.existsSync(fallbackPath)) {
+                            absoluteConfigPath = fallbackPath;
+                        } else {
+                            throw new Error(`Decap CMS config file not found at ${configPath} or ${fallbackPath}`);
+                        }
+                    }
+
+                    // Read and validate config
+                    try {
+                        const fileContent = fs.readFileSync(absoluteConfigPath, "utf8");
+                        const parsedConfig = yaml.load(fileContent) as Record<string, any>;
+
+                        if (!parsedConfig.backend || !parsedConfig.collections) {
+                            console.error("Decap CMS configuration is missing required fields: 'backend' or 'collections'. Admin dashboard will be disabled.");
+                            return;
+                        }
+
+                        // Whitelist filtering
+                        const filteredConfig: Record<string, any> = {};
+                        for (const key of WHITELIST) {
+                            if (key in parsedConfig) {
+                                filteredConfig[key] = parsedConfig[key];
+                            }
+                        }
+
+                        validatedConfigYaml = yaml.dump(filteredConfig);
+                    } catch (e) {
+                        console.error(`Failed to parse Decap CMS config: ${e}`);
+                        return;
+                    }
+
+                    // mount DecapCMS admin route
+                    injectRoute({
+                        pattern: adminRoute,
+                        entrypoint: "decap-cms-oauth-astro/src/admin.astro",
+                    });
+
+                    // mount DecapCMS config route
+                    injectRoute({
+                        pattern: `${adminRoute}/config.yml`,
+                        entrypoint: "decap-cms-oauth-astro/src/config.ts",
+                    });
+                }
+
+                if (enable) {
+                    env.schema!.OAUTH_GITHUB_CLIENT_ID = envField.string({
+                        context: "server",
+                        access: "secret",
+                    });
+                    env.schema!.OAUTH_GITHUB_CLIENT_SECRET = envField.string({
+                        context: "server",
+                        access: "secret",
+                    });
+                    env.schema!.OAUTH_GITHUB_REPO_ID = envField.string({
+                        context: "server",
+                        access: "secret",
+                        optional: true,
+                        default: "",
+                    });
+
+                    // mount OAuth backend - sign in route
+                    injectRoute({
+                        pattern: oauthLoginRoute,
+                        entrypoint: "decap-cms-oauth-astro/src/oauth/index.ts",
+                    });
+
+                    // mount OAuth backend - callback route
+                    injectRoute({
+                        pattern: oauthCallbackRoute,
+                        entrypoint: "decap-cms-oauth-astro/src/oauth/callback.ts",
+                    });
+                }
+
+                // apply env schema & defaults
+                updateConfig({
+                    env,
+                    vite: {
+                        plugins: [
+                            {
+                                name: "decap-cms-config",
+                                resolveId(id) {
+                                    if (id === "virtual:decap-cms-config") {
+                                        return "\0virtual:decap-cms-config";
+                                    }
+                                },
+                                load(id) {
+                                    if (id === "\0virtual:decap-cms-config") {
+                                        return `
+                                            export const configYaml = ${JSON.stringify(validatedConfigYaml)};
+                                            export const decapCMSSrcUrl = ${JSON.stringify(decapCMSSrcUrl)};
+                                            export const decapCMSVersion = ${JSON.stringify(decapCMSVersion)};
+                                        `;
+                                    }
+                                },
+                            },
+                        ],
+                    },
+                });
+            },
+        },
+    };
+}

package/src/oauth/callback.ts

@@ -0,0 +1,58 @@
+import type { APIRoute } from "astro";
+import { OAUTH_GITHUB_CLIENT_ID, OAUTH_GITHUB_CLIENT_SECRET, OAUTH_GITHUB_REPO_ID } from "astro:env/server";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ url, redirect }) => {
+  const data = {
+    code: url.searchParams.get("code"),
+    client_id: OAUTH_GITHUB_CLIENT_ID,
+    client_secret: OAUTH_GITHUB_CLIENT_SECRET,
+    ...(OAUTH_GITHUB_REPO_ID ? { repository_id: OAUTH_GITHUB_REPO_ID } : {}),
+  };
+
+  try {
+    const response = await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(data),
+    });
+
+    if (!response.ok) {
+      throw new Error(`HTTP error! status: ${response.status}`);
+    }
+
+    const body = await response.json();
+
+    const content = {
+      token: body.access_token,
+      provider: "github",
+    };
+
+    const script = `
+      <script>
+        const receiveMessage = (message) => {
+          window.opener.postMessage(
+            'authorization:${content.provider}:success:${JSON.stringify(content)}',
+            message.origin
+          );
+
+          window.removeEventListener("message", receiveMessage, false);
+        }
+        window.addEventListener("message", receiveMessage, false);
+
+        window.opener.postMessage("authorizing:${content.provider}", "*");
+      </script>
+    `;
+
+    return new Response(script, {
+      headers: { "Content-Type": "text/html" },
+    });
+  } catch (err) {
+    console.log(err);
+    return redirect("/?error=😡");
+  }
+};

package/src/oauth/index.ts

@@ -0,0 +1,13 @@
+import type { APIRoute } from "astro";
+import { OAUTH_GITHUB_CLIENT_ID } from "astro:env/server";
+
+export const prerender = false;
+
+export const GET: APIRoute = ({ redirect }) => {
+  const params = new URLSearchParams({
+    client_id: OAUTH_GITHUB_CLIENT_ID,
+    scope: "repo,user",
+  });
+
+  return redirect(`https://github.com/login/oauth/authorize?${params.toString()}`);
+};