dineway 0.1.9 → 0.1.11

package/src/astro/routes/api/auth/me.ts

@@ -1,60 +0,0 @@
-/**
- * GET /_dineway/api/auth/me
- *
- * Returns the current authenticated user's info.
- * Used by the admin UI to display user info in the header.
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { apiError, apiSuccess } from "#api/error.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { authMeActionBody } from "#api/schemas.js";
-
-export const GET: APIRoute = async ({ locals, session }) => {
-	const { user } = locals;
-
-	if (!user) {
-		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
-	}
-
-	// Check if this is the user's first login (for welcome modal)
-	// We track this in the session to show the modal only once
-	const hasSeenWelcome = await session?.get("hasSeenWelcome");
-	const isFirstLogin = !hasSeenWelcome;
-
-	// Return safe user info (no sensitive data)
-	return apiSuccess({
-		id: user.id,
-		email: user.email,
-		name: user.name,
-		role: user.role,
-		avatarUrl: user.avatarUrl,
-		isFirstLogin,
-	});
-};
-
-/**
- * POST /_dineway/api/auth/me
- *
- * Mark that the user has seen the welcome modal.
- */
-export const POST: APIRoute = async ({ request, locals, session }) => {
-	const { user } = locals;
-
-	if (!user) {
-		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
-	}
-
-	const body = await parseBody(request, authMeActionBody);
-	if (isParseError(body)) return body;
-
-	if (body.action === "dismissWelcome") {
-		session?.set("hasSeenWelcome", true);
-		return apiSuccess({ success: true });
-	}
-
-	return apiError("UNKNOWN_ACTION", "Unknown action", 400);
-};

package/src/astro/routes/api/auth/oauth/[provider]/callback.ts

@@ -1,221 +0,0 @@
-/**
- * GET /_dineway/api/auth/oauth/[provider]/callback
- *
- * Handle OAuth callback from provider
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import {
-	handleOAuthCallback,
-	OAuthError,
-	Role,
-	type OAuthConsumerConfig,
-	type RoleLevel,
-} from "@dineway-ai/auth";
-import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
-
-import { getPublicOrigin } from "#api/public-url.js";
-import { createOAuthStateStore } from "#auth/oauth-state-store.js";
-
-type ProviderName = "github" | "google";
-
-const VALID_PROVIDERS = new Set<string>(["github", "google"]);
-
-function isValidProvider(provider: string): provider is ProviderName {
-	return VALID_PROVIDERS.has(provider);
-}
-
-/** Safely extract a string value from an env-like record */
-function envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {
-	for (const key of keys) {
-		const val = env[key];
-		if (typeof val === "string" && val) return val;
-	}
-	return undefined;
-}
-
-/**
- * Get OAuth config from environment variables
- */
-function getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig["providers"] {
-	const providers: OAuthConsumerConfig["providers"] = {};
-
-	// GitHub
-	const githubClientId = envString(env, "DINEWAY_OAUTH_GITHUB_CLIENT_ID", "GITHUB_CLIENT_ID");
-	const githubClientSecret = envString(
-		env,
-		"DINEWAY_OAUTH_GITHUB_CLIENT_SECRET",
-		"GITHUB_CLIENT_SECRET",
-	);
-	if (githubClientId && githubClientSecret) {
-		providers.github = {
-			clientId: githubClientId,
-			clientSecret: githubClientSecret,
-		};
-	}
-
-	// Google
-	const googleClientId = envString(env, "DINEWAY_OAUTH_GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_ID");
-	const googleClientSecret = envString(
-		env,
-		"DINEWAY_OAUTH_GOOGLE_CLIENT_SECRET",
-		"GOOGLE_CLIENT_SECRET",
-	);
-	if (googleClientId && googleClientSecret) {
-		providers.google = {
-			clientId: googleClientId,
-			clientSecret: googleClientSecret,
-		};
-	}
-
-	return providers;
-}
-
-export const GET: APIRoute = async ({ params, request, locals, session, redirect }) => {
-	const { dineway } = locals;
-	const provider = params.provider;
-
-	// Validate provider
-	if (!provider || !isValidProvider(provider)) {
-		return redirect(
-			`/_dineway/admin/login?error=invalid_provider&message=${encodeURIComponent("Invalid OAuth provider")}`,
-		);
-	}
-
-	if (!dineway?.db) {
-		return redirect(
-			`/_dineway/admin/login?error=server_error&message=${encodeURIComponent("Database not configured")}`,
-		);
-	}
-
-	const url = new URL(request.url);
-	const code = url.searchParams.get("code");
-	const state = url.searchParams.get("state");
-	const error = url.searchParams.get("error");
-	const errorDescription = url.searchParams.get("error_description");
-
-	// Handle OAuth errors from provider
-	if (error) {
-		const message = errorDescription || error;
-		return redirect(
-			`/_dineway/admin/login?error=oauth_denied&message=${encodeURIComponent(message)}`,
-		);
-	}
-
-	// Validate required params
-	if (!code || !state) {
-		return redirect(
-			`/_dineway/admin/login?error=invalid_callback&message=${encodeURIComponent("Missing code or state parameter")}`,
-		);
-	}
-
-	try {
-		// Get OAuth providers from the adapter/runtime env when available,
-		// otherwise fall back to the Node build env.
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- some adapters inject locals.runtime.env at runtime; App.Locals intentionally stays generic
-		const runtimeLocals = locals as unknown as { runtime?: { env?: Record<string, unknown> } };
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- import.meta.env is typed as ImportMetaEnv but we need Record<string, unknown> for getOAuthConfig
-		const env = runtimeLocals.runtime?.env ?? (import.meta.env as Record<string, unknown>);
-		const providers = getOAuthConfig(env);
-
-		if (!providers[provider]) {
-			return redirect(
-				`/_dineway/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`,
-			);
-		}
-
-		const config: OAuthConsumerConfig = {
-			baseUrl: `${getPublicOrigin(url, dineway?.config)}/_dineway`,
-			providers,
-			canSelfSignup: async (email: string) => {
-				// Extract domain from email
-				const domain = email.split("@")[1]?.toLowerCase();
-				if (!domain) {
-					return null;
-				}
-
-				// Check allowed_domains table for a matching, enabled entry
-				const entry = await dineway.db
-					.selectFrom("allowed_domains")
-					.selectAll()
-					.where("domain", "=", domain)
-					.where("enabled", "=", 1)
-					.executeTakeFirst();
-
-				if (!entry) {
-					return null;
-				}
-
-				// Map the stored role level to the Role enum
-				const roleLevel = entry.default_role;
-				const roleMap: Record<number, RoleLevel> = {
-					50: Role.ADMIN,
-					40: Role.EDITOR,
-					30: Role.AUTHOR,
-					20: Role.CONTRIBUTOR,
-					10: Role.SUBSCRIBER,
-				};
-				const role = roleMap[roleLevel] ?? Role.CONTRIBUTOR;
-				if (!roleMap[roleLevel]) {
-					console.warn(
-						`[oauth] Unknown role level ${roleLevel} for domain ${domain}, defaulting to CONTRIBUTOR`,
-					);
-				}
-
-				return { allowed: true, role };
-			},
-		};
-
-		const adapter = createKyselyAdapter(dineway.db);
-		const stateStore = createOAuthStateStore(dineway.db);
-
-		const user = await handleOAuthCallback(config, adapter, provider, code, state, stateStore);
-
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
-
-		// Redirect to admin dashboard
-		return redirect("/_dineway/admin");
-	} catch (callbackError) {
-		console.error("OAuth callback error:", callbackError);
-
-		let message = "Authentication failed";
-		let errorCode = "oauth_error";
-
-		if (callbackError instanceof OAuthError) {
-			errorCode = callbackError.code;
-
-			// Map all error codes to user-friendly messages (never expose raw error.message)
-			switch (callbackError.code) {
-				case "invalid_state":
-					message = "OAuth session expired or invalid. Please try again.";
-					break;
-				case "signup_not_allowed":
-					message = "Self-signup is not allowed for your email. Please contact an administrator.";
-					break;
-				case "user_not_found":
-					message = "Your account was not found. It may have been deleted.";
-					break;
-				case "token_exchange_failed":
-					message = "Failed to complete authentication. Please try again.";
-					break;
-				case "profile_fetch_failed":
-					message = "Failed to retrieve your profile. Please try again.";
-					break;
-				default:
-					message = "Authentication failed. Please try again.";
-					break;
-			}
-		}
-		// For generic errors, keep the default "Authentication failed" message
-
-		return redirect(
-			`/_dineway/admin/login?error=${errorCode}&message=${encodeURIComponent(message)}`,
-		);
-	}
-};

package/src/astro/routes/api/auth/oauth/[provider].ts

@@ -1,120 +0,0 @@
-/**
- * GET /_dineway/api/auth/oauth/[provider]
- *
- * Start OAuth flow - redirects to provider authorization URL
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { createAuthorizationUrl, type OAuthConsumerConfig } from "@dineway-ai/auth";
-
-import { getPublicOrigin } from "#api/public-url.js";
-import { createOAuthStateStore } from "#auth/oauth-state-store.js";
-
-type ProviderName = "github" | "google";
-
-const VALID_PROVIDERS = new Set<string>(["github", "google"]);
-
-function isValidProvider(provider: string): provider is ProviderName {
-	return VALID_PROVIDERS.has(provider);
-}
-
-/** Safely extract a string value from an env-like record */
-function envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {
-	for (const key of keys) {
-		const val = env[key];
-		if (typeof val === "string" && val) return val;
-	}
-	return undefined;
-}
-
-/**
- * Get OAuth config from environment variables
- */
-function getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig["providers"] {
-	const providers: OAuthConsumerConfig["providers"] = {};
-
-	// GitHub
-	const githubClientId = envString(env, "DINEWAY_OAUTH_GITHUB_CLIENT_ID", "GITHUB_CLIENT_ID");
-	const githubClientSecret = envString(
-		env,
-		"DINEWAY_OAUTH_GITHUB_CLIENT_SECRET",
-		"GITHUB_CLIENT_SECRET",
-	);
-	if (githubClientId && githubClientSecret) {
-		providers.github = {
-			clientId: githubClientId,
-			clientSecret: githubClientSecret,
-		};
-	}
-
-	// Google
-	const googleClientId = envString(env, "DINEWAY_OAUTH_GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_ID");
-	const googleClientSecret = envString(
-		env,
-		"DINEWAY_OAUTH_GOOGLE_CLIENT_SECRET",
-		"GOOGLE_CLIENT_SECRET",
-	);
-	if (googleClientId && googleClientSecret) {
-		providers.google = {
-			clientId: googleClientId,
-			clientSecret: googleClientSecret,
-		};
-	}
-
-	return providers;
-}
-
-export const GET: APIRoute = async ({ params, request, locals, redirect }) => {
-	const { dineway } = locals;
-	const provider = params.provider;
-
-	// Validate provider
-	if (!provider || !isValidProvider(provider)) {
-		return redirect(
-			`/_dineway/admin/login?error=invalid_provider&message=${encodeURIComponent("Invalid OAuth provider")}`,
-		);
-	}
-
-	if (!dineway?.db) {
-		return redirect(
-			`/_dineway/admin/login?error=server_error&message=${encodeURIComponent("Database not configured")}`,
-		);
-	}
-
-	try {
-		const url = new URL(request.url);
-
-		// Get OAuth providers from the adapter/runtime env when available,
-		// otherwise fall back to the Node build env.
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- some adapters inject locals.runtime.env at runtime; App.Locals intentionally stays generic
-		const runtimeLocals = locals as unknown as { runtime?: { env?: Record<string, unknown> } };
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- import.meta.env is typed as ImportMetaEnv but we need Record<string, unknown> for getOAuthConfig
-		const env = runtimeLocals.runtime?.env ?? (import.meta.env as Record<string, unknown>);
-		const providers = getOAuthConfig(env);
-
-		if (!providers[provider]) {
-			return redirect(
-				`/_dineway/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`,
-			);
-		}
-
-		const config: OAuthConsumerConfig = {
-			baseUrl: `${getPublicOrigin(url, dineway?.config)}/_dineway`,
-			providers,
-		};
-
-		const stateStore = createOAuthStateStore(dineway.db);
-
-		const { url: authUrl } = await createAuthorizationUrl(config, provider, stateStore);
-
-		return redirect(authUrl);
-	} catch (error) {
-		console.error("OAuth initiation error:", error);
-		return redirect(
-			`/_dineway/admin/login?error=oauth_error&message=${encodeURIComponent("Failed to start OAuth flow. Please try again.")}`,
-		);
-	}
-};

package/src/astro/routes/api/auth/passkey/[id].ts

@@ -1,124 +0,0 @@
-/**
- * PATCH/DELETE /_dineway/api/auth/passkey/[id]
- *
- * Rename or delete a passkey
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { passkeyRenameBody } from "#api/schemas.js";
-
-interface PasskeyResponse {
-	id: string;
-	name: string | null;
-	deviceType: "singleDevice" | "multiDevice";
-	backedUp: boolean;
-	createdAt: string;
-	lastUsedAt: string;
-}
-
-/**
- * PATCH - Rename a passkey
- */
-export const PATCH: APIRoute = async ({ params, request, locals }) => {
-	const { dineway, user } = locals;
-	const { id } = params;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	// Require authentication
-	if (!user) {
-		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
-	}
-
-	if (!id) {
-		return apiError("MISSING_PARAM", "Passkey ID is required", 400);
-	}
-
-	try {
-		const adapter = createKyselyAdapter(dineway.db);
-
-		// Get the credential and verify ownership
-		const credential = await adapter.getCredentialById(id);
-
-		if (!credential || credential.userId !== user.id) {
-			return apiError("NOT_FOUND", "Passkey not found", 404);
-		}
-
-		// Parse request body
-		const body = await parseBody(request, passkeyRenameBody);
-		if (isParseError(body)) return body;
-
-		// Update the name
-		const trimmedName = body.name.trim() || null;
-		await adapter.updateCredentialName(id, trimmedName);
-
-		// Return updated passkey info
-		const passkey: PasskeyResponse = {
-			id: credential.id,
-			name: trimmedName,
-			deviceType: credential.deviceType,
-			backedUp: credential.backedUp,
-			createdAt: credential.createdAt.toISOString(),
-			lastUsedAt: credential.lastUsedAt.toISOString(),
-		};
-
-		return apiSuccess({ passkey });
-	} catch (error) {
-		return handleError(error, "Failed to rename passkey", "PASSKEY_RENAME_ERROR");
-	}
-};
-
-/**
- * DELETE - Remove a passkey
- */
-export const DELETE: APIRoute = async ({ params, locals }) => {
-	const { dineway, user } = locals;
-	const { id } = params;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	// Require authentication
-	if (!user) {
-		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
-	}
-
-	if (!id) {
-		return apiError("MISSING_PARAM", "Passkey ID is required", 400);
-	}
-
-	try {
-		const adapter = createKyselyAdapter(dineway.db);
-
-		// Get the credential and verify ownership
-		const credential = await adapter.getCredentialById(id);
-
-		if (!credential || credential.userId !== user.id) {
-			return apiError("NOT_FOUND", "Passkey not found", 404);
-		}
-
-		// Check that this isn't the last passkey
-		const count = await adapter.countCredentialsByUserId(user.id);
-
-		if (count <= 1) {
-			return apiError("LAST_PASSKEY", "Cannot remove your last passkey", 400);
-		}
-
-		// Delete the passkey
-		await adapter.deleteCredential(id);
-
-		return apiSuccess({ success: true });
-	} catch (error) {
-		return handleError(error, "Failed to delete passkey", "PASSKEY_DELETE_ERROR");
-	}
-};

package/src/astro/routes/api/auth/passkey/index.ts

@@ -1,54 +0,0 @@
-/**
- * GET /_dineway/api/auth/passkey
- *
- * List all passkeys for the authenticated user
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-
-interface PasskeyResponse {
-	id: string;
-	name: string | null;
-	deviceType: "singleDevice" | "multiDevice";
-	backedUp: boolean;
-	createdAt: string;
-	lastUsedAt: string;
-}
-
-export const GET: APIRoute = async ({ locals }) => {
-	const { dineway, user } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	// Require authentication
-	if (!user) {
-		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
-	}
-
-	try {
-		const adapter = createKyselyAdapter(dineway.db);
-		const credentials = await adapter.getCredentialsByUserId(user.id);
-
-		// Map to public response format (exclude sensitive fields)
-		const passkeys: PasskeyResponse[] = credentials.map((cred) => ({
-			id: cred.id,
-			name: cred.name,
-			deviceType: cred.deviceType,
-			backedUp: cred.backedUp,
-			createdAt: cred.createdAt.toISOString(),
-			lastUsedAt: cred.lastUsedAt.toISOString(),
-		}));
-
-		return apiSuccess({ items: passkeys });
-	} catch (error) {
-		return handleError(error, "Failed to list passkeys", "PASSKEY_LIST_ERROR");
-	}
-};

package/src/astro/routes/api/auth/passkey/options.ts

@@ -1,85 +0,0 @@
-/**
- * POST /_dineway/api/auth/passkey/options
- *
- * Get authentication options for passkey login.
- *
- * Rate limited: 10 requests per minute per IP.
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
-import { generateAuthenticationOptions } from "@dineway-ai/auth/passkey";
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { isParseError, parseOptionalBody } from "#api/parse.js";
-import { getPublicOrigin } from "#api/public-url.js";
-import { passkeyOptionsBody } from "#api/schemas.js";
-import { createChallengeStore, cleanupExpiredChallenges } from "#auth/challenge-store.js";
-import { getPasskeyConfig } from "#auth/passkey-config.js";
-import { checkRateLimit, getClientIp, rateLimitResponse } from "#auth/rate-limit.js";
-import { getTrustedProxyHeaders } from "#auth/trusted-proxy.js";
-import { OptionsRepository } from "#db/repositories/options.js";
-
-export const POST: APIRoute = async ({ request, locals }) => {
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	try {
-		// Fire-and-forget cleanup of expired challenges -- prevents accumulation
-		void cleanupExpiredChallenges(dineway.db).catch(() => {});
-
-		// Parse body before rate limiting so malformed requests don't consume slots
-		const body = await parseOptionalBody(request, passkeyOptionsBody, {});
-		if (isParseError(body)) return body;
-
-		// Rate limit: 10 requests per 60 seconds per IP
-		const ip = getClientIp(request, getTrustedProxyHeaders(dineway.config));
-		const rateLimit = await checkRateLimit(dineway.db, ip, "passkey/options", 10, 60);
-		if (!rateLimit.allowed) {
-			return rateLimitResponse(60);
-		}
-
-		const adapter = createKyselyAdapter(dineway.db);
-
-		// Get credentials to allow
-		let credentials: Awaited<ReturnType<typeof adapter.getCredentialsByUserId>> = [];
-
-		if (body.email) {
-			// Get credentials for specific user
-			const user = await adapter.getUserByEmail(body.email);
-			if (user) {
-				credentials = await adapter.getCredentialsByUserId(user.id);
-			}
-			// Don't reveal if user exists - just return empty allowCredentials
-		}
-		// If no email provided, allowCredentials will be undefined (allow any discoverable credential)
-
-		// Get passkey config
-		const url = new URL(request.url);
-		const options = new OptionsRepository(dineway.db);
-		const siteName = (await options.get<string>("dineway:site_title")) ?? undefined;
-		const siteUrl = getPublicOrigin(url, dineway?.config);
-		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);
-
-		// Generate authentication options
-		const challengeStore = createChallengeStore(dineway.db);
-		const authOptions = await generateAuthenticationOptions(
-			passkeyConfig,
-			credentials,
-			challengeStore,
-		);
-
-		return apiSuccess({
-			success: true,
-			options: authOptions,
-		});
-	} catch (error) {
-		return handleError(error, "Failed to generate passkey options", "PASSKEY_OPTIONS_ERROR");
-	}
-};