dineway 0.1.9 → 0.1.11

package/src/astro/routes/api/setup/admin.ts

@@ -1,104 +0,0 @@
-/**
- * POST /_dineway/api/setup/admin
- *
- * Step 3 of setup: Start admin creation by returning passkey registration options
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { generateToken } from "@dineway-ai/auth";
-import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
-import { generateRegistrationOptions } from "@dineway-ai/auth/passkey";
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { getPublicOrigin } from "#api/public-url.js";
-import { setupAdminBody } from "#api/schemas.js";
-import { createChallengeStore } from "#auth/challenge-store.js";
-import { getPasskeyConfig } from "#auth/passkey-config.js";
-import { SETUP_NONCE_COOKIE, SETUP_NONCE_MAX_AGE_SECONDS } from "#auth/setup-nonce.js";
-import { OptionsRepository } from "#db/repositories/options.js";
-
-export const POST: APIRoute = async ({ cookies, request, locals }) => {
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	try {
-		// Check if setup is already complete
-		const options = new OptionsRepository(dineway.db);
-		const setupComplete = await options.get("dineway:setup_complete");
-
-		if (setupComplete === true || setupComplete === "true") {
-			return apiError("SETUP_COMPLETE", "Setup already complete", 400);
-		}
-
-		// Check if any users exist
-		const adapter = createKyselyAdapter(dineway.db);
-		const userCount = await adapter.countUsers();
-
-		if (userCount > 0) {
-			return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
-		}
-
-		// Parse request body
-		const body = await parseBody(request, setupAdminBody);
-		if (isParseError(body)) return body;
-
-		const nonce = generateToken();
-
-		// Get passkey config
-		const url = new URL(request.url);
-		const siteName = (await options.get<string>("dineway:site_title")) ?? undefined;
-		const siteUrl = getPublicOrigin(url, dineway?.config);
-		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);
-
-		// Generate registration options
-		const challengeStore = createChallengeStore(dineway.db);
-
-		// Create a temporary user object for registration options
-		// (not persisted until passkey is verified)
-		const tempUser = {
-			id: `setup-${Date.now()}`, // Temporary ID
-			email: body.email.toLowerCase(),
-			name: body.name || null,
-		};
-
-		const registrationOptions = await generateRegistrationOptions(
-			passkeyConfig,
-			tempUser,
-			[], // No existing credentials
-			challengeStore,
-		);
-
-		// Store the nonce with the setup state. The verify endpoint compares
-		// it to an HttpOnly cookie so the admin step stays bound to this browser.
-		await options.set("dineway:setup_state", {
-			step: "admin",
-			email: body.email.toLowerCase(),
-			name: body.name || null,
-			tempUserId: tempUser.id,
-			nonce,
-		});
-
-		const publicOrigin = new URL(siteUrl);
-		cookies.set(SETUP_NONCE_COOKIE, nonce, {
-			path: "/_dineway/",
-			httpOnly: true,
-			sameSite: "strict",
-			secure: publicOrigin.protocol === "https:",
-			maxAge: SETUP_NONCE_MAX_AGE_SECONDS,
-		});
-
-		return apiSuccess({
-			success: true,
-			options: registrationOptions,
-		});
-	} catch (error) {
-		return handleError(error, "Failed to create admin", "SETUP_ADMIN_ERROR");
-	}
-};

package/src/astro/routes/api/setup/dev-bypass.ts

@@ -1,200 +0,0 @@
-/**
- * POST /_dineway/api/setup/dev-bypass
- * GET  /_dineway/api/setup/dev-bypass
- *
- * Development-only endpoint to bypass the setup wizard.
- * Runs migrations, creates a dev admin user, and marks setup complete.
- *
- * ONLY available when import.meta.env.DEV is true.
- *
- * Usage:
- * - GET with redirect: /_dineway/api/setup/dev-bypass?redirect=/_dineway/admin
- * - POST for API: Returns JSON with setup info
- *
- * For agent/browser testing, navigate to:
- *   /_dineway/api/setup/dev-bypass?redirect=/_dineway/admin
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { ulid } from "ulidx";
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { escapeHtml } from "#api/escape.js";
-import { handleApiTokenCreate } from "#api/handlers/api-tokens.js";
-import { getPublicOrigin } from "#api/public-url.js";
-import { isSafeRedirect } from "#api/redirect.js";
-import { runMigrations } from "#db/migrations/runner.js";
-import { OptionsRepository } from "#db/repositories/options.js";
-import { applySeed } from "#seed/apply.js";
-import { loadSeed } from "#seed/load.js";
-import { validateSeed } from "#seed/validate.js";
-
-// RBAC role levels (matching @dineway-ai/auth)
-const ROLE_ADMIN = 50;
-
-const DEV_USER_EMAIL = "dev@dineway.local";
-const DEV_USER_NAME = "Dev Admin";
-const DEV_SITE_TITLE = "Dineway Dev Site";
-
-async function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Response> {
-	// CRITICAL: Only allow in development mode
-	if (!import.meta.env.DEV) {
-		return apiError("FORBIDDEN", "Dev bypass is only available in development mode", 403);
-	}
-
-	const { locals, url, session } = context;
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	try {
-		// Run migrations
-		const migrations = await runMigrations(dineway.db);
-		console.log("[setup-dev-bypass] Migrations applied:", migrations.applied);
-
-		// Apply seed (user seed or built-in default)
-		const seed = await loadSeed();
-		const validation = validateSeed(seed);
-		if (validation.valid) {
-			const seedResult = await applySeed(dineway.db, seed, {
-				includeContent: true,
-				onConflict: "skip",
-				storage: dineway.storage ?? undefined,
-			});
-			console.log(
-				`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`,
-			);
-		}
-
-		const options = new OptionsRepository(dineway.db);
-
-		// Find or create dev user (direct DB access to avoid @dineway-ai/auth import issues in dev)
-		const existingUser = await dineway.db
-			.selectFrom("users")
-			.selectAll()
-			.where("email", "=", DEV_USER_EMAIL)
-			.executeTakeFirst();
-
-		let user: { id: string; email: string; name: string; role: number };
-		let userCreated = false;
-
-		if (!existingUser) {
-			const now = new Date().toISOString();
-			const newUser = {
-				id: ulid(),
-				email: DEV_USER_EMAIL,
-				name: DEV_USER_NAME,
-				role: ROLE_ADMIN,
-				email_verified: 1,
-				created_at: now,
-				updated_at: now,
-			};
-
-			await dineway.db.insertInto("users").values(newUser).execute();
-
-			user = {
-				id: newUser.id,
-				email: newUser.email,
-				name: newUser.name,
-				role: newUser.role,
-			};
-			userCreated = true;
-			console.log("[setup-dev-bypass] Created dev admin user:", user.email);
-		} else {
-			user = {
-				id: existingUser.id,
-				email: existingUser.email,
-				name: existingUser.name || DEV_USER_NAME,
-				role: existingUser.role,
-			};
-		}
-
-		// Set site title if not already set
-		const existingTitle = await options.get("dineway:site_title");
-		if (!existingTitle) {
-			await options.set("dineway:site_title", DEV_SITE_TITLE);
-		}
-
-		// Store canonical site URL (used by magic-link/recovery emails)
-		await options.set("dineway:site_url", getPublicOrigin(url, dineway?.config));
-
-		// Mark setup complete
-		await options.set("dineway:setup_complete", true);
-
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
-
-		// Optionally create a PAT token (?token=1) for headless/CLI testing.
-		let token: string | undefined;
-		if (url.searchParams.has("token")) {
-			const result = await handleApiTokenCreate(dineway.db, user.id, {
-				name: "dev-bypass-token",
-				scopes: [
-					"content:read",
-					"content:write",
-					"media:read",
-					"media:write",
-					"schema:read",
-					"schema:write",
-					"admin",
-				],
-			});
-			if (result.success) {
-				token = result.data.token;
-			}
-		}
-
-		// Check for redirect parameter
-		const redirect = url.searchParams.get("redirect");
-
-		if (redirect) {
-			// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\evil.com)
-			if (!isSafeRedirect(redirect)) {
-				return apiError("INVALID_REDIRECT", "Redirect must be a local path", 400);
-			}
-
-			// Return an HTML page with meta-refresh redirect
-			// This ensures the session is fully saved before redirect
-			const safeRedirect = escapeHtml(redirect);
-			const html = `<!DOCTYPE html>
-<html>
-<head>
-	<meta http-equiv="refresh" content="0;url=${safeRedirect}">
-</head>
-<body>Redirecting...</body>
-</html>`;
-			return new Response(html, {
-				status: 200,
-				headers: { "Content-Type": "text/html" },
-			});
-		}
-
-		// Return JSON response
-		return apiSuccess({
-			success: true,
-			message: "Dev setup complete",
-			migrations: migrations.applied,
-			userCreated,
-			user: {
-				id: user.id,
-				email: user.email,
-				name: user.name,
-				role: user.role,
-			},
-			...(token ? { token } : {}),
-		});
-	} catch (error) {
-		return handleError(error, "Dev bypass failed", "DEV_BYPASS_ERROR");
-	}
-}
-
-// Support both GET and POST
-export const GET: APIRoute = handleDevBypass;
-export const POST: APIRoute = handleDevBypass;

package/src/astro/routes/api/setup/dev-reset.ts

@@ -1,40 +0,0 @@
-/**
- * POST /_dineway/api/setup/dev-reset
- *
- * Development-only endpoint to reset setup state for testing.
- * Clears the setup_complete flag and deletes all users,
- * returning the site to the pre-setup state.
- *
- * ONLY available when import.meta.env.DEV is true.
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { OptionsRepository } from "#db/repositories/options.js";
-
-export const POST: APIRoute = async ({ locals }) => {
-	if (!import.meta.env.DEV) {
-		return apiError("FORBIDDEN", "Dev reset is only available in development mode", 403);
-	}
-
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	try {
-		const options = new OptionsRepository(dineway.db);
-
-		await options.delete("dineway:setup_complete");
-		await options.delete("dineway:setup_state");
-		await dineway.db.deleteFrom("users").execute();
-
-		return apiSuccess({ success: true });
-	} catch (error) {
-		return handleError(error, "Dev reset failed", "DEV_RESET_ERROR");
-	}
-};

package/src/astro/routes/api/setup/index.ts

@@ -1,128 +0,0 @@
-/**
- * POST /_dineway/api/setup
- *
- * Executes the setup wizard - applies seed file and marks setup complete
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { getPublicOrigin } from "#api/public-url.js";
-import { setupBody } from "#api/schemas.js";
-import { getAuthMode } from "#auth/mode.js";
-import { runMigrations } from "#db/migrations/runner.js";
-import { OptionsRepository } from "#db/repositories/options.js";
-import { applySeed } from "#seed/apply.js";
-import { loadSeed } from "#seed/load.js";
-import { validateSeed } from "#seed/validate.js";
-
-export const POST: APIRoute = async ({ request, url, locals }) => {
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	try {
-		// Guard: reject if setup has already been completed.
-		// The options table may not exist on first-ever setup (pre-migration),
-		// so a query failure means setup hasn't run yet — allow it to proceed.
-		try {
-			const options = new OptionsRepository(dineway.db);
-			const setupComplete = await options.get("dineway:setup_complete");
-
-			if (setupComplete === true || setupComplete === "true") {
-				return apiError("ALREADY_CONFIGURED", "Setup has already been completed", 409);
-			}
-		} catch {
-			// Options table doesn't exist yet — first-ever setup, allow it
-		}
-
-		// Parse request body
-		const body = await parseBody(request, setupBody);
-		if (isParseError(body)) return body;
-
-		// 1. Run core migrations
-		try {
-			await runMigrations(dineway.db);
-		} catch (error) {
-			return handleError(error, "Failed to run database migrations", "MIGRATION_ERROR");
-		}
-
-		// 2. Load seed file (user seed or built-in default)
-		const seed = await loadSeed();
-
-		// 3. Override seed settings with form values
-		seed.settings = {
-			...seed.settings,
-			title: body.title,
-			tagline: body.tagline,
-		};
-
-		// 4. Apply seed
-		const validation = validateSeed(seed);
-		if (!validation.valid) {
-			return apiError("INVALID_SEED", `Invalid seed file: ${validation.errors.join(", ")}`, 400);
-		}
-
-		let result;
-		try {
-			result = await applySeed(dineway.db, seed, {
-				includeContent: body.includeContent,
-				onConflict: "skip",
-				storage: dineway.storage ?? undefined,
-			});
-		} catch (error) {
-			return handleError(error, "Failed to apply seed", "SEED_ERROR");
-		}
-
-		// 5. Store setup state
-		// In external auth mode, mark setup complete immediately (first user to login becomes admin)
-		// In passkey mode, setup_complete is set after admin user is created
-		const authMode = getAuthMode(dineway.config);
-		const useExternalAuth = authMode.type === "external";
-
-		try {
-			const options = new OptionsRepository(dineway.db);
-
-			// Store the canonical site URL from the setup request.
-			// Keep the first value so later unauthenticated setup calls cannot
-			// rewrite the public origin during the setup window.
-			const siteUrl = getPublicOrigin(url, dineway.config);
-			await options.setIfAbsent("dineway:site_url", siteUrl);
-
-			if (useExternalAuth) {
-				// External auth mode: mark setup complete now
-				// First user to log in via external provider will become admin
-				await options.set("dineway:setup_complete", true);
-				await options.set("dineway:site_title", body.title);
-				if (body.tagline) {
-					await options.set("dineway:site_tagline", body.tagline);
-				}
-			} else {
-				// Passkey mode: store state for next step (admin creation)
-				await options.set("dineway:setup_state", {
-					step: "site_complete",
-					title: body.title,
-					tagline: body.tagline,
-				});
-			}
-		} catch (error) {
-			console.error("Failed to save setup state:", error);
-			// Non-fatal - continue anyway
-		}
-
-		// 6. Return success with result
-		return apiSuccess({
-			success: true,
-			// In external auth mode, setup is complete - redirect to admin
-			setupComplete: useExternalAuth,
-			result,
-		});
-	} catch (error) {
-		return handleError(error, "Setup failed", "SETUP_ERROR");
-	}
-};

package/src/astro/routes/api/setup/status.ts

@@ -1,122 +0,0 @@
-/**
- * GET /_dineway/api/setup/status
- *
- * Returns setup status and seed file information
- */
-
-import type { APIRoute } from "astro";
-
-export const prerender = false;
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { getAuthMode } from "#auth/mode.js";
-import { loadUserSeed } from "#seed/load.js";
-
-export const GET: APIRoute = async ({ locals }) => {
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	try {
-		// Check if setup is complete
-		const setupComplete = await dineway.db
-			.selectFrom("options")
-			.select("value")
-			.where("name", "=", "dineway:setup_complete")
-			.executeTakeFirst();
-
-		// Value is JSON-encoded, parse it. Accepts both boolean true and string "true"
-		const isComplete =
-			setupComplete &&
-			(() => {
-				try {
-					const parsed = JSON.parse(setupComplete.value);
-					return parsed === true || parsed === "true";
-				} catch {
-					return false;
-				}
-			})();
-
-		// Also check if users exist
-		let hasUsers = false;
-		try {
-			const userCount = await dineway.db
-				.selectFrom("users")
-				.select((eb) => eb.fn.countAll<number>().as("count"))
-				.executeTakeFirstOrThrow();
-			hasUsers = userCount.count > 0;
-		} catch {
-			// Users table might not exist yet
-		}
-
-		// Setup is complete only if flag is set AND users exist
-		if (isComplete && hasUsers) {
-			return apiSuccess({
-				needsSetup: false,
-			});
-		}
-
-		// Determine current step
-		// step: "start" | "site" | "admin" | "complete"
-		let step: "start" | "site" | "admin" = "start";
-
-		// Get setup state if it exists
-		const setupState = await dineway.db
-			.selectFrom("options")
-			.select("value")
-			.where("name", "=", "dineway:setup_state")
-			.executeTakeFirst();
-
-		if (setupState) {
-			try {
-				const state = JSON.parse(setupState.value);
-				if (state.step === "admin") {
-					step = "admin";
-				} else if (state.step === "site") {
-					step = "site";
-				}
-			} catch {
-				// Invalid state, stay at start
-			}
-		}
-
-		// If setup_complete but no users, jump to admin step
-		if (isComplete && !hasUsers) {
-			step = "admin";
-		}
-
-		// Check auth mode
-		const authMode = getAuthMode(dineway.config);
-		const useExternalAuth = authMode.type === "external";
-
-		// In external auth mode, setup is complete if flag is set (no users required initially)
-		if (useExternalAuth && isComplete) {
-			return apiSuccess({
-				needsSetup: false,
-			});
-		}
-
-		// Setup needed - try to load seed file info
-		const seed = await loadUserSeed();
-		const seedInfo = seed
-			? {
-					name: seed.meta?.name || "Unknown Template",
-					description: seed.meta?.description || "",
-					collections: seed.collections?.length || 0,
-					hasContent: !!(seed.content && Object.keys(seed.content).length > 0),
-				}
-			: null;
-
-		return apiSuccess({
-			needsSetup: true,
-			step,
-			seedInfo,
-			// Tell the wizard which auth mode is active
-			authMode: useExternalAuth ? authMode.providerType : "passkey",
-		});
-	} catch (error) {
-		return handleError(error, "Failed to check setup status", "SETUP_STATUS_ERROR");
-	}
-};

package/src/astro/routes/api/snapshot.ts

@@ -1,76 +0,0 @@
-/**
- * Snapshot endpoint — exports a portable database snapshot for preview mode.
- *
- * Security:
- * - Authenticated users: requires content:read + schema:read permissions
- * - Preview services: requires valid X-Preview-Signature header (HMAC-SHA256)
- * - Excludes auth/user/session/token tables
- */
-
-import type { APIRoute } from "astro";
-
-import { requirePerm } from "#api/authorize.js";
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import {
-	generateSnapshot,
-	parsePreviewSignatureHeader,
-	verifyPreviewSignature,
-} from "#api/handlers/snapshot.js";
-import { getPublicOrigin } from "#api/public-url.js";
-
-export const prerender = false;
-
-export const GET: APIRoute = async ({ request, locals, url }) => {
-	const { dineway, user } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	// Check for preview signature auth (used by preview sidecars)
-	const previewSig = request.headers.get("X-Preview-Signature");
-	let authorized = false;
-
-	if (previewSig) {
-		const secret = import.meta.env.DINEWAY_PREVIEW_SECRET || import.meta.env.PREVIEW_SECRET || "";
-		if (!secret) {
-			console.warn(
-				"[snapshot] X-Preview-Signature header present but no PREVIEW_SECRET configured",
-			);
-		} else {
-			const parsed = parsePreviewSignatureHeader(previewSig);
-			if (!parsed) {
-				console.warn("[snapshot] Failed to parse X-Preview-Signature header");
-			} else {
-				authorized = await verifyPreviewSignature(parsed.source, parsed.exp, parsed.sig, secret);
-				if (!authorized) {
-					console.warn("[snapshot] Preview signature verification failed", {
-						source: parsed.source,
-						exp: parsed.exp,
-						expired: parsed.exp < Date.now() / 1000,
-					});
-				}
-			}
-		}
-	}
-
-	if (!authorized) {
-		// Fall back to standard user auth
-		const contentDenied = requirePerm(user, "content:read");
-		if (contentDenied) return contentDenied;
-		const schemaDenied = requirePerm(user, "schema:read");
-		if (schemaDenied) return schemaDenied;
-	}
-
-	try {
-		const includeDrafts = url.searchParams.get("drafts") === "true";
-		const snapshot = await generateSnapshot(dineway.db, {
-			includeDrafts,
-			origin: getPublicOrigin(url, dineway.config),
-		});
-
-		return apiSuccess(snapshot);
-	} catch (error) {
-		return handleError(error, "Failed to generate snapshot", "SNAPSHOT_ERROR");
-	}
-};