emdash-multisite 0.0.0-stage → 0.7.0

package/src/middleware.ts

@@ -0,0 +1,607 @@
+import { after } from "emdash";
+import { runAsSite } from "./dialect.ts";
+import { EDGE_REQUEST_HEADER, classifyEdit, purgeSiteCache, tagSite, touchesPublicPage } from "./edge-cache.ts";
+import { appearanceState, canManage, checkAddress, consoleState } from "./console.ts";
+import { consolePageHtml } from "./console-page.ts";
+import { isStaff, listSites } from "./fleet.ts";
+import {
+	ORG_CREATE_PATH,
+	buildTemplate,
+	createSiteForOrg,
+	parseCreatedOrg,
+	pendingReconcile,
+	planFor,
+	readStatus,
+	reconcile,
+	signUpOpenCached,
+	slugProblem,
+	switchTheme,
+} from "./orgs.ts";
+import {
+	consumeHandoffNonce,
+	handoffSecret,
+	isEmailVerified,
+	readAllStates,
+	readOrgs,
+	readSiteState,
+	readSiteTheme,
+	resolveLimits,
+	siteExists,
+	siteHasTables,
+	siteHasUser,
+	warm,
+	writeSiteState,
+} from "./registry.ts";
+import { overLimit } from "./abuse.ts";
+import { demoUrls } from "./demo.ts";
+import { log } from "./log.ts";
+import { PASSWORD_PATHS, syncRecentPasswords } from "./passwords.ts";
+import { backupSite, listBackups, restoreSite } from "./backup.ts";
+import { sitesConfig } from "./config.ts";
+import { safeNext, signHandoff, verifyHandoff } from "./handoff.ts";
+import { purgeSite } from "./purge.ts";
+import { siteUrl } from "./sites.ts";
+import { sql } from "kysely";
+import { getDb } from "emdash/runtime";
+import { effectiveLimits, TEMPLATE_PREFIX, demoBannerHtml, demoGuard, isTemplateId, lostLimitRace, SIGNUP_PATH, emailDomainBlocked, DEFAULT_DELETE_GRACE_DAYS, DEFAULT_LIMITS, DEFAULT_POST_LOGIN_PATH, csrfOk, isPurgeDue, loginEntryRedirect, transition, type SiteState, type StateAction, createProblem, needsReconcile, effectiveTheme, isThemeRouteRequest, isThemed, themeFromMetadata, themeProblem, themeRoute } from "./rules.ts";
+import { isSiteId } from "./rewrite.ts";
+import { forgetSiteSettings, scopeState } from "./scope.ts";
+import { resolveSite, type SitesConfig } from "./sites.ts";
+
+/**
+ * Outer middleware: runs BEFORE EmDash's own, and wraps the whole request in
+ * the site its hostname maps to.
+ *
+ * Why it exists: EmDash reads its runtime and caches at the very top of a
+ * request, before the per-site database handle exists. Setting the site here
+ * means every per-site cache and the runtime resolve to the right site from the
+ * first line of the request.
+ *
+ * On the control-plane (primary) site it also turns "create an organization"
+ * into "create a site" (see orgs.ts) and serves
+ * GET /api/multisite/sites/<slug> so a page can poll provisioning.
+ *
+ * Wire it through EmDash's supported hook:
+ *   emdash({ middleware: { outer: "emdash-multisite/middleware" } })
+ */
+
+/** Astro's `next`; a path argument rewrites the request. */
+type Next = (rewrite?: string) => Promise<Response>;
+interface Session {
+	get(key: string): unknown | Promise<unknown>;
+	set(key: string, value: unknown): void;
+}
+interface Ctx {
+	url: URL;
+	request: Request;
+	/** Astro's per-request locals; themes read what we set here. */
+	locals?: Record<string, unknown>;
+	session?: Session;
+}
+
+const STATUS_PREFIX = "/api/multisite/sites/";
+const RECONCILE_API = "/api/multisite/reconcile";
+const TEMPLATES_API = "/api/multisite/templates";
+const FLEET_API = "/api/multisite/fleet";
+const FLEET_PAGE = "/admin/fleet";
+const FLEET_NATIVE_PAGE = "/_emdash/admin/plugins/multisite/site";
+const forbidden = () => new Response(JSON.stringify({ code: "CSRF", message: "Missing or cross-site request." }), {
+	status: 403,
+	headers: { "content-type": "application/json", "cache-control": "no-store" },
+});
+const html = (body: string, status: number) =>
+	new Response(body, { status, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } });
+
+/** The signed-in EmDash user id, or null. Set by emdash-better-auth as session "user" = { id }. */
+async function sessionUserId(ctx: Ctx): Promise<string | null> {
+	try {
+		const u = (await ctx.session?.get("user")) as { id?: string } | undefined;
+		return u?.id ?? null;
+	} catch {
+		return null;
+	}
+}
+const json = (body: unknown, status: number) =>
+	new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json", "cache-control": "no-store" } });
+
+/**
+ * `POST /api/auth/organization/create`: refuse before the org exists.
+ * Bad address, unverified email, or over a limit. Anonymous callers fall
+ * through so Better Auth answers 401 itself.
+ */
+/** Provision a just-created site, unless it lost a creation race (see `lostLimitRace`): then it is deleted unprovisioned. */
+async function createOrRejectSite(sites: SitesConfig, org: NonNullable<ReturnType<typeof parseCreatedOrg>>): Promise<void> {
+	const states = await readAllStates();
+	// Plan-aware limit: a subscriber's cap, not the static config cap, so an
+	// upgraded user is not stripped of a legitimately-allowed site by the race
+	// check. Falls back to the free tier when they have no subscription.
+	const raceLimits = org.ownerUserId
+		? await resolveLimits(org.ownerUserId, sites.limits)
+		: effectiveLimits(sites.limits);
+	if (lostLimitRace(org.slug, await readOrgs(), new Set([...states].filter(([, v]) => v.state === "deleted").map(([k]) => k)), raceLimits)) {
+		log("create.race_lost", { site: org.slug, user: org.ownerUserId });
+		await writeSiteState(org.slug, { state: "deleted", at: new Date().toISOString(), reason: "over the site limit (parallel requests)" });
+		await purgeSiteCache(org.slug);
+		return;
+	}
+	await createSiteForOrg(org, planFor(sites, { theme: org.theme }));
+}
+const tooMany = () =>
+	new Response(JSON.stringify({ code: "RATE_LIMITED", message: "Too many requests. Try again in a minute." }), {
+		status: 429,
+		headers: { "content-type": "application/json", "cache-control": "no-store", "retry-after": "60" },
+	});
+/** Sign-up: refuse throwaway-mail domains and brake bursts per client IP. Null = let it through.
+ *
+ * Turnstile is NOT verified here. Better Auth's own `captcha` plugin (emdash-better-auth auth.ts)
+ * verifies the `x-captcha-response` header against TURNSTILE_SECRET on the sign-up request. A
+ * Turnstile token is SINGLE-USE, so a second verifier here consumed the token first and made the
+ * plugin's verify fail with VERIFICATION_FAILED (and before that, reading the body — where the
+ * token never is — failed with TURNSTILE_MISSING). One verifier only: Better Auth's captcha plugin. */
+async function guardSignup(ctx: Ctx, sites: SitesConfig): Promise<Response | null> {
+	const body = (await ctx.request.clone().json().catch(() => null)) as { email?: unknown } | null;
+	if (emailDomainBlocked(body?.email, sites.blockedEmailDomains)) {
+		log("signup.blocked_domain");
+		return json({ code: "EMAIL_DOMAIN_BLOCKED", message: "Please sign up with a permanent email address." }, 400);
+	}
+	if (await overLimit("SIGNUP_LIMITER", ctx.request.headers.get("cf-connecting-ip") ?? "unknown")) {
+		log("signup.rate_limited");
+		return tooMany();
+	}
+	return null;
+}
+async function guardOrgCreate(ctx: Ctx, sites: SitesConfig): Promise<Response | null> {
+	const { primary } = sites;
+	let body: { slug?: unknown; metadata?: unknown } | null = null;
+	try {
+		body = (await ctx.request.clone().json()) as { slug?: unknown; metadata?: unknown };
+	} catch {
+		return null; // not JSON: let Better Auth produce its own error
+	}
+	const addressProblem = slugProblem(body?.slug, primary);
+	if (addressProblem) return json({ code: "INVALID_SITE_ADDRESS", message: addressProblem }, 400);
+
+	const themeIssue = themeProblem(themeFromMetadata(body?.metadata) ?? undefined, sites.themes);
+	if (themeIssue && sites.themes) return json({ code: "INVALID_THEME", message: themeIssue }, 400);
+
+	const userId = await sessionUserId(ctx);
+	if (!userId) return null;
+	if (await overLimit("CREATE_LIMITER", userId)) {
+		log("create.rate_limited", { user: userId });
+		return tooMany();
+	}
+	// OP-13: Per-IP site creation cap (prevents one IP from creating many sites via different accounts)
+	const clientIp = ctx.request.headers.get("cf-connecting-ip") ?? "unknown";
+	if (await overLimit("CREATE_IP_LIMITER", clientIp)) {
+		log("create.ip_rate_limited", { ip: clientIp });
+		return tooMany();
+	}
+	const orgs = await readOrgs();
+	const states = await readAllStates();
+	// Plan-aware limit (OP-11): a subscriber gets their plan's cap, everyone else
+	// the free tier. Replaces the former static `effectiveLimits(sites.limits)`.
+	const limits = await resolveLimits(userId, sites.limits);
+	const problem = createProblem(
+		{
+			userId,
+			emailVerified: await isEmailVerified(userId),
+			owned: orgs.filter((o) => o.ownerUserId === userId && states.get(o.slug)?.state !== "deleted").length,
+			total: orgs.filter((o) => states.get(o.slug)?.state !== "deleted").length,
+		},
+		limits,
+	);
+	return problem ? json({ code: problem.code, message: problem.message }, problem.status) : null;
+}
+
+/**
+ * Hand the request to EmDash, rewritten to the site's theme subtree when the
+ * path is a public page. With no themes configured nothing is rewritten and
+ * the host's own pages serve every site.
+ *
+ * Direct requests to the subtree (`/theme-routes/...`) are refused: they would
+ * skip site selection and show one theme's pages on another site's host.
+ */
+async function themedNext(ctx: Ctx, sites: SitesConfig, site: string, next: Next, opts: { authLinks?: boolean } = {}): Promise<Response> {
+	if (!sites.themes) return next();
+	const { pathname } = ctx.url;
+	if (isThemeRouteRequest(pathname)) return new Response("Not found", { status: 404 });
+	if ((ctx.request.method !== "GET" && ctx.request.method !== "HEAD") || !isThemed(pathname)) return next();
+	await warm();
+	const theme = effectiveTheme(await readSiteTheme(site, ctx.request.headers.has(EDGE_REQUEST_HEADER)), sites.themes, sites.defaultTheme);
+	if (sites.authLinks && opts.authLinks !== false) {
+		// The control plane is always open for sign-up; a customer site follows its own setting.
+		const primary = site === sites.primary;
+		(ctx.locals ??= {}).multisite = { signup: primary || (await signUpOpenCached(site)), account: primary ? "/account/sites" : "/account" };
+	}
+	return next(themeRoute(theme, pathname) + ctx.url.search);
+}
+
+// Workers global; absent on Node, where the demo simply has no strip.
+declare const HTMLRewriter: (new () => { on(sel: string, h: object): { transform(r: Response): Response } }) | undefined;
+
+/** A template site as a public demo: read-only, with a strip offering to use the theme. */
+async function serveDemo(ctx: Ctx, sites: SitesConfig, site: string, next: Next): Promise<Response> {
+	const refused = demoGuard(ctx.request.method, ctx.url.pathname);
+	if (refused) return new Response(refused === 405 ? "Method not allowed" : "Not found", { status: refused, headers: { allow: "GET, HEAD" } });
+	const response = await themedNext(ctx, sites, site, next, { authLinks: false });
+	const theme = site.slice(TEMPLATE_PREFIX.length);
+	if (!sites.appUrl || !response.headers.get("content-type")?.includes("text/html") || typeof HTMLRewriter === "undefined") return response;
+	const banner = demoBannerHtml(sites.themes?.[theme]?.name ?? theme, `${sites.appUrl}/account/sites?new=1&theme=${encodeURIComponent(theme)}`);
+	return new HTMLRewriter().on("body", { element: (el: { append(c: string, o: { html: boolean }): void }) => el.append(banner, { html: true }) }).transform(response);
+}
+
+/** What visitors of a suspended or deleted site see. A deleted site is indistinguishable from one that never existed. */
+function unavailable(state: SiteState): Response {
+	return state.state === "deleted"
+		? html("<!doctype html><meta charset=utf-8><title>Not found</title><h1>Not found</h1>", 404)
+		: html("<!doctype html><meta charset=utf-8><title>Site unavailable</title><h1>This site is unavailable</h1><p>It has been suspended. If this is your site, contact support.</p>", 503);
+}
+
+const HANDOFF_PATH = "/_multisite/handoff";
+const noStore = { "cache-control": "no-store", "referrer-policy": "no-referrer" };
+const redirectTo = (location: string) => new Response(null, { status: 302, headers: { location, ...noStore } });
+const handoffFailed = () =>
+	html("<!doctype html><meta charset=utf-8><title>Link expired</title><p>This sign-in link has expired or was already used. Go back and open the admin again.</p>", 403);
+
+/**
+ * Tenant side of "Open admin": check the signed link the control plane made,
+ * accept it once, start the user's session on this site and go to the admin.
+ */
+async function acceptHandoff(ctx: Ctx, site: string): Promise<Response> {
+	const token = ctx.url.searchParams.get("t") ?? "";
+	await warm();
+	const claims = await verifyHandoff(await handoffSecret(), token, site);
+	if (!claims) return handoffFailed();
+	if (!(await siteHasUser(site, claims.uid))) return handoffFailed();
+	if (!(await consumeHandoffNonce(site, claims.nonce, claims.exp))) return handoffFailed();
+	ctx.session?.set("user", { id: claims.uid });
+	return redirectTo(safeNext(ctx.url.searchParams.get("next")));
+}
+
+/**
+ * Entry point. Labels successful GETs with their site when the cached entrypoint asked for it (see edge-cache.ts), and purges
+ * the site's cached pages after an admin write that changes a public page but has no plugin hook (menus, settings, ...).
+ */
+export async function onRequest(context: Ctx, next: Next): Promise<Response> {
+	const { method } = context.request;
+	const edit = classifyEdit(method, context.url.pathname);
+	// The body can be read only once: peek at a clone before the route consumes it. Only content saves need it.
+	const body = edit && edit !== "always" ? await context.request.clone().json().catch(() => null) : null;
+	const response = await handle(context, next);
+	if (edit && response.status >= 200 && response.status < 300 && touchesPublicPage(edit, body)) {
+		const sites = sitesConfig();
+		if (sites) {
+			const site = resolveSite(context.url.hostname, sites);
+			after(async () => void (await purgeSiteCache(site)));
+		}
+	}
+	if (!context.request.headers.has(EDGE_REQUEST_HEADER)) return response;
+	const sites = sitesConfig();
+	return sites ? tagSite(response, method, resolveSite(context.url.hostname, sites)) : response;
+}
+
+async function handle(context: Ctx, next: Next): Promise<Response> {
+	// Renders that fill the edge cache must not trust per-isolate memos of site existence / state / theme (see registry.ts).
+	const fresh = context.request.headers.has(EDGE_REQUEST_HEADER);
+	const sites = sitesConfig();
+	if (!sites) return next();
+	const state = scopeState();
+	state.primary = sites.primary;
+	const site = resolveSite(context.url.hostname, sites);
+
+	return runAsSite(site, async () => {
+		if (fresh) forgetSiteSettings();
+		if (site !== sites.primary) {
+			await warm();
+			// Never start the runtime of a site that does not exist: it would create the site's tables.
+			if (!(await siteExists(site, fresh))) return html("<!doctype html><meta charset=utf-8><title>Not found</title><h1>Not found</h1>", 404);
+			const blocked = await readSiteState(site, fresh);
+			if (blocked) return unavailable(blocked);
+			if (isTemplateId(site)) return serveDemo(context, sites, site, next);
+			if (context.request.method === "GET" && context.url.pathname === HANDOFF_PATH) return acceptHandoff(context, site);
+			return themedNext(context, sites, site, next);
+		}
+		const { pathname } = context.url;
+		const { method } = context.request;
+		if (pathname.startsWith("/api/multisite/") || pathname === FLEET_PAGE || pathname === ORG_CREATE_PATH || pathname.startsWith("/_multisite/") || /^\/sites\/[^/]+\/open-admin$/.test(pathname)) await warm();
+
+		// Organization deletes would orphan the site's tables; deleting goes through the state route.
+		if (method === "POST" && pathname === "/api/auth/organization/delete") {
+			return json({ code: "USE_DELETE_SITE", message: "Delete the site from My sites instead." }, 403);
+		}
+
+		// Suspend / resume (staff) and delete / restore: the site's operational state.
+		const stateApi = /^\/api\/multisite\/sites\/([a-z0-9-]+)\/state$/.exec(pathname);
+		if (method === "POST" && stateApi) {
+			if (!csrfOk(context.request.headers, context.url.origin)) return forbidden();
+			const slug = stateApi[1]!;
+			const userId = await sessionUserId(context);
+			if (!userId) return json({ code: "UNAUTHORIZED" }, 401);
+			let body: { action?: unknown } | null = null;
+			try {
+				body = (await context.request.json()) as { action?: unknown };
+			} catch {
+				return json({ code: "BAD_REQUEST" }, 400);
+			}
+			const action = body?.action as StateAction;
+			if (!["suspend", "resume", "delete", "restore"].includes(action)) return json({ code: "BAD_REQUEST" }, 400);
+			const org = (await readOrgs()).find((o) => o.slug === slug);
+			if (!org || slug === sites.primary) return json({ code: "NOT_FOUND" }, 404);
+			const staff = await isStaff(userId);
+			const owner = org.ownerUserId === userId;
+			if (!staff && !owner) return json({ code: "NOT_FOUND" }, 404);
+			const result = transition(await readSiteState(slug), action, { staff, owner });
+			if (!result.ok) return json({ code: result.code }, result.status);
+			await writeSiteState(slug, result.next ? { state: result.next, at: new Date().toISOString(), reason: `${action} by ${userId}` } : null);
+			// the site's cached pages must go offline / change NOW, not at the TTL
+			await purgeSiteCache(slug);
+			return json({ state: result.next ?? "active" }, 200);
+		}
+
+		// Purge a deleted site for good (staff). Normally the cron does this after the grace period.
+		const purgeApi = /^\/api\/multisite\/sites\/([a-z0-9-]+)\/purge$/.exec(pathname);
+		if (method === "POST" && purgeApi) {
+			if (!csrfOk(context.request.headers, context.url.origin)) return forbidden();
+			const slug = purgeApi[1]!;
+			if (!(await isStaff(await sessionUserId(context)))) return json({ code: "FORBIDDEN" }, 403);
+			const current = await readSiteState(slug);
+			if (current?.state !== "deleted" || slug === sites.primary) return json({ code: "INVALID_STATE" }, 409);
+			const body = (await context.request.json().catch(() => null)) as { force?: unknown } | null;
+			const graceDays = sites.deleteGraceDays ?? DEFAULT_DELETE_GRACE_DAYS;
+			if (body?.force !== true && !isPurgeDue(current, graceDays, Date.now())) {
+				return json({ code: "NOT_DUE", message: `Deleted sites are kept ${graceDays} days.` }, 409);
+			}
+			after(async () => {
+				try {
+					await runAsSite(site, () => purgeSite(slug));
+				} catch (error) {
+					console.error(`[multisite] purging "${slug}" failed:`, error);
+				}
+			});
+			return json({ purging: true }, 202);
+		}
+
+		// Appearance: the owner's theme picker for one site.
+		const appearancePage = /^\/sites\/([a-z0-9-]+)\/appearance$/.exec(pathname);
+		if (method === "GET" && appearancePage) {
+			if (!(await sessionUserId(context))) {
+				return Response.redirect(new URL(`/login?redirect=${encodeURIComponent(pathname)}`, context.url), 302);
+			}
+			// With the account tab, theme switching lives there (one home for it); the standalone page is for hosts without the tab.
+			if (sites.accountTab) return redirectTo(`/account/sites?appearance=${appearancePage[1]}`);
+			return html(consolePageHtml("appearance", appearancePage[1]), 200);
+		}
+		const appearanceApi = /^\/api\/multisite\/sites\/([a-z0-9-]+)\/(appearance|theme)$/.exec(pathname);
+		if (appearanceApi) {
+			const [, slug, kind] = appearanceApi as unknown as [string, string, string];
+			const userId = await sessionUserId(context);
+			if (!userId) return json({ code: "UNAUTHORIZED" }, 401);
+			if (!(await canManage(userId, slug, sites.primary))) return json({ code: "FORBIDDEN" }, 403);
+			if (method === "GET" && kind === "appearance") {
+				const state = await appearanceState(slug, sites);
+				return state ? json(state, 200) : json({ code: "NOT_FOUND" }, 404);
+			}
+			if (method === "POST" && kind === "theme") {
+				if (!csrfOk(context.request.headers, context.url.origin)) return forbidden();
+				let body: { theme?: unknown; includeContent?: unknown } | null = null;
+				try {
+					body = (await context.request.json()) as { theme?: unknown; includeContent?: unknown };
+				} catch {
+					return json({ code: "BAD_REQUEST" }, 400);
+				}
+				const issue = themeProblem(body?.theme, sites.themes);
+				if (issue || typeof body?.theme !== "string") return json({ code: "INVALID_THEME", message: issue ?? "Choose a theme." }, 400);
+				const state = await appearanceState(slug, sites);
+				if (!state) return json({ code: "NOT_FOUND" }, 404);
+				// Re-applying the current theme is allowed: it is additive and repairs a site
+				// that is missing the theme's collections (for example after a seed change).
+				if (slug !== sites.primary && (await readStatus(slug))?.status !== "ready") return json({ code: "NOT_READY" }, 409);
+				if (await readSiteState(slug)) return json({ code: "NOT_ACTIVE" }, 409);
+				const theme = body.theme;
+				const includeContent = body.includeContent === true;
+				after(async () => {
+					try {
+						await runAsSite(site, () => switchTheme(sites, slug, theme, { includeContent }));
+					await purgeSiteCache(slug);
+					} catch (error) {
+						console.error(`[multisite] switching "${slug}" to "${theme}" failed:`, error);
+					}
+				});
+				return json({ switching: true, to: theme }, 202);
+			}
+		}
+
+		if (method === "GET" && pathname.startsWith(STATUS_PREFIX) && !pathname.slice(STATUS_PREFIX.length).includes("/")) {
+			const slug = pathname.slice(STATUS_PREFIX.length);
+			if (!isSiteId(slug)) return json({ code: "NOT_FOUND" }, 404);
+			const status = await readStatus(slug);
+			// Self-heal: whoever is watching a site whose run died restarts it, so a
+			// killed run costs about a minute instead of a stuck site. Signed-in callers
+			// only: the status URL is otherwise public.
+			if (status?.status === "provisioning" && needsReconcile(status, Date.now()) && (await sessionUserId(context))) {
+				after(async () => void (await runAsSite(site, () => reconcile(sites, slug))));
+			}
+			return status ? json(status, 200) : json({ code: "NOT_FOUND" }, 404);
+		}
+
+		// Sign-in / sign-up land on the console, not the marketing home.
+		if (method === "GET") {
+			const entry = loginEntryRedirect(
+				context.url,
+				(await sessionUserId(context)) !== null,
+				sites.postLoginPath ?? (sites.accountTab ? "/account/sites" : DEFAULT_POST_LOGIN_PATH),
+			);
+			if (entry) return Response.redirect(new URL(entry, context.url), 302);
+		}
+
+		// OP-27: Legal pages on the control plane (no tracking, no scripts, plain HTML)
+		const legalPages: Record<string, string> = {
+			"/terms": "Terms of Service",
+			"/privacy": "Privacy Policy",
+			"/dpa": "Data Processing Agreement",
+			"/support": "Support",
+		};
+		if (method === "GET" && pathname in legalPages) {
+			const title = legalPages[pathname];
+			// TODO: Replace with real legal copy before launch
+			const content = `<!doctype html>
+<meta charset=utf-8>
+<title>${title}</title>
+<style>
+body{font-family:system-ui,sans-serif;max-width:720px;margin:0 auto;padding:2rem;line-height:1.6}
+h1{margin-bottom:1rem}
+.notice{background:#fef3cd;padding:1rem;border-radius:4px;margin-bottom:2rem}
+</style>
+<div class="notice"><strong>TODO:</strong> Replace this placeholder with real legal text before launch.</div>
+<h1>${title}</h1>
+<p>This is a placeholder for the ${title}. Replace with real legal copy.</p>
+<p><a href="/">← Back to home</a></p>`;
+			return html(content, 200);
+		}
+
+		// "Open admin": sign a one-time link for the user and send them to the tenant.
+		const openAdmin = /^\/sites\/([a-z0-9-]+)\/open-admin$/.exec(pathname);
+		if (method === "GET" && openAdmin) {
+			const slug = openAdmin[1]!;
+			const userId = await sessionUserId(context);
+			if (!userId) return redirectTo(`/login?redirect=${encodeURIComponent(pathname)}`);
+			const base = siteUrl(slug, sites);
+			if (!base || !(await canManage(userId, slug, sites.primary)) || slug === sites.primary || (await readSiteState(slug))) {
+				return html("Not found", 404);
+			}
+			const token = await signHandoff(await handoffSecret(), { uid: userId, site: slug });
+			return redirectTo(`${base}${HANDOFF_PATH}?t=${encodeURIComponent(token)}&next=${encodeURIComponent(safeNext(context.url.searchParams.get("next")))}`);
+		}
+
+		// Customer console. Pages need a session (shell only, no data); the JSON
+		// is separately gated by the same session.
+		if (method === "GET" && sites.accountTab && (pathname === "/sites" || pathname === "/sites/new")) {
+			return redirectTo(pathname === "/sites" ? "/account/sites" : "/account/sites?new=1");
+		}
+		if (method === "GET" && (pathname === "/sites" || pathname === "/sites/new")) {
+			if (!(await sessionUserId(context))) {
+				return Response.redirect(new URL(`/login?redirect=${encodeURIComponent(pathname)}`, context.url), 302);
+			}
+			return html(consolePageHtml(pathname === "/sites" ? "list" : "new"), 200);
+		}
+		if (method === "GET" && pathname === "/api/multisite/me") {
+			const userId = await sessionUserId(context);
+			if (!userId) return json({ code: "UNAUTHORIZED" }, 401);
+			const state = await consoleState(userId, sites);
+			const stalled = state.sites.find((x) => x.status === "provisioning" && x.canRetry);
+			if (stalled) after(async () => void (await runAsSite(site, () => reconcile(sites, stalled.slug))));
+			return json(state, 200);
+		}
+		// Themes a new site can pick (no seeds: those stay on the server).
+		if (method === "GET" && pathname === "/api/multisite/themes") {
+			if (!(await sessionUserId(context))) return json({ code: "UNAUTHORIZED" }, 401);
+			const entries = Object.entries(sites.themes ?? {});
+			const fallback = effectiveTheme(null, sites.themes, sites.defaultTheme);
+			const demos = await demoUrls(sites);
+			return json(
+				{ default: fallback, themes: entries.map(([id, t]) => ({ id, name: t.name, description: t.description ?? "", pitch: t.pitch, preview: t.preview, checklist: t.checklist ?? [], ...(demos[id] ? { demoUrl: demos[id] } : {}) })) },
+				200,
+			);
+		}
+		if (method === "GET" && pathname === "/api/multisite/slug-check") {
+			if (!(await sessionUserId(context))) return json({ code: "UNAUTHORIZED" }, 401);
+			const checked = await checkAddress(context.url.searchParams.get("slug"), sites.primary);
+			return json(checked.available ? { ...checked, url: siteUrl(String(context.url.searchParams.get("slug")).toLowerCase(), sites) } : checked, 200);
+		}
+
+		// Retry one site's provisioning: its owner or staff. Idempotent, 202 = started.
+		if (method === "POST" && pathname.startsWith(STATUS_PREFIX) && pathname.endsWith("/retry")) {
+			if (!csrfOk(context.request.headers, context.url.origin)) return forbidden();
+			const slug = pathname.slice(STATUS_PREFIX.length, -"/retry".length);
+			if (!isSiteId(slug)) return json({ code: "NOT_FOUND" }, 404);
+			const userId = await sessionUserId(context);
+			if (!userId) return json({ code: "UNAUTHORIZED" }, 401);
+			const org = (await readOrgs()).find((o) => o.slug === slug);
+			if (!org) return json({ code: "NOT_FOUND" }, 404);
+			if (org.ownerUserId !== userId && !(await isStaff(userId))) return json({ code: "FORBIDDEN" }, 403);
+			if ((await pendingReconcile(slug)).length === 0) return json({ code: "NOT_NEEDED" }, 409);
+			after(async () => void (await runAsSite(site, () => reconcile(sites, slug))));
+			return json({ retrying: true }, 202);
+		}
+
+		// Staff: re-run the next stuck site (failed, or provisioning that died). One per call; call again for the next.
+		if (method === "POST" && pathname === RECONCILE_API) {
+			if (!csrfOk(context.request.headers, context.url.origin)) return forbidden();
+			if (!(await isStaff(await sessionUserId(context)))) return json({ code: "FORBIDDEN" }, 403);
+			const slugs = await pendingReconcile();
+			if (slugs.length) after(async () => void (await runAsSite(site, () => reconcile(sites))));
+			return json({ pending: slugs, started: slugs[0] ?? null }, 202);
+		}
+
+		// Staff: back up, list backups of, and restore one site (see backup.ts). Run inside the request.
+		const backupApi = /^\/api\/multisite\/sites\/([a-z0-9-]+)\/(backup|backups|restore)$/.exec(pathname);
+		if (backupApi && ((method === "GET" && backupApi[2] === "backups") || (method === "POST" && backupApi[2] !== "backups"))) {
+			if (method === "POST" && !csrfOk(context.request.headers, context.url.origin)) return forbidden();
+			if (!(await isStaff(await sessionUserId(context)))) return json({ code: "FORBIDDEN" }, 403);
+			const slug = backupApi[1]!;
+			if (slug === sites.primary || !(await siteHasTables(slug))) return json({ code: "NOT_FOUND" }, 404);
+			return runAsSite(site, async () => {
+				if (backupApi[2] === "backups") return json({ backups: await listBackups(slug) }, 200);
+				if (backupApi[2] === "backup") return json(await backupSite(slug), 201);
+				const body = (await context.request.json().catch(() => null)) as { key?: unknown; replace?: unknown } | null;
+				if (typeof body?.key !== "string") return json({ code: "BAD_REQUEST" }, 400);
+				const result = await restoreSite(slug, body.key, { replace: body.replace === true });
+				const status = { restored: 200, "not-found": 404, "site-has-tables": 409, "bad-backup": 422 }[result];
+				return json({ result }, status);
+			});
+		}
+		// Staff: build the template site of ONE theme (`{ theme }`; `rebuild: true` replaces an existing one). Runs inside the request, not in the
+		// background: it takes ~70 s, longer than the ~30 s a background task gets. New sites of that theme
+		// are then cloned from it (seconds) instead of migrated and seeded.
+		if (method === "POST" && pathname === TEMPLATES_API) {
+			if (!csrfOk(context.request.headers, context.url.origin)) return forbidden();
+			if (!(await isStaff(await sessionUserId(context)))) return json({ code: "FORBIDDEN" }, 403);
+			const body = (await context.request.json().catch(() => null)) as { theme?: unknown; rebuild?: unknown } | null;
+			const theme = typeof body?.theme === "string" ? body.theme : "";
+			const started = Date.now();
+			const result = await runAsSite(site, () => buildTemplate(sites, theme, { rebuild: body?.rebuild === true }));
+			return json({ theme, result, ms: Date.now() - started }, result === "unknown-theme" ? 400 : 200);
+		}
+
+		// Fleet view — staff only (role 50 on the control plane). The keys to the
+		// whole fleet, so the gate is the point: never reachable by a tenant admin
+		// or an anonymous visitor.
+		if (method === "GET" && pathname === FLEET_API) {
+			if (!(await isStaff(await sessionUserId(context)))) return json({ code: "FORBIDDEN" }, 403);
+			return json({ sites: await listSites() }, 200);
+		}
+
+		// The old fleet page is now the control plane's native admin page (plugin "Site"). Keep the
+		// address working: staff go there, everyone else signs in first.
+		if (method === "GET" && pathname === FLEET_PAGE) {
+			if (!(await isStaff(await sessionUserId(context)))) {
+				return Response.redirect(new URL(`/login?redirect=${FLEET_PAGE}`, context.url), 302);
+			}
+			return redirectTo(FLEET_NATIVE_PAGE);
+		}
+
+		// A password change or reset on the control plane reaches the owner's sites too (see passwords.ts).
+		if (method === "POST" && PASSWORD_PATHS.has(pathname)) {
+			const response = await next();
+			if (response.status === 200) after(() => runAsSite(site, () => syncRecentPasswords(120_000)).then(() => undefined));
+			return response;
+		}
+		if (method === "POST" && pathname === SIGNUP_PATH) {
+			const rejected = await guardSignup(context, sites);
+			if (rejected) return rejected;
+		}
+		if (method === "POST" && pathname === ORG_CREATE_PATH) {
+			const rejected = await guardOrgCreate(context, sites);
+			if (rejected) return rejected;
+			const response = await next();
+			if (response.status === 200) {
+				const org = parseCreatedOrg(await response.clone().json().catch(() => null));
+				// Provisioning outlives the response: `after` uses the Worker's waitUntil.
+				if (org) after(() => runAsSite(site, () => createOrRejectSite(sites, org)));
+			}
+			return response;
+		}
+
+		return themedNext(context, sites, site, next);
+	});
+}