emdash 0.0.0-b → 0.0.1

package/src/astro/routes/api/auth/passkey/register/verify.ts

@@ -0,0 +1,117 @@
+/**
+ * POST /_emdash/api/auth/passkey/register/verify
+ *
+ * Verify and store a new passkey credential (authenticated user)
+ */
+
+import type { APIRoute } from "astro";
+
+export const prerender = false;
+
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { verifyRegistrationResponse, registerPasskey } from "@emdash-cms/auth/passkey";
+
+import { apiError, apiSuccess } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { passkeyRegisterVerifyBody } from "#api/schemas.js";
+import { createChallengeStore } from "#auth/challenge-store.js";
+import { getPasskeyConfig } from "#auth/passkey-config.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+const MAX_PASSKEYS = 10;
+
+interface PasskeyResponse {
+	id: string;
+	name: string | null;
+	deviceType: "singleDevice" | "multiDevice";
+	backedUp: boolean;
+	createdAt: string;
+	lastUsedAt: string;
+}
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Require authentication
+	if (!user) {
+		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	}
+
+	try {
+		const adapter = createKyselyAdapter(emdash.db);
+
+		// Check passkey limit again (in case of concurrent requests)
+		const count = await adapter.countCredentialsByUserId(user.id);
+		if (count >= MAX_PASSKEYS) {
+			return apiError("PASSKEY_LIMIT", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);
+		}
+
+		// Parse request body
+		const body = await parseBody(request, passkeyRegisterVerifyBody);
+		if (isParseError(body)) return body;
+
+		// Get passkey config
+		const url = new URL(request.url);
+		const optionsRepo = new OptionsRepository(emdash.db);
+		const siteName = (await optionsRepo.get<string>("emdash:site_title")) ?? undefined;
+		const passkeyConfig = getPasskeyConfig(url, siteName);
+
+		// Verify the registration response
+		const challengeStore = createChallengeStore(emdash.db);
+		const verified = await verifyRegistrationResponse(
+			passkeyConfig,
+			body.credential,
+			challengeStore,
+		);
+
+		// Get passkey name - prefer body.name, then check stored pending name
+		let passKeyName: string | undefined = body.name ?? undefined;
+		if (!passKeyName) {
+			const pending = await optionsRepo.get<{ name?: string }>(
+				`emdash:passkey_pending:${user.id}`,
+			);
+			if (pending?.name) {
+				passKeyName = pending.name;
+			}
+		}
+
+		// Clean up pending state
+		await optionsRepo.delete(`emdash:passkey_pending:${user.id}`);
+
+		// Register the passkey
+		const credential = await registerPasskey(adapter, user.id, verified, passKeyName);
+
+		// Return the new passkey info
+		const passkey: PasskeyResponse = {
+			id: credential.id,
+			name: credential.name,
+			deviceType: credential.deviceType,
+			backedUp: credential.backedUp,
+			createdAt: credential.createdAt.toISOString(),
+			lastUsedAt: credential.lastUsedAt.toISOString(),
+		};
+
+		return apiSuccess({ passkey });
+	} catch (error) {
+		console.error("Passkey registration verify error:", error);
+
+		// Handle specific errors
+		const message = error instanceof Error ? error.message : "";
+
+		// Check for duplicate credential error
+		if (message.includes("credential_exists") || message.includes("already")) {
+			return apiError("CREDENTIAL_EXISTS", "This passkey is already registered", 400);
+		}
+
+		// Check for challenge errors
+		if (message.includes("challenge") || message.includes("expired")) {
+			return apiError("CHALLENGE_EXPIRED", "Registration expired. Please try again.", 400);
+		}
+
+		return apiError("PASSKEY_REGISTER_ERROR", "Registration failed", 500);
+	}
+};

package/src/astro/routes/api/auth/passkey/verify.ts

@@ -0,0 +1,66 @@
+/**
+ * POST /_emdash/api/auth/passkey/verify
+ *
+ * Verify a passkey authentication and create a session
+ */
+
+import type { APIRoute } from "astro";
+
+export const prerender = false;
+
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { authenticateWithPasskey } from "@emdash-cms/auth/passkey";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { passkeyVerifyBody } from "#api/schemas.js";
+import { createChallengeStore } from "#auth/challenge-store.js";
+import { getPasskeyConfig } from "#auth/passkey-config.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const POST: APIRoute = async ({ request, locals, session }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		const body = await parseBody(request, passkeyVerifyBody);
+		if (isParseError(body)) return body;
+
+		// Get passkey config
+		const url = new URL(request.url);
+		const options = new OptionsRepository(emdash.db);
+		const siteName = (await options.get<string>("emdash:site_title")) ?? undefined;
+		const passkeyConfig = getPasskeyConfig(url, siteName);
+
+		// Authenticate with passkey
+		const adapter = createKyselyAdapter(emdash.db);
+		const challengeStore = createChallengeStore(emdash.db);
+
+		const user = await authenticateWithPasskey(
+			passkeyConfig,
+			adapter,
+			body.credential,
+			challengeStore,
+		);
+
+		// Create session
+		if (session) {
+			session.set("user", { id: user.id });
+		}
+
+		return apiSuccess({
+			success: true,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role,
+			},
+		});
+	} catch (error) {
+		return handleError(error, "Authentication failed", "PASSKEY_VERIFY_ERROR");
+	}
+};

package/src/astro/routes/api/auth/signup/complete.ts

@@ -0,0 +1,85 @@
+/**
+ * POST /_emdash/api/auth/signup/complete
+ *
+ * Complete self-signup by registering a passkey for the new user.
+ * This creates the user account and establishes a session.
+ */
+
+import type { APIRoute } from "astro";
+
+export const prerender = false;
+
+import { completeSignup, SignupError } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { verifyRegistrationResponse, registerPasskey } from "@emdash-cms/auth/passkey";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { signupCompleteBody } from "#api/schemas.js";
+import { createChallengeStore } from "#auth/challenge-store.js";
+import { getPasskeyConfig } from "#auth/passkey-config.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const POST: APIRoute = async ({ request, locals, session }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		const body = await parseBody(request, signupCompleteBody);
+		if (isParseError(body)) return body;
+
+		const adapter = createKyselyAdapter(emdash.db);
+
+		// Get passkey config
+		const url = new URL(request.url);
+		const options = new OptionsRepository(emdash.db);
+		const siteName = (await options.get<string>("emdash:site_title")) ?? undefined;
+		const passkeyConfig = getPasskeyConfig(url, siteName);
+
+		// Verify the passkey registration response
+		const challengeStore = createChallengeStore(emdash.db);
+		const verified = await verifyRegistrationResponse(
+			passkeyConfig,
+			body.credential,
+			challengeStore,
+		);
+
+		// Complete the signup - creates the user
+		const user = await completeSignup(adapter, body.token, {
+			name: body.name,
+		});
+
+		// Register the passkey for the new user
+		await registerPasskey(adapter, user.id, verified, "Initial passkey");
+
+		// Create session
+		if (session) {
+			session.set("user", { id: user.id });
+		}
+
+		return apiSuccess({
+			success: true,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role,
+			},
+		});
+	} catch (error) {
+		if (error instanceof SignupError) {
+			const statusMap: Record<string, number> = {
+				invalid_token: 404,
+				token_expired: 410,
+				user_exists: 409,
+				domain_not_allowed: 403,
+			};
+			return apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);
+		}
+
+		return handleError(error, "Failed to complete signup", "SIGNUP_COMPLETE_ERROR");
+	}
+};

package/src/astro/routes/api/auth/signup/request.ts

@@ -0,0 +1,77 @@
+/**
+ * POST /_emdash/api/auth/signup/request
+ *
+ * Request self-signup. Sends verification email if domain is allowed.
+ * Always returns 200 to prevent email enumeration.
+ */
+
+import type { APIRoute } from "astro";
+
+export const prerender = false;
+
+import { requestSignup } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+
+import { apiError, apiSuccess } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { signupRequestBody } from "#api/schemas.js";
+import { getSiteBaseUrl } from "#api/site-url.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	// Check if email pipeline is available
+	if (!emdash.email?.isAvailable()) {
+		return apiError(
+			"EMAIL_NOT_CONFIGURED",
+			"Email not configured. Self-signup is unavailable.",
+			503,
+		);
+	}
+
+	try {
+		const body = await parseBody(request, signupRequestBody);
+		if (isParseError(body)) return body;
+
+		const adapter = createKyselyAdapter(emdash.db);
+
+		// Get site config for signup email
+		const options = new OptionsRepository(emdash.db);
+		const siteName = (await options.get<string>("emdash:site_title")) || "EmDash";
+
+		// Use stored site URL to prevent Host header spoofing in signup emails
+		const baseUrl = await getSiteBaseUrl(emdash.db, request);
+
+		// Request signup - this handles all checks internally and fails silently
+		// if domain not allowed or user exists (to prevent enumeration)
+		await requestSignup(
+			{
+				baseUrl,
+				siteName,
+				email: (message) => emdash.email!.send(message, "system"),
+			},
+			adapter,
+			body.email.toLowerCase().trim(),
+		);
+
+		// Always return success to prevent email enumeration
+		return apiSuccess({
+			success: true,
+			message: "If your email domain is allowed, you'll receive a verification email.",
+		});
+	} catch (error) {
+		console.error("Signup request error:", error);
+
+		// Don't reveal internal errors - just return generic success
+		// to prevent information leakage
+		return apiSuccess({
+			success: true,
+			message: "If your email domain is allowed, you'll receive a verification email.",
+		});
+	}
+};

package/src/astro/routes/api/auth/signup/verify.ts

@@ -0,0 +1,53 @@
+/**
+ * GET /_emdash/api/auth/signup/verify
+ *
+ * Validate a signup verification token (called when user clicks email link).
+ * Returns the email and role for the UI to display.
+ */
+
+import type { APIRoute } from "astro";
+
+export const prerender = false;
+
+import { validateSignupToken, SignupError, roleFromLevel } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+
+export const GET: APIRoute = async ({ url, locals }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const token = url.searchParams.get("token");
+
+	if (!token) {
+		return apiError("MISSING_PARAM", "Token is required", 400);
+	}
+
+	try {
+		const adapter = createKyselyAdapter(emdash.db);
+		const result = await validateSignupToken(adapter, token);
+
+		return apiSuccess({
+			success: true,
+			email: result.email,
+			role: result.role,
+			roleName: roleFromLevel(result.role),
+		});
+	} catch (error) {
+		if (error instanceof SignupError) {
+			const statusMap: Record<string, number> = {
+				invalid_token: 404,
+				token_expired: 410,
+				user_exists: 409,
+				domain_not_allowed: 403,
+			};
+			return apiError(error.code.toUpperCase(), error.message, statusMap[error.code] ?? 400);
+		}
+
+		return handleError(error, "Failed to validate signup token", "SIGNUP_VERIFY_ERROR");
+	}
+};