npm - emdash - Versions diffs - 0.29.0 → 0.31.0 - Mend

emdash 0.29.0 → 0.31.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (876) hide show

package/dist/astro/routes/api/menus/_name_/reorder.mjs CHANGED Viewed

@@ -1,15 +1,16 @@
 import "../../../../../after-B1IIdH3Y.mjs";
 import "../../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { o as handleMenuItemReorder } from "../../../../../menus-BpfevlJD.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { st as reorderMenuItemsBody, zn as localeFilterQuery } from "../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-CrRUFdej.mjs";
+import { o as handleMenuItemReorder } from "../../../../../menus-BMGzWyWH.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../../error-DJ98TRbQ.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
+import { z as localeFilterQuery } from "../../../../../media-BJ6SRY3g.mjs";
+import { st as reorderMenuItemsBody } from "../../../../../redirects-D457qwt0.mjs";
+import "../../../../../relations-CZMpBqEd.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
+import { r as requirePerm } from "../../../../../authorize-6WPZa1xZ.mjs";
 //#region src/astro/routes/api/menus/[name]/reorder.ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_/reorder.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"reorder.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/reorder.ts"],"sourcesContent":["/*\n Menu items reorder endpoint\n \n POST /_emdash/api/menus/:name/reorder - Batch update positions\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemReorder } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, reorderMenuItemsBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, reorderMenuItemsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemReorder(emdash.db, name, body.items, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to reorder menu items\", \"MENU_REORDER_ERROR\");\n\t}\n};\n"],"mappings":"~~;;;;;;;;;;;;;;~~AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;AAK/B,SAAO,aAHQ,MAAM,sBAAsB,OAAO,IAAI,MAAM,KAAK,OAAO,EACvE,QAAQ,QAAQ,QAChB,CAAC,CACyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}
1	+ {"version":3,"file":"reorder.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/reorder.ts"],"sourcesContent":["/*\n Menu items reorder endpoint\n \n POST /_emdash/api/menus/:name/reorder - Batch update positions\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemReorder } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, reorderMenuItemsBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, reorderMenuItemsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemReorder(emdash.db, name, body.items, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to reorder menu items\", \"MENU_REORDER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;AAK/B,SAAO,aAHQ,MAAM,sBAAsB,OAAO,IAAI,MAAM,KAAK,OAAO,EACvE,QAAQ,QAAQ,QAChB,CAAC,CACyB;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}

package/dist/astro/routes/api/menus/_name_/translations.mjs CHANGED Viewed

@@ -1,15 +1,16 @@
 import "../../../../../after-B1IIdH3Y.mjs";
 import "../../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { l as handleMenuTranslations, r as handleMenuGet, t as handleMenuCreate } from "../../../../../menus-BpfevlJD.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { zn as localeFilterQuery } from "../../../../../redirects-CeD7K7EX.mjs";
-import "../../../../../relations-BmBmX4Eb.mjs";
-import "../../../../../status-D3Gy1Zc6.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-CrRUFdej.mjs";
+import { l as handleMenuTranslations, r as handleMenuGet, t as handleMenuCreate } from "../../../../../menus-BMGzWyWH.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../../error-DJ98TRbQ.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
+import { z as localeFilterQuery } from "../../../../../media-BJ6SRY3g.mjs";
+import "../../../../../redirects-D457qwt0.mjs";
+import "../../../../../relations-CZMpBqEd.mjs";
+import "../../../../../status-COfycGIU.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-BmCwQCib.mjs";
+import { r as requirePerm } from "../../../../../authorize-6WPZa1xZ.mjs";
 import { z } from "zod";
 //#region src/astro/routes/api/menus/[name]/translations.ts

package/dist/astro/routes/api/menus/_name_/translations.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/translations.ts"],"sourcesContent":["/*\n Menu translation endpoints\n \n GET /_emdash/api/menus/:name/translations — list translations for a menu (uses any locale row)\n * POST /_emdash/api/menus/:name/translations — create a new locale translation (body: { locale, label })\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuGet, handleMenuTranslations } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nconst createTranslationBody = z\n\t.object({\n\t\tlocale: z.string().min(1),\n\t\tlabel: z.string().min(1).optional(),\n\t})\n\t.meta({ id: \"CreateMenuTranslationBody\" });\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\t// Look up any menu row matching the name so we can get its translation_group.\n\t\tconst anchor = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!anchor.success) return unwrapResult(anchor);\n\t\tconst result = await handleMenuTranslations(emdash.db, anchor.data.id);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu translations\", \"MENU_TRANSLATIONS_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createTranslationBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Resolve the source menu (either by explicit locale in query, or the\n\t\t// first matching row). Its id becomes the `translationOf` for the new row.\n\t\tconst source = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!source.success) return unwrapResult(source);\n\n\t\tconst result = await handleMenuCreate(emdash.db, {\n\t\t\tname,\n\t\t\tlabel: body.label ?? source.data.label,\n\t\t\tlocale: body.locale,\n\t\t\ttranslationOf: source.data.id,\n\t\t});\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu translation\", \"MENU_TRANSLATION_CREATE_ERROR\");\n\t}\n};\n"],"mappings":"~~;;;;;;;;;;;;;;;~~AAgBA,MAAa,YAAY;AAEzB,MAAM,wBAAwB,EAC5B,OAAO;CACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CACzB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnC,CAAC,CACD,KAAK,EAAE,IAAI,6BAA6B,CAAC;AAE3C,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EAEH,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,SAAO,aADQ,MAAM,uBAAuB,OAAO,IAAI,OAAO,KAAK,GAAG,CAC3C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,0BAA0B;;;AAI3F,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAQhD,SAAO,aANQ,MAAM,iBAAiB,OAAO,IAAI;GAChD;GACA,OAAO,KAAK,SAAS,OAAO,KAAK;GACjC,QAAQ,KAAK;GACb,eAAe,OAAO,KAAK;GAC3B,CAAC,EAC0B,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,gCAAgC"}
1	+ {"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/translations.ts"],"sourcesContent":["/*\n Menu translation endpoints\n \n GET /_emdash/api/menus/:name/translations — list translations for a menu (uses any locale row)\n * POST /_emdash/api/menus/:name/translations — create a new locale translation (body: { locale, label })\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuGet, handleMenuTranslations } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nconst createTranslationBody = z\n\t.object({\n\t\tlocale: z.string().min(1),\n\t\tlabel: z.string().min(1).optional(),\n\t})\n\t.meta({ id: \"CreateMenuTranslationBody\" });\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\t// Look up any menu row matching the name so we can get its translation_group.\n\t\tconst anchor = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!anchor.success) return unwrapResult(anchor);\n\t\tconst result = await handleMenuTranslations(emdash.db, anchor.data.id);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu translations\", \"MENU_TRANSLATIONS_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createTranslationBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Resolve the source menu (either by explicit locale in query, or the\n\t\t// first matching row). Its id becomes the `translationOf` for the new row.\n\t\tconst source = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!source.success) return unwrapResult(source);\n\n\t\tconst result = await handleMenuCreate(emdash.db, {\n\t\t\tname,\n\t\t\tlabel: body.label ?? source.data.label,\n\t\t\tlocale: body.locale,\n\t\t\ttranslationOf: source.data.id,\n\t\t});\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu translation\", \"MENU_TRANSLATION_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAM,wBAAwB,EAC5B,OAAO;CACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CACzB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnC,CAAC,CACD,KAAK,EAAE,IAAI,6BAA6B,CAAC;AAE3C,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EAEH,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,SAAO,aADQ,MAAM,uBAAuB,OAAO,IAAI,OAAO,KAAK,GAAG,CAC3C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,0BAA0B;;;AAI3F,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAQhD,SAAO,aANQ,MAAM,iBAAiB,OAAO,IAAI;GAChD;GACA,OAAO,KAAK,SAAS,OAAO,KAAK;GACjC,QAAQ,KAAK;GACb,eAAe,OAAO,KAAK;GAC3B,CAAC,EAC0B,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,gCAAgC"}

package/dist/astro/routes/api/menus/_name_.mjs CHANGED Viewed

@@ -1,15 +1,16 @@
 import "../../../../after-B1IIdH3Y.mjs";
 import "../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../base64-C74Msx8h.mjs";
-import "../../../../types-Ch8pFMEm.mjs";
-import { n as handleMenuDelete, r as handleMenuGet, u as handleMenuUpdate } from "../../../../menus-BpfevlJD.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-GLksnn-B.mjs";
-import { ct as updateMenuBody, zn as localeFilterQuery } from "../../../../redirects-CeD7K7EX.mjs";
-import "../../../../relations-BmBmX4Eb.mjs";
-import "../../../../status-D3Gy1Zc6.mjs";
+import "../../../../base64-B-PsqheR.mjs";
+import "../../../../types-CrRUFdej.mjs";
+import { n as handleMenuDelete, r as handleMenuGet, u as handleMenuUpdate } from "../../../../menus-BMGzWyWH.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../error-DJ98TRbQ.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-53zyxlpv.mjs";
+import { z as localeFilterQuery } from "../../../../media-BJ6SRY3g.mjs";
+import { ct as updateMenuBody } from "../../../../redirects-D457qwt0.mjs";
+import "../../../../relations-CZMpBqEd.mjs";
+import "../../../../status-COfycGIU.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../authorize-BmCwQCib.mjs";
+import { r as requirePerm } from "../../../../authorize-6WPZa1xZ.mjs";
 //#region src/astro/routes/api/menus/[name].ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"_name_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/[name].ts"],"sourcesContent":["/*\n Single menu endpoint\n \n GET /_emdash/api/menus/:name[?locale=xx]\n * PUT /_emdash/api/menus/:name[?locale=xx]\n * DELETE /_emdash/api/menus/:name[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuDelete, handleMenuGet, handleMenuUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuGet(emdash.db, name, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu\", \"MENU_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuUpdate(emdash.db, name, { ...body, locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu\", \"MENU_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuDelete(emdash.db, name, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu\", \"MENU_DELETE_ERROR\");\n\t}\n};\n"],"mappings":"~~;;;;;;;;;;;;;;~~AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAClD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,iBAAiB;;;AAIrE,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,iBAAiB,OAAO,IAAI,MAAM;GAAE,GAAG;GAAM,QAAQ,MAAM;GAAQ,CAAC,CAC9D;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB;;;AAIzE,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACtE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,iBAAiB,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC,CACrD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}
1	+ {"version":3,"file":"_name_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/[name].ts"],"sourcesContent":["/*\n Single menu endpoint\n \n GET /_emdash/api/menus/:name[?locale=xx]\n * PUT /_emdash/api/menus/:name[?locale=xx]\n * DELETE /_emdash/api/menus/:name[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuDelete, handleMenuGet, handleMenuUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuGet(emdash.db, name, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu\", \"MENU_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuUpdate(emdash.db, name, { ...body, locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu\", \"MENU_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuDelete(emdash.db, name, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu\", \"MENU_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAClD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,iBAAiB;;;AAIrE,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,iBAAiB,OAAO,IAAI,MAAM;GAAE,GAAG;GAAM,QAAQ,MAAM;GAAQ,CAAC,CAC9D;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB;;;AAIzE,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACtE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,iBAAiB,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC,CACrD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/menus/index.mjs CHANGED Viewed

@@ -1,15 +1,16 @@
 import "../../../../after-B1IIdH3Y.mjs";
 import "../../../../object-cache-Bok5j2ae.mjs";
-import "../../../../base64-C74Msx8h.mjs";
-import "../../../../types-Ch8pFMEm.mjs";
-import { c as handleMenuList, t as handleMenuCreate } from "../../../../menus-BpfevlJD.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../error-CfJMLSkd.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-GLksnn-B.mjs";
-import { $ as createMenuBody, zn as localeFilterQuery } from "../../../../redirects-CeD7K7EX.mjs";
-import "../../../../relations-BmBmX4Eb.mjs";
-import "../../../../status-D3Gy1Zc6.mjs";
+import "../../../../base64-B-PsqheR.mjs";
+import "../../../../types-CrRUFdej.mjs";
+import { c as handleMenuList, t as handleMenuCreate } from "../../../../menus-BMGzWyWH.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../error-DJ98TRbQ.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-53zyxlpv.mjs";
+import { z as localeFilterQuery } from "../../../../media-BJ6SRY3g.mjs";
+import { $ as createMenuBody } from "../../../../redirects-D457qwt0.mjs";
+import "../../../../relations-CZMpBqEd.mjs";
+import "../../../../status-COfycGIU.mjs";
 import "../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../authorize-BmCwQCib.mjs";
+import { r as requirePerm } from "../../../../authorize-6WPZa1xZ.mjs";
 //#region src/astro/routes/api/menus/index.ts
 const prerender = false;

package/dist/astro/routes/api/menus/index.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/index.ts"],"sourcesContent":["/*\n Menus list and create endpoints\n \n GET /_emdash/api/menus[?locale=xx] - List menus (optionally filtered by locale)\n * POST /_emdash/api/menus - Create menu (body may include locale & translationOf)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuList } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuBody, localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuList(emdash.db, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menus\", \"MENU_LIST_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuCreate(emdash.db, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu\", \"MENU_CREATE_ERROR\");\n\t}\n};\n"],"mappings":"~~;;;;;;;;;;;;;;~~AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,eAAe,OAAO,IAAI,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAC7C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,kBAAkB;;;AAIvE,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,iBAAiB,OAAO,IAAI,KAAK,EAC1B,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}
1	+ {"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/index.ts"],"sourcesContent":["/*\n Menus list and create endpoints\n \n GET /_emdash/api/menus[?locale=xx] - List menus (optionally filtered by locale)\n * POST /_emdash/api/menus - Create menu (body may include locale & translationOf)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuList } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuBody, localeFilterQuery } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuList(emdash.db, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menus\", \"MENU_LIST_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuCreate(emdash.db, body);\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu\", \"MENU_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,eAAe,OAAO,IAAI,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAC7C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,kBAAkB;;;AAIvE,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,iBAAiB,OAAO,IAAI,KAAK,EAC1B,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/oauth/authorize.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorize.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"mappings":";;;cA2Ba,SAAA;AAAA,~~cAwDA~~,GAAA,EAAK,QAAA;AAAA,~~cAsGL~~,IAAA,EAAM,QAAA"}
1	+ {"version":3,"file":"authorize.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"mappings":";;;cA2Ba,SAAA;AAAA,cA6DA,GAAA,EAAK,QAAA;AAAA,cAoGL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/oauth/authorize.mjs CHANGED Viewed

@@ -1,9 +1,9 @@
-import { n as getPublicOrigin } from "../../../../public-url-C0cEvrRu.mjs";
-import { n as VALID_SCOPES } from "../../../../api-tokens-Dk2GrJMY.mjs";
-import { t as escapeHtml } from "../../../../escape-r8_GbEU2.mjs";
-import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "../../../../oauth-clients-43_XADoa.mjs";
-import "../../../../oauth-user-lookup-Ctgemb0k.mjs";
-import { n as handleAuthorizationApproval, t as buildDeniedRedirect } from "../../../../oauth-authorization-BWqWTHBK.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-DSGTnJFw.mjs";
+import { o as isValidScope } from "../../../../api-tokens-Cvmixds7.mjs";
+import { t as escapeHtml } from "../../../../escape-CFedIB1C.mjs";
+import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "../../../../oauth-clients-BlrUHAsf.mjs";
+import "../../../../oauth-user-lookup-oUllxvAv.mjs";
+import { n as handleAuthorizationApproval, t as buildDeniedRedirect } from "../../../../oauth-authorization-oqfbBuMH.mjs";
 //#region src/astro/routes/api/oauth/authorize.ts
 const prerender = false;
@@ -26,11 +26,16 @@ function getCsrfCookie(request) {
 }
 const SCOPE_LABELS = {
 	"content:read": "Read content (posts, pages, etc.)",
-	"content:write": "Create, edit, and delete content",
+	"content:write": "Create, edit, and delete content; manage menus and taxonomies",
 	"media:read": "View media files",
 	"media:write": "Upload and manage media files",
 	"schema:read": "View collection schemas",
 	"schema:write": "Create and modify collection schemas",
+	"taxonomies:manage": "Manage taxonomies",
+	"menus:manage": "Manage navigation menus",
+	"settings:read": "View site settings",
+	"settings:manage": "Modify site settings",
+	"mcp:tools": "Use MCP tools from all enabled plugins",
 	admin: "Full administrative access"
 };
 const GET = async ({ url, request, locals }) => {
@@ -66,8 +71,7 @@ const GET = async ({ url, request, locals }) => {
 		loginUrl.searchParams.set("redirect", url.pathname + url.search);
 		return Response.redirect(loginUrl.toString(), 302);
 	}
-	const validSet = new Set(VALID_SCOPES);
-	const requestedScopes = (scope ?? "").split(" ").filter(Boolean).filter((s) => validSet.has(s));
+	const requestedScopes = [...new Set((scope ?? "").split(" ").filter(Boolean).filter(isValidScope))];
 	if (requestedScopes.length === 0) return new Response(renderErrorPage("No valid scopes requested."), {
 		status: 400,
 		headers: { "Content-Type": "text/html; charset=utf-8" }
@@ -105,6 +109,8 @@ const POST = async ({ request, locals }) => {
 		const v = formData.get(name);
 		return typeof v === "string" ? v : fallback;
 	};
+	const requestedScopes = new Set((new URL(request.url).searchParams.get("scope") ?? "").split(" ").filter(Boolean).filter(isValidScope));
+	const selectedScopes = [...new Set(formData.getAll("scope").filter((value) => typeof value === "string").filter(isValidScope).filter((scope) => requestedScopes.has(scope)))];
 	const formCsrf = field("csrf_token");
 	const cookieCsrf = getCsrfCookie(request);
 	const csrfError = new Response(renderErrorPage("Invalid or missing CSRF token. Please try again."), {
@@ -153,7 +159,7 @@ const POST = async ({ request, locals }) => {
 		response_type: field("response_type", "code"),
 		client_id: field("client_id"),
 		redirect_uri: redirectUri,
-		scope: field("scope"),
+		scope: selectedScopes.join(" "),
 		state,
 		code_challenge: field("code_challenge"),
 		code_challenge_method: field("code_challenge_method", "S256"),
@@ -161,10 +167,11 @@ const POST = async ({ request, locals }) => {
 	});
 	if (!result.success) {
 		const errMsg = result.error?.message ?? "Authorization failed";
+		const invalidScope = result.error?.code === "INVALID_SCOPE";
 		try {
 			const errorUrl = new URL(redirectUri);
-			errorUrl.searchParams.set("error", "server_error");
-			errorUrl.searchParams.set("error_description", "Authorization failed");
+			errorUrl.searchParams.set("error", invalidScope ? "invalid_scope" : "server_error");
+			errorUrl.searchParams.set("error_description", invalidScope ? "No selected permission can be granted" : "Authorization failed");
 			if (state) errorUrl.searchParams.set("state", state);
 			return Response.redirect(errorUrl.toString(), 302);
 		} catch {
@@ -178,7 +185,8 @@ const POST = async ({ request, locals }) => {
 };
 function renderConsentPage(params) {
 	const scopeList = params.scopes.map((s) => {
-		return `<li>${escapeHtml(SCOPE_LABELS[s] ?? s)}</li>`;
+		const label = SCOPE_LABELS[s] ?? getPluginScopeLabel(s) ?? s;
+		return `<li><label><input type="checkbox" name="scope" value="${escapeHtml(s)}" checked><span>${escapeHtml(label)}</span></label></li>`;
 	}).join("\n");
 	return `<!DOCTYPE html>
 <html lang="en">
@@ -197,6 +205,8 @@ function renderConsentPage(params) {
   ul { list-style: none; margin-bottom: 1.5rem; }
   li { padding: 0.5rem 0; border-bottom: 1px solid #262626; font-size: 0.875rem; }
   li:last-child { border-bottom: none; }
+  label { display: flex; align-items: flex-start; gap: 0.625rem; cursor: pointer; }
+  input[type="checkbox"] { margin-top: 0.125rem; accent-color: #2563eb; }
   .actions { display: flex; gap: 0.75rem; }
   button { flex: 1; padding: 0.625rem 1rem; border-radius: 8px; border: none; font-size: 0.875rem; font-weight: 500; cursor: pointer; }
   .approve { background: #2563eb; color: white; }
@@ -210,14 +220,13 @@ function renderConsentPage(params) {
   <h1>Authorize Application</h1>
   <p class="client-id">${escapeHtml(params.clientId)}</p>
   <p class="user">Signed in as <strong>${escapeHtml(params.userName)}</strong></p>
-  <h2>Permissions requested</h2>
-  <ul>${scopeList}</ul>
   <form method="POST">
+    <h2>Permissions requested</h2>
+    <ul>${scopeList}</ul>
     <input type="hidden" name="csrf_token" value="${escapeHtml(params.csrfToken)}">
     <input type="hidden" name="response_type" value="${escapeHtml(params.responseType)}">
     <input type="hidden" name="client_id" value="${escapeHtml(params.clientId)}">
     <input type="hidden" name="redirect_uri" value="${escapeHtml(params.redirectUri)}">
-    <input type="hidden" name="scope" value="${escapeHtml(params.scopes.join(" "))}">
     <input type="hidden" name="state" value="${escapeHtml(params.state)}">
     <input type="hidden" name="code_challenge" value="${escapeHtml(params.codeChallenge)}">
     <input type="hidden" name="code_challenge_method" value="${escapeHtml(params.codeChallengeMethod)}">
@@ -231,6 +240,10 @@ function renderConsentPage(params) {
 </body>
 </html>`;
 }
+function getPluginScopeLabel(scope) {
+	const pluginId = scope.startsWith("mcp:tools:") ? scope.slice(10) : "";
+	return pluginId ? `Use MCP tools from ${pluginId}` : null;
+}
 function renderErrorPage(message) {
 	return `<!DOCTYPE html>
 <html lang="en">

package/dist/astro/routes/api/oauth/authorize.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorize.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"sourcesContent":["/*\n GET/POST /_emdash/oauth/authorize\n \n OAuth 2.1 Authorization Endpoint. Handles both the consent page (GET)\n * and consent submission (POST).\n \n GET: Renders an HTML consent page showing which client is requesting\n * access and which scopes are being requested.\n * POST: Processes the user's decision (approve/deny) and redirects\n * to the client's redirect_uri with an authorization code or error.\n \n Requires an authenticated session (not token auth). If unauthenticated,\n * redirects to login with a return URL.\n /\n\nimport type { APIRoute } from \"astro\";\n\nimport { escapeHtml } from \"#api/escape.js\";\nimport {\n\tbuildDeniedRedirect,\n\thandleAuthorizationApproval,\n\tvalidateRedirectUri,\n} from \"#api/handlers/oauth-authorization.js\";\nimport { lookupOAuthClient, validateClientRedirectUri } from \"#api/handlers/oauth-clients.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { VALID_SCOPES } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\n// ---------------------------------------------------------------------------\n// CSRF (SEC-18): Double-submit cookie pattern\n// ---------------------------------------------------------------------------\n\nconst CSRF_COOKIE_NAME = \"emdash_oauth_csrf\";\n\n/* Generate a 32-byte random token as hex. /\nfunction generateCsrfToken(): string {\n\tconst bytes = new Uint8Array(32);\n\tcrypto.getRandomValues(bytes);\n\treturn Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/* Build the Set-Cookie header value for the CSRF token. /\nfunction csrfCookieHeader(token: string, request: Request, siteUrl?: string): string {\n\t// SameSite=Strict prevents cross-site form submission.\n\t// HttpOnly: the token value is embedded in the form hidden field server-side,\n\t// so JS never needs to read the cookie. HttpOnly adds defense-in-depth.\n\t// Secure is set when:\n\t// - siteUrl is configured and uses https (proxy case — request may be http internally), OR\n\t// - the actual request is over https (non-proxy case, preserve existing behaviour)\n\tconst isSecure = siteUrl\n\t\t? siteUrl.startsWith(\"https:\")\n\t\t: new URL(request.url).protocol === \"https:\";\n\tconst secure = isSecure ? \"; Secure\" : \"\";\n\treturn `${CSRF_COOKIE_NAME}=${token}; Path=/_emdash/oauth/authorize; HttpOnly; SameSite=Strict${secure}`;\n}\n\n/* Extract the CSRF token from the request's cookies. /\nfunction getCsrfCookie(request: Request): string \| null {\n\tconst cookieHeader = request.headers.get(\"Cookie\");\n\tif (!cookieHeader) return null;\n\tconst match = cookieHeader.match(new RegExp(`(?:^\|;\\\\s)${CSRF_COOKIE_NAME}=([^;]+)`));\n\treturn match?.[1] ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// Human-readable scope labels\n// ---------------------------------------------------------------------------\n\nconst SCOPE_LABELS: Record<string, string> = {\n\t\"content:read\": \"Read content (posts, pages, etc.)\",\n\t\"content:write\": \"Create, edit, and delete content\",\n\t\"media:read\": \"View media files\",\n\t\"media:write\": \"Upload and manage media files\",\n\t\"schema:read\": \"View collection schemas\",\n\t\"schema:write\": \"Create and modify collection schemas\",\n\tadmin: \"Full administrative access\",\n};\n\n// ---------------------------------------------------------------------------\n// GET: Render consent page\n// ---------------------------------------------------------------------------\n\nexport const GET: APIRoute = async ({ url, request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\t// Validate required OAuth params before rendering\n\tconst clientId = url.searchParams.get(\"client_id\");\n\tconst redirectUri = url.searchParams.get(\"redirect_uri\");\n\tconst responseType = url.searchParams.get(\"response_type\");\n\tconst codeChallenge = url.searchParams.get(\"code_challenge\");\n\tconst codeChallengeMethod = url.searchParams.get(\"code_challenge_method\");\n\tconst scope = url.searchParams.get(\"scope\");\n\tconst state = url.searchParams.get(\"state\");\n\n\t// Basic validation — detailed validation happens on POST\n\tif (!clientId \|\| !redirectUri \|\| responseType !== \"code\" \|\| !codeChallenge) {\n\t\treturn new Response(\n\t\t\trenderErrorPage(\"Invalid authorization request. Missing required parameters.\"),\n\t\t\t{\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t},\n\t\t);\n\t}\n\n\tif (codeChallengeMethod && codeChallengeMethod !== \"S256\") {\n\t\treturn new Response(renderErrorPage(\"Only S256 code challenge method is supported.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate client_id is registered and redirect_uri is in the allowlist.\n\t// This check happens BEFORE authentication so we never redirect to an\n\t// unregistered URI (even for the login redirect, we only redirect to our\n\t// own login page, not to the client's redirect_uri).\n\tif (emdash?.db) {\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\t// If not authenticated, redirect to login with return URL\n\tif (!user) {\n\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\tloginUrl.searchParams.set(\"redirect\", url.pathname + url.search);\n\t\treturn Response.redirect(loginUrl.toString(), 302);\n\t}\n\n\t// Parse and validate scopes\n\tconst validSet = new Set<string>(VALID_SCOPES);\n\tconst requestedScopes = (scope ?? \"\")\n\t\t.split(\" \")\n\t\t.filter(Boolean)\n\t\t.filter((s) => validSet.has(s));\n\n\tif (requestedScopes.length === 0) {\n\t\treturn new Response(renderErrorPage(\"No valid scopes requested.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// SEC-18: Generate CSRF token for the consent form (double-submit cookie pattern)\n\tconst csrfToken = generateCsrfToken();\n\n\t// Render the consent page\n\tconst html = renderConsentPage({\n\t\tclientId,\n\t\tscopes: requestedScopes,\n\t\tredirectUri,\n\t\tresponseType,\n\t\tcodeChallenge,\n\t\tcodeChallengeMethod: codeChallengeMethod ?? \"S256\",\n\t\tstate: state ?? \"\",\n\t\tresource: url.searchParams.get(\"resource\") ?? \"\",\n\t\tuserName: user.name ?? user.email,\n\t\tcsrfToken,\n\t});\n\n\treturn new Response(html, {\n\t\theaders: {\n\t\t\t\"Content-Type\": \"text/html; charset=utf-8\",\n\t\t\t\"Set-Cookie\": csrfCookieHeader(csrfToken, request, getPublicOrigin(url, emdash?.config)),\n\t\t},\n\t});\n};\n\n// ---------------------------------------------------------------------------\n// POST: Process consent\n// ---------------------------------------------------------------------------\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn new Response(renderErrorPage(\"EmDash is not initialized.\"), {\n\t\t\tstatus: 500,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tif (!user) {\n\t\treturn new Response(renderErrorPage(\"Authentication required.\"), {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tconst formData = await request.formData();\n\tconst field = (name: string, fallback = \"\"): string => {\n\t\tconst v = formData.get(name);\n\t\treturn typeof v === \"string\" ? v : fallback;\n\t};\n\n\t// SEC-18: Validate CSRF token (double-submit cookie pattern).\n\t// The form includes a hidden csrf_token field; the cookie has the same value.\n\t// An attacker cannot read the cookie to forge the form field (HttpOnly + SameSite=Strict).\n\tconst formCsrf = field(\"csrf_token\");\n\tconst cookieCsrf = getCsrfCookie(request);\n\tconst csrfError = new Response(\n\t\trenderErrorPage(\"Invalid or missing CSRF token. Please try again.\"),\n\t\t{ status: 403, headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n\t);\n\tif (!formCsrf \|\| !cookieCsrf) return csrfError;\n\n\t// Constant-time comparison: hash both values to fixed-length 32-byte digests,\n\t// then XOR every byte pair. This avoids crypto.subtle.timingSafeEqual which is\n\t// a Cloudflare Workers extension and doesn't exist in Node.js.\n\t// The SHA-256 pre-hash ensures fixed length, eliminating length-leaking.\n\tconst csrfEncoder = new TextEncoder();\n\tconst [csrfHashA, csrfHashB] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(formCsrf)),\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(cookieCsrf)),\n\t]);\n\tconst a = new Uint8Array(csrfHashA);\n\tconst b = new Uint8Array(csrfHashB);\n\tlet diff = 0;\n\t// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- tsgo needs these\n\tfor (let i = 0; i < a.length; i++) diff \|= a[i]! ^ b[i]!;\n\tif (diff !== 0) return csrfError;\n\n\tconst action = field(\"action\");\n\tconst redirectUri = field(\"redirect_uri\");\n\tconst state = field(\"state\") \|\| undefined;\n\n\tif (!redirectUri) {\n\t\treturn new Response(renderErrorPage(\"Missing redirect_uri.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate redirect_uri scheme/host before using it for any redirect\n\tconst uriError = validateRedirectUri(redirectUri);\n\tif (uriError) {\n\t\treturn new Response(renderErrorPage(escapeHtml(uriError)), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// User denied — SEC-44: validate redirect_uri against client's registered URIs\n\t// before redirecting, to prevent open redirect on the deny path.\n\tif (action === \"deny\") {\n\t\tconst clientId = field(\"client_id\");\n\t\tif (!clientId) {\n\t\t\treturn new Response(renderErrorPage(\"Missing client_id.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst denyUrl = buildDeniedRedirect(redirectUri, state);\n\t\treturn Response.redirect(denyUrl, 302);\n\t}\n\n\t// User approved — process the authorization\n\tconst result = await handleAuthorizationApproval(emdash.db, user.id, user.role, {\n\t\tresponse_type: field(\"response_type\", \"code\"),\n\t\tclient_id: field(\"client_id\"),\n\t\tredirect_uri: redirectUri,\n\t\tscope: field(\"scope\"),\n\t\tstate,\n\t\tcode_challenge: field(\"code_challenge\"),\n\t\tcode_challenge_method: field(\"code_challenge_method\", \"S256\"),\n\t\tresource: field(\"resource\") \|\| undefined,\n\t});\n\n\tif (!result.success) {\n\t\tconst errMsg = result.error?.message ?? \"Authorization failed\";\n\t\t// On error, redirect back with error params — use generic description to avoid\n\t\t// leaking internal error details to the (already-validated) redirect target\n\t\ttry {\n\t\t\tconst errorUrl = new URL(redirectUri);\n\t\t\terrorUrl.searchParams.set(\"error\", \"server_error\");\n\t\t\terrorUrl.searchParams.set(\"error_description\", \"Authorization failed\");\n\t\t\tif (state) errorUrl.searchParams.set(\"state\", state);\n\t\t\treturn Response.redirect(errorUrl.toString(), 302);\n\t\t} catch {\n\t\t\treturn new Response(renderErrorPage(escapeHtml(errMsg)), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\treturn Response.redirect(result.data.redirect_url, 302);\n};\n\n// ---------------------------------------------------------------------------\n// HTML rendering\n// ---------------------------------------------------------------------------\n\nfunction renderConsentPage(params: {\n\tclientId: string;\n\tscopes: string[];\n\tredirectUri: string;\n\tresponseType: string;\n\tcodeChallenge: string;\n\tcodeChallengeMethod: string;\n\tstate: string;\n\tresource: string;\n\tuserName: string;\n\tcsrfToken: string;\n}): string {\n\tconst scopeList = params.scopes\n\t\t.map((s) => {\n\t\t\tconst label = SCOPE_LABELS[s] ?? s;\n\t\t\treturn `<li>${escapeHtml(label)}</li>`;\n\t\t})\n\t\t.join(\"\\n\");\n\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize Application — EmDash</title>\n<style>\n * { margin: 0; padding: 0; box-sizing: border-box; }\n body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 0.5rem; }\n .client-id { color: #a3a3a3; font-size: 0.875rem; word-break: break-all; margin-bottom: 1.5rem; }\n .user { color: #a3a3a3; font-size: 0.875rem; margin-bottom: 1rem; }\n h2 { font-size: 0.875rem; font-weight: 500; color: #a3a3a3; text-transform: uppercase; letter-spacing: 0.05em; margin-bottom: 0.75rem; }\n ul { list-style: none; margin-bottom: 1.5rem; }\n li { padding: 0.5rem 0; border-bottom: 1px solid #262626; font-size: 0.875rem; }\n li:last-child { border-bottom: none; }\n .actions { display: flex; gap: 0.75rem; }\n button { flex: 1; padding: 0.625rem 1rem; border-radius: 8px; border: none; font-size: 0.875rem; font-weight: 500; cursor: pointer; }\n .approve { background: #2563eb; color: white; }\n .approve:hover { background: #1d4ed8; }\n .deny { background: #262626; color: #e5e5e5; }\n .deny:hover { background: #333; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n <h1>Authorize Application</h1>\n <p class=\"client-id\">${escapeHtml(params.clientId)}</p>\n <p class=\"user\">Signed in as <strong>${escapeHtml(params.userName)}</strong></p>\n <h2>Permissions requested</h2>\n <ul>${scopeList}</ul>\n <form method=\"POST\">\n <input type=\"hidden\" name=\"csrf_token\" value=\"${escapeHtml(params.csrfToken)}\">\n <input type=\"hidden\" name=\"response_type\" value=\"${escapeHtml(params.responseType)}\">\n <input type=\"hidden\" name=\"client_id\" value=\"${escapeHtml(params.clientId)}\">\n <input type=\"hidden\" name=\"redirect_uri\" value=\"${escapeHtml(params.redirectUri)}\">\n <input type=\"hidden\" name=\"scope\" value=\"${escapeHtml(params.scopes.join(\" \"))}\">\n <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(params.state)}\">\n <input type=\"hidden\" name=\"code_challenge\" value=\"${escapeHtml(params.codeChallenge)}\">\n <input type=\"hidden\" name=\"code_challenge_method\" value=\"${escapeHtml(params.codeChallengeMethod)}\">\n <input type=\"hidden\" name=\"resource\" value=\"${escapeHtml(params.resource)}\">\n <div class=\"actions\">\n <button type=\"submit\" name=\"action\" value=\"deny\" class=\"deny\">Deny</button>\n <button type=\"submit\" name=\"action\" value=\"approve\" class=\"approve\">Approve</button>\n </div>\n </form>\n</div>\n</body>\n</html>`;\n}\n\nfunction renderErrorPage(message: string): string {\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorization Error — EmDash</title>\n<style>\n * { margin: 0; padding: 0; box-sizing: border-box; }\n body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 1rem; color: #ef4444; }\n p { font-size: 0.875rem; color: #a3a3a3; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n <h1>Authorization Error</h1>\n <p>${escapeHtml(message)}</p>\n</div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;AA2BA,MAAa,YAAY;AAMzB,MAAM,mBAAmB;;AAGzB,SAAS,oBAA4B;CACpC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;;AAI1E,SAAS,iBAAiB,OAAe,SAAkB,SAA0B;AAWpF,QAAO,GAAG,iBAAiB,GAAG,MAAM,6DAJnB,UACd,QAAQ,WAAW,SAAS,GAC5B,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,YACX,aAAa;;;AAKxC,SAAS,cAAc,SAAiC;CACvD,MAAM,eAAe,QAAQ,QAAQ,IAAI,SAAS;AAClD,KAAI,CAAC,aAAc,QAAO;AAE1B,QADc,aAAa,MAAM,IAAI,OAAO,cAAc,iBAAiB,UAAU,CAAC,GACvE,MAAM;;AAOtB,MAAM,eAAuC;CAC5C,gBAAgB;CAChB,iBAAiB;CACjB,cAAc;CACd,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,OAAO;CACP;AAMD,MAAa,MAAgB,OAAO,EAAE,KAAK,SAAS,aAAa;CAChE,MAAM,EAAE,QAAQ,SAAS;CAGzB,MAAM,WAAW,IAAI,aAAa,IAAI,YAAY;CAClD,MAAM,cAAc,IAAI,aAAa,IAAI,eAAe;CACxD,MAAM,eAAe,IAAI,aAAa,IAAI,gBAAgB;CAC1D,MAAM,gBAAgB,IAAI,aAAa,IAAI,iBAAiB;CAC5D,MAAM,sBAAsB,IAAI,aAAa,IAAI,wBAAwB;CACzE,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAG3C,KAAI,CAAC,YAAY,CAAC,eAAe,iBAAiB,UAAU,CAAC,cAC5D,QAAO,IAAI,SACV,gBAAgB,8DAA8D,EAC9E;EACC,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CACD;AAGF,KAAI,uBAAuB,wBAAwB,OAClD,QAAO,IAAI,SAAS,gBAAgB,gDAAgD,EAAE;EACrF,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAOH,KAAI,QAAQ,IAAI;EACf,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;;AAKJ,KAAI,CAAC,MAAM;EACV,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,WAAS,aAAa,IAAI,YAAY,IAAI,WAAW,IAAI,OAAO;AAChE,SAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;;CAInD,MAAM,WAAW,IAAI,IAAY,aAAa;CAC9C,MAAM,mBAAmB,SAAS,IAChC,MAAM,IAAI,CACV,OAAO,QAAQ,CACf,QAAQ,MAAM,SAAS,IAAI,EAAE,CAAC;AAEhC,KAAI,gBAAgB,WAAW,EAC9B,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,YAAY,mBAAmB;CAGrC,MAAM,OAAO,kBAAkB;EAC9B;EACA,QAAQ;EACR;EACA;EACA;EACA,qBAAqB,uBAAuB;EAC5C,OAAO,SAAS;EAChB,UAAU,IAAI,aAAa,IAAI,WAAW,IAAI;EAC9C,UAAU,KAAK,QAAQ,KAAK;EAC5B;EACA,CAAC;AAEF,QAAO,IAAI,SAAS,MAAM,EACzB,SAAS;EACR,gBAAgB;EAChB,cAAc,iBAAiB,WAAW,SAAS,gBAAgB,KAAK,QAAQ,OAAO,CAAC;EACxF,EACD,CAAC;;AAOH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAGH,KAAI,CAAC,KACJ,QAAO,IAAI,SAAS,gBAAgB,2BAA2B,EAAE;EAChE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAGH,MAAM,WAAW,MAAM,QAAQ,UAAU;CACzC,MAAM,SAAS,MAAc,WAAW,OAAe;EACtD,MAAM,IAAI,SAAS,IAAI,KAAK;AAC5B,SAAO,OAAO,MAAM,WAAW,IAAI;;CAMpC,MAAM,WAAW,MAAM,aAAa;CACpC,MAAM,aAAa,cAAc,QAAQ;CACzC,MAAM,YAAY,IAAI,SACrB,gBAAgB,mDAAmD,EACnE;EAAE,QAAQ;EAAK,SAAS,EAAE,gBAAgB,4BAA4B;EAAE,CACxE;AACD,KAAI,CAAC,YAAY,CAAC,WAAY,QAAO;CAMrC,MAAM,cAAc,IAAI,aAAa;CACrC,MAAM,CAAC,WAAW,aAAa,MAAM,QAAQ,IAAI,CAChD,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC,EAC7D,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,CAAC,CAC/D,CAAC;CACF,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,IAAI,OAAO;AAEX,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,KAAM,EAAE;AACrD,KAAI,SAAS,EAAG,QAAO;CAEvB,MAAM,SAAS,MAAM,SAAS;CAC9B,MAAM,cAAc,MAAM,eAAe;CACzC,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAEhC,KAAI,CAAC,YACJ,QAAO,IAAI,SAAS,gBAAgB,wBAAwB,EAAE;EAC7D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,WAAW,oBAAoB,YAAY;AACjD,KAAI,SACH,QAAO,IAAI,SAAS,gBAAgB,WAAW,SAAS,CAAC,EAAE;EAC1D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAKH,KAAI,WAAW,QAAQ;EACtB,MAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SACJ,QAAO,IAAI,SAAS,gBAAgB,qBAAqB,EAAE;GAC1D,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,UAAU,oBAAoB,aAAa,MAAM;AACvD,SAAO,SAAS,SAAS,SAAS,IAAI;;CAIvC,MAAM,SAAS,MAAM,4BAA4B,OAAO,IAAI,KAAK,IAAI,KAAK,MAAM;EAC/E,eAAe,MAAM,iBAAiB,OAAO;EAC7C,WAAW,MAAM,YAAY;EAC7B,cAAc;EACd,OAAO,MAAM,QAAQ;EACrB;EACA,gBAAgB,MAAM,iBAAiB;EACvC,uBAAuB,MAAM,yBAAyB,OAAO;EAC7D,UAAU,MAAM,WAAW,IAAI;EAC/B,CAAC;AAEF,KAAI,CAAC,OAAO,SAAS;EACpB,MAAM,SAAS,OAAO,OAAO,WAAW;AAGxC,MAAI;GACH,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,YAAS,aAAa,IAAI,SAAS,eAAe;AAClD,YAAS,aAAa,IAAI,qBAAqB,uBAAuB;AACtE,OAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,UAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;UAC3C;AACP,UAAO,IAAI,SAAS,gBAAgB,WAAW,OAAO,CAAC,EAAE;IACxD,QAAQ;IACR,SAAS,EAAE,gBAAgB,4BAA4B;IACvD,CAAC;;;AAIJ,QAAO,SAAS,SAAS,OAAO,KAAK,cAAc,IAAI;;AAOxD,SAAS,kBAAkB,QAWhB;CACV,MAAM,YAAY,OAAO,OACvB,KAAK,MAAM;AAEX,SAAO,OAAO,WADA,aAAa,MAAM,EACF,CAAC;GAC/B,CACD,KAAK,KAAK;AAEZ,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA4BiB,WAAW,OAAO,SAAS,CAAC;yCACZ,WAAW,OAAO,SAAS,CAAC;;QAE7D,UAAU;;oDAEkC,WAAW,OAAO,UAAU,CAAC;uDAC1B,WAAW,OAAO,aAAa,CAAC;mDACpC,WAAW,OAAO,SAAS,CAAC;sDACzB,WAAW,OAAO,YAAY,CAAC;+CACtC,WAAW,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC;+CACpC,WAAW,OAAO,MAAM,CAAC;wDAChB,WAAW,OAAO,cAAc,CAAC;+DAC1B,WAAW,OAAO,oBAAoB,CAAC;kDACpD,WAAW,OAAO,SAAS,CAAC;;;;;;;;;;AAW9E,SAAS,gBAAgB,SAAyB;AACjD,QAAO;;;;;;;;;;;;;;;;;OAiBD,WAAW,QAAQ,CAAC"}
1	+ {"version":3,"file":"authorize.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"sourcesContent":["/*\n GET/POST /_emdash/oauth/authorize\n \n OAuth 2.1 Authorization Endpoint. Handles both the consent page (GET)\n * and consent submission (POST).\n \n GET: Renders an HTML consent page showing which client is requesting\n * access and which scopes are being requested.\n * POST: Processes the user's decision (approve/deny) and redirects\n * to the client's redirect_uri with an authorization code or error.\n \n Requires an authenticated session (not token auth). If unauthenticated,\n * redirects to login with a return URL.\n /\n\nimport type { APIRoute } from \"astro\";\n\nimport { escapeHtml } from \"#api/escape.js\";\nimport {\n\tbuildDeniedRedirect,\n\thandleAuthorizationApproval,\n\tvalidateRedirectUri,\n} from \"#api/handlers/oauth-authorization.js\";\nimport { lookupOAuthClient, validateClientRedirectUri } from \"#api/handlers/oauth-clients.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isValidScope } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\n// ---------------------------------------------------------------------------\n// CSRF (SEC-18): Double-submit cookie pattern\n// ---------------------------------------------------------------------------\n\nconst CSRF_COOKIE_NAME = \"emdash_oauth_csrf\";\n\n/* Generate a 32-byte random token as hex. /\nfunction generateCsrfToken(): string {\n\tconst bytes = new Uint8Array(32);\n\tcrypto.getRandomValues(bytes);\n\treturn Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/* Build the Set-Cookie header value for the CSRF token. /\nfunction csrfCookieHeader(token: string, request: Request, siteUrl?: string): string {\n\t// SameSite=Strict prevents cross-site form submission.\n\t// HttpOnly: the token value is embedded in the form hidden field server-side,\n\t// so JS never needs to read the cookie. HttpOnly adds defense-in-depth.\n\t// Secure is set when:\n\t// - siteUrl is configured and uses https (proxy case — request may be http internally), OR\n\t// - the actual request is over https (non-proxy case, preserve existing behaviour)\n\tconst isSecure = siteUrl\n\t\t? siteUrl.startsWith(\"https:\")\n\t\t: new URL(request.url).protocol === \"https:\";\n\tconst secure = isSecure ? \"; Secure\" : \"\";\n\treturn `${CSRF_COOKIE_NAME}=${token}; Path=/_emdash/oauth/authorize; HttpOnly; SameSite=Strict${secure}`;\n}\n\n/* Extract the CSRF token from the request's cookies. /\nfunction getCsrfCookie(request: Request): string \| null {\n\tconst cookieHeader = request.headers.get(\"Cookie\");\n\tif (!cookieHeader) return null;\n\tconst match = cookieHeader.match(new RegExp(`(?:^\|;\\\\s)${CSRF_COOKIE_NAME}=([^;]+)`));\n\treturn match?.[1] ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// Human-readable scope labels\n// ---------------------------------------------------------------------------\n\nconst SCOPE_LABELS: Record<string, string> = {\n\t\"content:read\": \"Read content (posts, pages, etc.)\",\n\t\"content:write\": \"Create, edit, and delete content; manage menus and taxonomies\",\n\t\"media:read\": \"View media files\",\n\t\"media:write\": \"Upload and manage media files\",\n\t\"schema:read\": \"View collection schemas\",\n\t\"schema:write\": \"Create and modify collection schemas\",\n\t\"taxonomies:manage\": \"Manage taxonomies\",\n\t\"menus:manage\": \"Manage navigation menus\",\n\t\"settings:read\": \"View site settings\",\n\t\"settings:manage\": \"Modify site settings\",\n\t\"mcp:tools\": \"Use MCP tools from all enabled plugins\",\n\tadmin: \"Full administrative access\",\n};\n\n// ---------------------------------------------------------------------------\n// GET: Render consent page\n// ---------------------------------------------------------------------------\n\nexport const GET: APIRoute = async ({ url, request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\t// Validate required OAuth params before rendering\n\tconst clientId = url.searchParams.get(\"client_id\");\n\tconst redirectUri = url.searchParams.get(\"redirect_uri\");\n\tconst responseType = url.searchParams.get(\"response_type\");\n\tconst codeChallenge = url.searchParams.get(\"code_challenge\");\n\tconst codeChallengeMethod = url.searchParams.get(\"code_challenge_method\");\n\tconst scope = url.searchParams.get(\"scope\");\n\tconst state = url.searchParams.get(\"state\");\n\n\t// Basic validation — detailed validation happens on POST\n\tif (!clientId \|\| !redirectUri \|\| responseType !== \"code\" \|\| !codeChallenge) {\n\t\treturn new Response(\n\t\t\trenderErrorPage(\"Invalid authorization request. Missing required parameters.\"),\n\t\t\t{\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t},\n\t\t);\n\t}\n\n\tif (codeChallengeMethod && codeChallengeMethod !== \"S256\") {\n\t\treturn new Response(renderErrorPage(\"Only S256 code challenge method is supported.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate client_id is registered and redirect_uri is in the allowlist.\n\t// This check happens BEFORE authentication so we never redirect to an\n\t// unregistered URI (even for the login redirect, we only redirect to our\n\t// own login page, not to the client's redirect_uri).\n\tif (emdash?.db) {\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\t// If not authenticated, redirect to login with return URL\n\tif (!user) {\n\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\tloginUrl.searchParams.set(\"redirect\", url.pathname + url.search);\n\t\treturn Response.redirect(loginUrl.toString(), 302);\n\t}\n\n\t// Parse and validate scopes\n\tconst requestedScopes = [\n\t\t...new Set((scope ?? \"\").split(\" \").filter(Boolean).filter(isValidScope)),\n\t];\n\n\tif (requestedScopes.length === 0) {\n\t\treturn new Response(renderErrorPage(\"No valid scopes requested.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// SEC-18: Generate CSRF token for the consent form (double-submit cookie pattern)\n\tconst csrfToken = generateCsrfToken();\n\n\t// Render the consent page\n\tconst html = renderConsentPage({\n\t\tclientId,\n\t\tscopes: requestedScopes,\n\t\tredirectUri,\n\t\tresponseType,\n\t\tcodeChallenge,\n\t\tcodeChallengeMethod: codeChallengeMethod ?? \"S256\",\n\t\tstate: state ?? \"\",\n\t\tresource: url.searchParams.get(\"resource\") ?? \"\",\n\t\tuserName: user.name ?? user.email,\n\t\tcsrfToken,\n\t});\n\n\treturn new Response(html, {\n\t\theaders: {\n\t\t\t\"Content-Type\": \"text/html; charset=utf-8\",\n\t\t\t\"Set-Cookie\": csrfCookieHeader(csrfToken, request, getPublicOrigin(url, emdash?.config)),\n\t\t},\n\t});\n};\n\n// ---------------------------------------------------------------------------\n// POST: Process consent\n// ---------------------------------------------------------------------------\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn new Response(renderErrorPage(\"EmDash is not initialized.\"), {\n\t\t\tstatus: 500,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tif (!user) {\n\t\treturn new Response(renderErrorPage(\"Authentication required.\"), {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tconst formData = await request.formData();\n\tconst field = (name: string, fallback = \"\"): string => {\n\t\tconst v = formData.get(name);\n\t\treturn typeof v === \"string\" ? v : fallback;\n\t};\n\tconst requestedScopes = new Set(\n\t\t(new URL(request.url).searchParams.get(\"scope\") ?? \"\")\n\t\t\t.split(\" \")\n\t\t\t.filter(Boolean)\n\t\t\t.filter(isValidScope),\n\t);\n\tconst selectedScopes = [\n\t\t...new Set(\n\t\t\tformData\n\t\t\t\t.getAll(\"scope\")\n\t\t\t\t.filter((value): value is string => typeof value === \"string\")\n\t\t\t\t.filter(isValidScope)\n\t\t\t\t.filter((scope) => requestedScopes.has(scope)),\n\t\t),\n\t];\n\n\t// SEC-18: Validate CSRF token (double-submit cookie pattern).\n\t// The form includes a hidden csrf_token field; the cookie has the same value.\n\t// An attacker cannot read the cookie to forge the form field (HttpOnly + SameSite=Strict).\n\tconst formCsrf = field(\"csrf_token\");\n\tconst cookieCsrf = getCsrfCookie(request);\n\tconst csrfError = new Response(\n\t\trenderErrorPage(\"Invalid or missing CSRF token. Please try again.\"),\n\t\t{ status: 403, headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n\t);\n\tif (!formCsrf \|\| !cookieCsrf) return csrfError;\n\n\t// Constant-time comparison: hash both values to fixed-length 32-byte digests,\n\t// then XOR every byte pair. This avoids crypto.subtle.timingSafeEqual which is\n\t// a Cloudflare Workers extension and doesn't exist in Node.js.\n\t// The SHA-256 pre-hash ensures fixed length, eliminating length-leaking.\n\tconst csrfEncoder = new TextEncoder();\n\tconst [csrfHashA, csrfHashB] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(formCsrf)),\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(cookieCsrf)),\n\t]);\n\tconst a = new Uint8Array(csrfHashA);\n\tconst b = new Uint8Array(csrfHashB);\n\tlet diff = 0;\n\t// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- tsgo needs these\n\tfor (let i = 0; i < a.length; i++) diff \|= a[i]! ^ b[i]!;\n\tif (diff !== 0) return csrfError;\n\n\tconst action = field(\"action\");\n\tconst redirectUri = field(\"redirect_uri\");\n\tconst state = field(\"state\") \|\| undefined;\n\n\tif (!redirectUri) {\n\t\treturn new Response(renderErrorPage(\"Missing redirect_uri.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate redirect_uri scheme/host before using it for any redirect\n\tconst uriError = validateRedirectUri(redirectUri);\n\tif (uriError) {\n\t\treturn new Response(renderErrorPage(escapeHtml(uriError)), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// User denied — SEC-44: validate redirect_uri against client's registered URIs\n\t// before redirecting, to prevent open redirect on the deny path.\n\tif (action === \"deny\") {\n\t\tconst clientId = field(\"client_id\");\n\t\tif (!clientId) {\n\t\t\treturn new Response(renderErrorPage(\"Missing client_id.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst denyUrl = buildDeniedRedirect(redirectUri, state);\n\t\treturn Response.redirect(denyUrl, 302);\n\t}\n\n\t// User approved — process the authorization\n\tconst result = await handleAuthorizationApproval(emdash.db, user.id, user.role, {\n\t\tresponse_type: field(\"response_type\", \"code\"),\n\t\tclient_id: field(\"client_id\"),\n\t\tredirect_uri: redirectUri,\n\t\tscope: selectedScopes.join(\" \"),\n\t\tstate,\n\t\tcode_challenge: field(\"code_challenge\"),\n\t\tcode_challenge_method: field(\"code_challenge_method\", \"S256\"),\n\t\tresource: field(\"resource\") \|\| undefined,\n\t});\n\n\tif (!result.success) {\n\t\tconst errMsg = result.error?.message ?? \"Authorization failed\";\n\t\tconst invalidScope = result.error?.code === \"INVALID_SCOPE\";\n\t\t// On error, redirect back with error params — use generic description to avoid\n\t\t// leaking internal error details to the (already-validated) redirect target\n\t\ttry {\n\t\t\tconst errorUrl = new URL(redirectUri);\n\t\t\terrorUrl.searchParams.set(\"error\", invalidScope ? \"invalid_scope\" : \"server_error\");\n\t\t\terrorUrl.searchParams.set(\n\t\t\t\t\"error_description\",\n\t\t\t\tinvalidScope ? \"No selected permission can be granted\" : \"Authorization failed\",\n\t\t\t);\n\t\t\tif (state) errorUrl.searchParams.set(\"state\", state);\n\t\t\treturn Response.redirect(errorUrl.toString(), 302);\n\t\t} catch {\n\t\t\treturn new Response(renderErrorPage(escapeHtml(errMsg)), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\treturn Response.redirect(result.data.redirect_url, 302);\n};\n\n// ---------------------------------------------------------------------------\n// HTML rendering\n// ---------------------------------------------------------------------------\n\nfunction renderConsentPage(params: {\n\tclientId: string;\n\tscopes: string[];\n\tredirectUri: string;\n\tresponseType: string;\n\tcodeChallenge: string;\n\tcodeChallengeMethod: string;\n\tstate: string;\n\tresource: string;\n\tuserName: string;\n\tcsrfToken: string;\n}): string {\n\tconst scopeList = params.scopes\n\t\t.map((s) => {\n\t\t\tconst label = SCOPE_LABELS[s] ?? getPluginScopeLabel(s) ?? s;\n\t\t\treturn `<li><label><input type=\"checkbox\" name=\"scope\" value=\"${escapeHtml(s)}\" checked><span>${escapeHtml(label)}</span></label></li>`;\n\t\t})\n\t\t.join(\"\\n\");\n\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize Application — EmDash</title>\n<style>\n * { margin: 0; padding: 0; box-sizing: border-box; }\n body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 0.5rem; }\n .client-id { color: #a3a3a3; font-size: 0.875rem; word-break: break-all; margin-bottom: 1.5rem; }\n .user { color: #a3a3a3; font-size: 0.875rem; margin-bottom: 1rem; }\n h2 { font-size: 0.875rem; font-weight: 500; color: #a3a3a3; text-transform: uppercase; letter-spacing: 0.05em; margin-bottom: 0.75rem; }\n ul { list-style: none; margin-bottom: 1.5rem; }\n li { padding: 0.5rem 0; border-bottom: 1px solid #262626; font-size: 0.875rem; }\n li:last-child { border-bottom: none; }\n label { display: flex; align-items: flex-start; gap: 0.625rem; cursor: pointer; }\n input[type=\"checkbox\"] { margin-top: 0.125rem; accent-color: #2563eb; }\n .actions { display: flex; gap: 0.75rem; }\n button { flex: 1; padding: 0.625rem 1rem; border-radius: 8px; border: none; font-size: 0.875rem; font-weight: 500; cursor: pointer; }\n .approve { background: #2563eb; color: white; }\n .approve:hover { background: #1d4ed8; }\n .deny { background: #262626; color: #e5e5e5; }\n .deny:hover { background: #333; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n <h1>Authorize Application</h1>\n <p class=\"client-id\">${escapeHtml(params.clientId)}</p>\n <p class=\"user\">Signed in as <strong>${escapeHtml(params.userName)}</strong></p>\n <form method=\"POST\">\n <h2>Permissions requested</h2>\n <ul>${scopeList}</ul>\n <input type=\"hidden\" name=\"csrf_token\" value=\"${escapeHtml(params.csrfToken)}\">\n <input type=\"hidden\" name=\"response_type\" value=\"${escapeHtml(params.responseType)}\">\n <input type=\"hidden\" name=\"client_id\" value=\"${escapeHtml(params.clientId)}\">\n <input type=\"hidden\" name=\"redirect_uri\" value=\"${escapeHtml(params.redirectUri)}\">\n <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(params.state)}\">\n <input type=\"hidden\" name=\"code_challenge\" value=\"${escapeHtml(params.codeChallenge)}\">\n <input type=\"hidden\" name=\"code_challenge_method\" value=\"${escapeHtml(params.codeChallengeMethod)}\">\n <input type=\"hidden\" name=\"resource\" value=\"${escapeHtml(params.resource)}\">\n <div class=\"actions\">\n <button type=\"submit\" name=\"action\" value=\"deny\" class=\"deny\">Deny</button>\n <button type=\"submit\" name=\"action\" value=\"approve\" class=\"approve\">Approve</button>\n </div>\n </form>\n</div>\n</body>\n</html>`;\n}\n\nfunction getPluginScopeLabel(scope: string): string \| null {\n\tconst pluginId = scope.startsWith(\"mcp:tools:\") ? scope.slice(\"mcp:tools:\".length) : \"\";\n\treturn pluginId ? `Use MCP tools from ${pluginId}` : null;\n}\n\nfunction renderErrorPage(message: string): string {\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorization Error — EmDash</title>\n<style>\n * { margin: 0; padding: 0; box-sizing: border-box; }\n body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 1rem; color: #ef4444; }\n p { font-size: 0.875rem; color: #a3a3a3; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n <h1>Authorization Error</h1>\n <p>${escapeHtml(message)}</p>\n</div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;AA2BA,MAAa,YAAY;AAMzB,MAAM,mBAAmB;;AAGzB,SAAS,oBAA4B;CACpC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;;AAI1E,SAAS,iBAAiB,OAAe,SAAkB,SAA0B;AAWpF,QAAO,GAAG,iBAAiB,GAAG,MAAM,6DAJnB,UACd,QAAQ,WAAW,SAAS,GAC5B,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,YACX,aAAa;;;AAKxC,SAAS,cAAc,SAAiC;CACvD,MAAM,eAAe,QAAQ,QAAQ,IAAI,SAAS;AAClD,KAAI,CAAC,aAAc,QAAO;AAE1B,QADc,aAAa,MAAM,IAAI,OAAO,cAAc,iBAAiB,UAAU,CAAC,GACvE,MAAM;;AAOtB,MAAM,eAAuC;CAC5C,gBAAgB;CAChB,iBAAiB;CACjB,cAAc;CACd,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,qBAAqB;CACrB,gBAAgB;CAChB,iBAAiB;CACjB,mBAAmB;CACnB,aAAa;CACb,OAAO;CACP;AAMD,MAAa,MAAgB,OAAO,EAAE,KAAK,SAAS,aAAa;CAChE,MAAM,EAAE,QAAQ,SAAS;CAGzB,MAAM,WAAW,IAAI,aAAa,IAAI,YAAY;CAClD,MAAM,cAAc,IAAI,aAAa,IAAI,eAAe;CACxD,MAAM,eAAe,IAAI,aAAa,IAAI,gBAAgB;CAC1D,MAAM,gBAAgB,IAAI,aAAa,IAAI,iBAAiB;CAC5D,MAAM,sBAAsB,IAAI,aAAa,IAAI,wBAAwB;CACzE,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAG3C,KAAI,CAAC,YAAY,CAAC,eAAe,iBAAiB,UAAU,CAAC,cAC5D,QAAO,IAAI,SACV,gBAAgB,8DAA8D,EAC9E;EACC,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CACD;AAGF,KAAI,uBAAuB,wBAAwB,OAClD,QAAO,IAAI,SAAS,gBAAgB,gDAAgD,EAAE;EACrF,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAOH,KAAI,QAAQ,IAAI;EACf,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;;AAKJ,KAAI,CAAC,MAAM;EACV,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,WAAS,aAAa,IAAI,YAAY,IAAI,WAAW,IAAI,OAAO;AAChE,SAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;;CAInD,MAAM,kBAAkB,CACvB,GAAG,IAAI,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,aAAa,CAAC,CACzE;AAED,KAAI,gBAAgB,WAAW,EAC9B,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,YAAY,mBAAmB;CAGrC,MAAM,OAAO,kBAAkB;EAC9B;EACA,QAAQ;EACR;EACA;EACA;EACA,qBAAqB,uBAAuB;EAC5C,OAAO,SAAS;EAChB,UAAU,IAAI,aAAa,IAAI,WAAW,IAAI;EAC9C,UAAU,KAAK,QAAQ,KAAK;EAC5B;EACA,CAAC;AAEF,QAAO,IAAI,SAAS,MAAM,EACzB,SAAS;EACR,gBAAgB;EAChB,cAAc,iBAAiB,WAAW,SAAS,gBAAgB,KAAK,QAAQ,OAAO,CAAC;EACxF,EACD,CAAC;;AAOH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAGH,KAAI,CAAC,KACJ,QAAO,IAAI,SAAS,gBAAgB,2BAA2B,EAAE;EAChE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAGH,MAAM,WAAW,MAAM,QAAQ,UAAU;CACzC,MAAM,SAAS,MAAc,WAAW,OAAe;EACtD,MAAM,IAAI,SAAS,IAAI,KAAK;AAC5B,SAAO,OAAO,MAAM,WAAW,IAAI;;CAEpC,MAAM,kBAAkB,IAAI,KAC1B,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,IACjD,MAAM,IAAI,CACV,OAAO,QAAQ,CACf,OAAO,aAAa,CACtB;CACD,MAAM,iBAAiB,CACtB,GAAG,IAAI,IACN,SACE,OAAO,QAAQ,CACf,QAAQ,UAA2B,OAAO,UAAU,SAAS,CAC7D,OAAO,aAAa,CACpB,QAAQ,UAAU,gBAAgB,IAAI,MAAM,CAAC,CAC/C,CACD;CAKD,MAAM,WAAW,MAAM,aAAa;CACpC,MAAM,aAAa,cAAc,QAAQ;CACzC,MAAM,YAAY,IAAI,SACrB,gBAAgB,mDAAmD,EACnE;EAAE,QAAQ;EAAK,SAAS,EAAE,gBAAgB,4BAA4B;EAAE,CACxE;AACD,KAAI,CAAC,YAAY,CAAC,WAAY,QAAO;CAMrC,MAAM,cAAc,IAAI,aAAa;CACrC,MAAM,CAAC,WAAW,aAAa,MAAM,QAAQ,IAAI,CAChD,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC,EAC7D,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,CAAC,CAC/D,CAAC;CACF,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,IAAI,OAAO;AAEX,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,KAAM,EAAE;AACrD,KAAI,SAAS,EAAG,QAAO;CAEvB,MAAM,SAAS,MAAM,SAAS;CAC9B,MAAM,cAAc,MAAM,eAAe;CACzC,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAEhC,KAAI,CAAC,YACJ,QAAO,IAAI,SAAS,gBAAgB,wBAAwB,EAAE;EAC7D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,WAAW,oBAAoB,YAAY;AACjD,KAAI,SACH,QAAO,IAAI,SAAS,gBAAgB,WAAW,SAAS,CAAC,EAAE;EAC1D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAKH,KAAI,WAAW,QAAQ;EACtB,MAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SACJ,QAAO,IAAI,SAAS,gBAAgB,qBAAqB,EAAE;GAC1D,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,UAAU,oBAAoB,aAAa,MAAM;AACvD,SAAO,SAAS,SAAS,SAAS,IAAI;;CAIvC,MAAM,SAAS,MAAM,4BAA4B,OAAO,IAAI,KAAK,IAAI,KAAK,MAAM;EAC/E,eAAe,MAAM,iBAAiB,OAAO;EAC7C,WAAW,MAAM,YAAY;EAC7B,cAAc;EACd,OAAO,eAAe,KAAK,IAAI;EAC/B;EACA,gBAAgB,MAAM,iBAAiB;EACvC,uBAAuB,MAAM,yBAAyB,OAAO;EAC7D,UAAU,MAAM,WAAW,IAAI;EAC/B,CAAC;AAEF,KAAI,CAAC,OAAO,SAAS;EACpB,MAAM,SAAS,OAAO,OAAO,WAAW;EACxC,MAAM,eAAe,OAAO,OAAO,SAAS;AAG5C,MAAI;GACH,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,YAAS,aAAa,IAAI,SAAS,eAAe,kBAAkB,eAAe;AACnF,YAAS,aAAa,IACrB,qBACA,eAAe,0CAA0C,uBACzD;AACD,OAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,UAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;UAC3C;AACP,UAAO,IAAI,SAAS,gBAAgB,WAAW,OAAO,CAAC,EAAE;IACxD,QAAQ;IACR,SAAS,EAAE,gBAAgB,4BAA4B;IACvD,CAAC;;;AAIJ,QAAO,SAAS,SAAS,OAAO,KAAK,cAAc,IAAI;;AAOxD,SAAS,kBAAkB,QAWhB;CACV,MAAM,YAAY,OAAO,OACvB,KAAK,MAAM;EACX,MAAM,QAAQ,aAAa,MAAM,oBAAoB,EAAE,IAAI;AAC3D,SAAO,yDAAyD,WAAW,EAAE,CAAC,kBAAkB,WAAW,MAAM,CAAC;GACjH,CACD,KAAK,KAAK;AAEZ,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA8BiB,WAAW,OAAO,SAAS,CAAC;yCACZ,WAAW,OAAO,SAAS,CAAC;;;UAG3D,UAAU;oDACgC,WAAW,OAAO,UAAU,CAAC;uDAC1B,WAAW,OAAO,aAAa,CAAC;mDACpC,WAAW,OAAO,SAAS,CAAC;sDACzB,WAAW,OAAO,YAAY,CAAC;+CACtC,WAAW,OAAO,MAAM,CAAC;wDAChB,WAAW,OAAO,cAAc,CAAC;+DAC1B,WAAW,OAAO,oBAAoB,CAAC;kDACpD,WAAW,OAAO,SAAS,CAAC;;;;;;;;;;AAW9E,SAAS,oBAAoB,OAA8B;CAC1D,MAAM,WAAW,MAAM,WAAW,aAAa,GAAG,MAAM,MAAM,GAAoB,GAAG;AACrF,QAAO,WAAW,sBAAsB,aAAa;;AAGtD,SAAS,gBAAgB,SAAyB;AACjD,QAAO;;;;;;;;;;;;;;;;;OAiBD,WAAW,QAAQ,CAAC"}

package/dist/astro/routes/api/oauth/device/authorize.mjs CHANGED Viewed

@@ -1,10 +1,10 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import "../../../../../api-tokens-Dk2GrJMY.mjs";
-import "../../../../../oauth-user-lookup-Ctgemb0k.mjs";
-import { t as handleDeviceAuthorize } from "../../../../../device-flow-CPXQ_QfW.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-CrRUFdej.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
+import "../../../../../api-tokens-Cvmixds7.mjs";
+import "../../../../../oauth-user-lookup-oUllxvAv.mjs";
+import { t as handleDeviceAuthorize } from "../../../../../device-flow-BeA6lUS1.mjs";
 import { z } from "zod";
 //#region src/astro/routes/api/oauth/device/authorize.ts

package/dist/astro/routes/api/oauth/device/code.mjs CHANGED Viewed

@@ -1,13 +1,13 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CSgZVESw.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-C0cEvrRu.mjs";
-import "../../../../../api-tokens-Dk2GrJMY.mjs";
-import "../../../../../oauth-user-lookup-Ctgemb0k.mjs";
-import { n as handleDeviceCodeRequest } from "../../../../../device-flow-CPXQ_QfW.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-Cg4Rvc_-.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-CrRUFdej.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CwjQj0YG.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-DSGTnJFw.mjs";
+import "../../../../../api-tokens-Cvmixds7.mjs";
+import "../../../../../oauth-user-lookup-oUllxvAv.mjs";
+import { n as handleDeviceCodeRequest } from "../../../../../device-flow-BeA6lUS1.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-D3IEiUi2.mjs";
 import { z } from "zod";
 //#region src/astro/routes/api/oauth/device/code.ts

package/dist/astro/routes/api/oauth/device/token.mjs CHANGED Viewed

@@ -1,12 +1,12 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CSgZVESw.mjs";
-import "../../../../../api-tokens-Dk2GrJMY.mjs";
-import "../../../../../oauth-user-lookup-Ctgemb0k.mjs";
-import { r as handleDeviceTokenExchange } from "../../../../../device-flow-CPXQ_QfW.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-Cg4Rvc_-.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-CrRUFdej.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CwjQj0YG.mjs";
+import "../../../../../api-tokens-Cvmixds7.mjs";
+import "../../../../../oauth-user-lookup-oUllxvAv.mjs";
+import { r as handleDeviceTokenExchange } from "../../../../../device-flow-BeA6lUS1.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-D3IEiUi2.mjs";
 import { z } from "zod";
 //#region src/astro/routes/api/oauth/device/token.ts

package/dist/astro/routes/api/oauth/register.mjs CHANGED Viewed

@@ -1,7 +1,7 @@
-import "../../../../base64-C74Msx8h.mjs";
-import "../../../../types-Ch8pFMEm.mjs";
-import { r as handleError, t as apiError } from "../../../../error-CfJMLSkd.mjs";
-import { t as handleOAuthClientCreate } from "../../../../oauth-clients-43_XADoa.mjs";
+import "../../../../base64-B-PsqheR.mjs";
+import "../../../../types-CrRUFdej.mjs";
+import { r as handleError, t as apiError } from "../../../../error-DJ98TRbQ.mjs";
+import { t as handleOAuthClientCreate } from "../../../../oauth-clients-BlrUHAsf.mjs";
 //#region src/astro/routes/api/oauth/register.ts
 const prerender = false;

package/dist/astro/routes/api/oauth/token/refresh.mjs CHANGED Viewed

@@ -1,10 +1,10 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import "../../../../../api-tokens-Dk2GrJMY.mjs";
-import "../../../../../oauth-user-lookup-Ctgemb0k.mjs";
-import { i as handleTokenRefresh } from "../../../../../device-flow-CPXQ_QfW.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-CrRUFdej.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
+import "../../../../../api-tokens-Cvmixds7.mjs";
+import "../../../../../oauth-user-lookup-oUllxvAv.mjs";
+import { i as handleTokenRefresh } from "../../../../../device-flow-BeA6lUS1.mjs";
 import { z } from "zod";
 //#region src/astro/routes/api/oauth/token/refresh.ts

package/dist/astro/routes/api/oauth/token/revoke.mjs CHANGED Viewed

@@ -1,10 +1,10 @@
-import "../../../../../base64-C74Msx8h.mjs";
-import "../../../../../types-Ch8pFMEm.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfJMLSkd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-GLksnn-B.mjs";
-import "../../../../../api-tokens-Dk2GrJMY.mjs";
-import "../../../../../oauth-user-lookup-Ctgemb0k.mjs";
-import { a as handleTokenRevoke } from "../../../../../device-flow-CPXQ_QfW.mjs";
+import "../../../../../base64-B-PsqheR.mjs";
+import "../../../../../types-CrRUFdej.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-DJ98TRbQ.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-53zyxlpv.mjs";
+import "../../../../../api-tokens-Cvmixds7.mjs";
+import "../../../../../oauth-user-lookup-oUllxvAv.mjs";
+import { a as handleTokenRevoke } from "../../../../../device-flow-BeA6lUS1.mjs";
 import { z } from "zod";
 //#region src/astro/routes/api/oauth/token/revoke.ts

package/dist/astro/routes/api/oauth/token.mjs CHANGED Viewed

@@ -1,10 +1,10 @@
-import "../../../../base64-C74Msx8h.mjs";
-import "../../../../types-Ch8pFMEm.mjs";
-import { r as handleError, t as apiError } from "../../../../error-CfJMLSkd.mjs";
-import "../../../../api-tokens-Dk2GrJMY.mjs";
-import "../../../../oauth-user-lookup-Ctgemb0k.mjs";
-import { r as handleAuthorizationCodeExchange } from "../../../../oauth-authorization-BWqWTHBK.mjs";
-import { i as handleTokenRefresh, r as handleDeviceTokenExchange } from "../../../../device-flow-CPXQ_QfW.mjs";
+import "../../../../base64-B-PsqheR.mjs";
+import "../../../../types-CrRUFdej.mjs";
+import { r as handleError, t as apiError } from "../../../../error-DJ98TRbQ.mjs";
+import "../../../../api-tokens-Cvmixds7.mjs";
+import "../../../../oauth-user-lookup-oUllxvAv.mjs";
+import { r as handleAuthorizationCodeExchange } from "../../../../oauth-authorization-oqfbBuMH.mjs";
+import { i as handleTokenRefresh, r as handleDeviceTokenExchange } from "../../../../device-flow-BeA6lUS1.mjs";
 import { z } from "zod";
 //#region src/astro/routes/api/oauth/token.ts