emdash 0.39.0 → 0.40.0

package/src/astro/routes/api/admin/transfer/imports/[id]/analyze.ts

@@ -0,0 +1,51 @@
+/**
+ * POST /_emdash/api/admin/transfer/imports/:id/analyze
+ *
+ * Runs one bounded analysis step. Call again after `nextRequestInMs` until it
+ * is null; the response then carries the plan and its digest. `decisions`
+ * (principal mappings, title and tagline choices) are applied once the
+ * import is planned.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, requireDb, unwrapResult } from "#api/error.js";
+import { handleImportAnalyze } from "#api/handlers/transfer.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { transferImportAnalyzeBody } from "#api/schemas/transfer.js";
+import { requireScope } from "#auth/scopes.js";
+
+import { getI18nConfig } from "../../../../../../../i18n/config.js";
+import { analysisTargetContext } from "../../../../../../../transfer/analyze/target.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "transfer:analyze");
+	if (scopeDenied) return scopeDenied;
+
+	if (!emdash.storage) {
+		return apiError("STORAGE_NOT_CONFIGURED", "No storage backend is configured", 503);
+	}
+
+	const body = await parseOptionalBody(request, transferImportAnalyzeBody, {});
+	if (isParseError(body)) return body;
+
+	return unwrapResult(
+		await handleImportAnalyze(emdash.db, emdash.storage, {
+			operationId: params.id ?? "",
+			decisions: body.decisions,
+			target: analysisTargetContext({
+				i18n: getI18nConfig(),
+				maxUploadSize: emdash.config.maxUploadSize,
+			}),
+		}),
+	);
+};

package/src/astro/routes/api/admin/transfer/imports/[id]/cancel.ts

@@ -0,0 +1,27 @@
+/**
+ * POST /_emdash/api/admin/transfer/imports/:id/cancel
+ *
+ * Cancels an import. A step in progress stops after its current batch.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleImportCancel } from "#api/handlers/transfer.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "transfer:execute");
+	if (scopeDenied) return scopeDenied;
+
+	return unwrapResult(await handleImportCancel(emdash.db, params.id ?? "", user!.id));
+};

package/src/astro/routes/api/admin/transfer/imports/[id]/execute.ts

@@ -0,0 +1,48 @@
+/**
+ * POST /_emdash/api/admin/transfer/imports/:id/execute
+ *
+ * Starts a planned import. Body: `{ packageDigest, planDigest }`. Both
+ * digests must match the reviewed package and plan. Then call `advance`
+ * until the import ends.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, requireDb, unwrapResult } from "#api/error.js";
+import { handleImportExecute } from "#api/handlers/transfer.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { transferImportExecuteBody } from "#api/schemas/transfer.js";
+import { requireScope } from "#auth/scopes.js";
+
+import { toSha256Digest } from "../../../../../../../transfer/format/digest.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "transfer:execute");
+	if (scopeDenied) return scopeDenied;
+
+	if (!emdash.storage) {
+		return apiError("STORAGE_NOT_CONFIGURED", "No storage backend is configured", 503);
+	}
+
+	const body = await parseBody(request, transferImportExecuteBody);
+	if (isParseError(body)) return body;
+
+	return unwrapResult(
+		await handleImportExecute(emdash.db, emdash.storage, {
+			operationId: params.id ?? "",
+			userId: user.id,
+			packageDigest: toSha256Digest(body.packageDigest.slice("sha256:".length)),
+			planDigest: toSha256Digest(body.planDigest.slice("sha256:".length)),
+		}),
+	);
+};

package/src/astro/routes/api/admin/transfer/imports/[id]/files/[...path].ts

@@ -0,0 +1,54 @@
+/**
+ * PUT /_emdash/api/admin/transfer/imports/:id/files/<package path>
+ *
+ * Upload one declared package file as the raw request body. `Content-Length`
+ * is required and must equal the declared size; the body must hash to the
+ * declared SHA-256. Re-sending an already verified file succeeds without
+ * storing it again when its bytes match.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, requireDb, unwrapResult } from "#api/error.js";
+import { handleImportFileUpload } from "#api/handlers/transfer.js";
+import { requireScope } from "#auth/scopes.js";
+
+import { TRANSFER_LIMITS } from "../../../../../../../../transfer/format/limits.js";
+
+export const prerender = false;
+
+const CONTENT_LENGTH_PATTERN = /^\d{1,16}$/;
+
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "transfer:analyze");
+	if (scopeDenied) return scopeDenied;
+
+	if (!emdash.storage) {
+		return apiError("STORAGE_NOT_CONFIGURED", "No storage backend is configured", 503);
+	}
+
+	const header = request.headers.get("Content-Length");
+	if (header === null) {
+		return apiError("LENGTH_REQUIRED", "Content-Length is required", 411);
+	}
+	if (!CONTENT_LENGTH_PATTERN.test(header)) {
+		return apiError("VALIDATION_ERROR", "Invalid Content-Length", 400);
+	}
+
+	return unwrapResult(
+		await handleImportFileUpload(emdash.db, emdash.storage, {
+			operationId: params.id ?? "",
+			path: params.path ?? "",
+			contentLength: Number(header),
+			body: request.body,
+			maxBlobBytes: emdash.config.maxUploadSize ?? TRANSFER_LIMITS.defaultMaxBlobBytes,
+		}),
+	);
+};

package/src/astro/routes/api/admin/transfer/imports/[id]/index.ts

@@ -0,0 +1,25 @@
+/**
+ * GET /_emdash/api/admin/transfer/imports/:id — import status and upload counts.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleImportGet } from "#api/handlers/transfer.js";
+import { requireAnyScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireAnyScope(locals, ["transfer:analyze", "transfer:execute"]);
+	if (scopeDenied) return scopeDenied;
+
+	return unwrapResult(await handleImportGet(emdash.db, params.id ?? ""));
+};

package/src/astro/routes/api/admin/transfer/imports/[id]/missing.ts

@@ -0,0 +1,34 @@
+/**
+ * GET /_emdash/api/admin/transfer/imports/:id/missing
+ *
+ * Declared package files not uploaded yet, in path order, paginated. Upload
+ * every listed file, then list again: uploading an index chunk declares the
+ * files it lists.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleImportMissing } from "#api/handlers/transfer.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { transferPaginationQuery } from "#api/schemas/transfer.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, url, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "transfer:analyze");
+	if (scopeDenied) return scopeDenied;
+
+	const query = parseQuery(url, transferPaginationQuery);
+	if (isParseError(query)) return query;
+
+	return unwrapResult(await handleImportMissing(emdash.db, params.id ?? "", query));
+};

package/src/astro/routes/api/admin/transfer/imports/[id]/plan.ts

@@ -0,0 +1,29 @@
+/**
+ * GET /_emdash/api/admin/transfer/imports/:id/plan — the analyzed plan and its digest.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, requireDb, unwrapResult } from "#api/error.js";
+import { handleImportPlan } from "#api/handlers/transfer.js";
+import { requireAnyScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireAnyScope(locals, ["transfer:analyze", "transfer:execute"]);
+	if (scopeDenied) return scopeDenied;
+
+	if (!emdash.storage) {
+		return apiError("STORAGE_NOT_CONFIGURED", "No storage backend is configured", 503);
+	}
+
+	return unwrapResult(await handleImportPlan(emdash.db, emdash.storage, params.id ?? ""));
+};

package/src/astro/routes/api/admin/transfer/imports/[id]/receipt.ts

@@ -0,0 +1,25 @@
+/**
+ * GET /_emdash/api/admin/transfer/imports/:id/receipt — the verified receipt of a complete import.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleImportReceipt } from "#api/handlers/transfer.js";
+import { requireAnyScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireAnyScope(locals, ["transfer:analyze", "transfer:execute"]);
+	if (scopeDenied) return scopeDenied;
+
+	return unwrapResult(await handleImportReceipt(emdash.db, params.id ?? ""));
+};

package/src/astro/routes/api/admin/transfer/imports/index.ts

@@ -0,0 +1,85 @@
+/**
+ * Site imports
+ *
+ * GET  /_emdash/api/admin/transfer/imports — list imports, newest first.
+ * POST /_emdash/api/admin/transfer/imports — create an import. The body is the
+ *      package's `manifest.json` bytes, unchanged. An optional
+ *      `Idempotency-Key` header makes retries return the same operation.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, requireDb, unwrapResult } from "#api/error.js";
+import { handleImportCreate, handleImportList } from "#api/handlers/transfer.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { transferPaginationQuery } from "#api/schemas/transfer.js";
+import { requireAnyScope, requireScope } from "#auth/scopes.js";
+
+import { isTransferError } from "../../../../../../transfer/errors.js";
+import { TRANSFER_LIMITS } from "../../../../../../transfer/format/limits.js";
+import { readStreamBytes } from "../../../../../../transfer/staging/stage.js";
+
+export const prerender = false;
+
+const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7e]{1,255}$/;
+
+export const GET: APIRoute = async ({ url, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireAnyScope(locals, ["transfer:analyze", "transfer:execute"]);
+	if (scopeDenied) return scopeDenied;
+
+	const query = parseQuery(url, transferPaginationQuery);
+	if (isParseError(query)) return query;
+
+	return unwrapResult(await handleImportList(emdash.db, query));
+};
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "transfer:analyze");
+	if (scopeDenied) return scopeDenied;
+
+	if (!emdash.storage) {
+		return apiError("STORAGE_NOT_CONFIGURED", "No storage backend is configured", 503);
+	}
+
+	const idempotencyKey = request.headers.get("Idempotency-Key") ?? undefined;
+	if (idempotencyKey !== undefined && !IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {
+		return apiError("VALIDATION_ERROR", "Invalid Idempotency-Key header", 400);
+	}
+
+	const declaredLength = Number(request.headers.get("Content-Length") ?? "0");
+	if (declaredLength > TRANSFER_LIMITS.manifestBytes) {
+		return apiError("TRANSFER_LIMIT_EXCEEDED", "Manifest is too large", 413);
+	}
+	if (!request.body) {
+		return apiError("TRANSFER_MANIFEST_INVALID", "Request body must be the package manifest", 422);
+	}
+
+	let manifest: Uint8Array;
+	try {
+		manifest = await readStreamBytes(request.body, TRANSFER_LIMITS.manifestBytes);
+	} catch (error) {
+		if (isTransferError(error)) return apiError(error.code, error.message, error.status);
+		return apiError("TRANSFER_MANIFEST_INVALID", "Failed to read the manifest", 400);
+	}
+
+	const result = await handleImportCreate(emdash.db, emdash.storage, {
+		userId: user.id,
+		manifest,
+		idempotencyKey,
+	});
+	return unwrapResult(result, result.success && result.data.created ? 201 : 200);
+};

package/src/astro/routes/api/admin/users/[id]/send-recovery.ts

@@ -6,10 +6,12 @@
  * Admin-initiated account recovery — sends a recovery magic link to the user's email.
  */
 
+import { getMagicLinkEmailStrings } from "@emdash-cms/admin/locales/emails";
 import { Role, sendMagicLink, type MagicLinkConfig } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import type { APIRoute } from "astro";
 
+import { resolveEmailLocale } from "#api/email-locale.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { getSiteBaseUrl } from "#api/site-url.js";
 import { OptionsRepository } from "#db/repositories/options.js";
@@ -54,12 +56,18 @@ export const POST: APIRoute = async ({ request, params, locals }) => {
 		// Build config using the configured site URL, stored option as fallback (not request Host header)
 		const options = new OptionsRepository(emdash.db);
 		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
-		const siteName = (await options.get<string>("emdash:site_title")) ?? "EmDash";
+		const siteOptions = await options.getMany<string>(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") ?? "EmDash";
 
+		// Localized copy following the site locale; the locale also
+		// drives lang/dir on the email HTML so RTL copy renders correctly.
+		const emailLocale = resolveEmailLocale(siteOptions.get("emdash:locale"), request);
 		const config: MagicLinkConfig = {
 			baseUrl,
 			siteName,
 			email: (message) => emdash.email!.send(message, "system"),
+			emailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),
+			emailLocale,
 		};
 
 		// Send recovery link

package/src/astro/routes/api/auth/invite/index.ts

@@ -13,9 +13,11 @@ import type { APIRoute } from "astro";
 
 export const prerender = false;
 
+import { getInviteEmailStrings } from "@emdash-cms/admin/locales/emails";
 import { createInvite, InviteError, Role } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
+import { resolveEmailLocale } from "#api/email-locale.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { inviteCreateBody } from "#api/schemas.js";
@@ -44,7 +46,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 		// Get site config for invite email
 		const options = new OptionsRepository(emdash.db);
-		const siteName = (await options.get<string>("emdash:site_title")) || "EmDash";
+		const siteOptions = await options.getMany<string>(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") || "EmDash";
 
 		// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in invite emails
 		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
@@ -55,11 +58,22 @@ export const POST: APIRoute = async ({ request, locals }) => {
 					emdash.email!.send(message, "system")
 			: undefined;
 
+		// Localize the invite email copy. Only resolved when an
+		// email will actually be sent — the copy-link fallback has no copy.
+		const emailLocale = emailSend
+			? resolveEmailLocale(siteOptions.get("emdash:locale"), request)
+			: undefined;
+		const emailStrings = emailLocale
+			? await getInviteEmailStrings(emailLocale, siteName)
+			: undefined;
+
 		const result = await createInvite(
 			{
 				baseUrl,
 				siteName,
 				email: emailSend,
+				emailStrings,
+				emailLocale,
 			},
 			adapter,
 			body.email,

package/src/astro/routes/api/auth/magic-link/send.ts

@@ -11,9 +11,11 @@ import type { APIRoute } from "astro";
 
 export const prerender = false;
 
+import { getMagicLinkEmailStrings } from "@emdash-cms/admin/locales/emails";
 import { sendMagicLink, type MagicLinkConfig } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
+import { resolveEmailLocale } from "#api/email-locale.js";
 import { apiError, apiSuccess } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { magicLinkSendBody } from "#api/schemas.js";
@@ -60,12 +62,18 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		// Build magic link config using the configured site URL, stored option as fallback (not request Host header)
 		const options = new OptionsRepository(emdash.db);
 		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
-		const siteName = (await options.get<string>("emdash:site_title")) ?? "EmDash";
+		const siteOptions = await options.getMany<string>(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") ?? "EmDash";
 
+		// Localized copy following the site locale; the locale also
+		// drives lang/dir on the email HTML so RTL copy renders correctly.
+		const emailLocale = resolveEmailLocale(siteOptions.get("emdash:locale"), request);
 		const config: MagicLinkConfig = {
 			baseUrl,
 			siteName,
 			email: (message) => emdash.email!.send(message, "system"),
+			emailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),
+			emailLocale,
 		};
 
 		// Send magic link (silently fails if user doesn't exist)

package/src/astro/routes/api/auth/magic-link/verify.ts

@@ -1,7 +1,12 @@
 /**
- * GET /_emdash/api/auth/magic-link/verify
+ * GET  /_emdash/api/auth/magic-link/verify
+ * POST /_emdash/api/auth/magic-link/verify
  *
- * Verify a magic link token and create a session.
+ * GET is the link in the email. It only forwards to the admin confirmation
+ * page, because mail scanners fetch every link in a message and would
+ * otherwise use up the single-use token before the recipient clicks.
+ *
+ * POST verifies the token and creates the session.
  * Tokens are single-use and expire after 15 minutes.
  */
 
@@ -12,60 +17,53 @@ export const prerender = false;
 import { verifyMagicLink, MagicLinkError } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
-import { apiError } from "#api/error.js";
-import { isSafeRedirect } from "#api/redirect.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { magicLinkVerifyBody } from "#api/schemas.js";
 
-export const GET: APIRoute = async ({ url, locals, session, redirect }) => {
+export const GET: APIRoute = async ({ url, redirect }) => {
+	const token = url.searchParams.get("token");
+	if (!token) {
+		return redirect("/_emdash/admin/login?error=missing_token");
+	}
+
+	const confirmUrl = new URLSearchParams({ token });
+	const rawRedirect = url.searchParams.get("redirect");
+	if (rawRedirect) confirmUrl.set("redirect", rawRedirect);
+	return redirect(`/_emdash/admin/login/magic-link?${confirmUrl.toString()}`);
+};
+
+export const POST: APIRoute = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
 
-	// Get token from query params
-	const token = url.searchParams.get("token");
-
-	if (!token) {
-		// Redirect to login with error
-		return redirect("/_emdash/admin/login?error=missing_token");
-	}
-
 	try {
-		// Verify the magic link token
+		const body = await parseBody(request, magicLinkVerifyBody);
+		if (isParseError(body)) return body;
+
 		const adapter = createKyselyAdapter(emdash.db);
-		const user = await verifyMagicLink(adapter, token);
+		const user = await verifyMagicLink(adapter, body.token);
 
 		// Fire-and-forget cleanup of expired tokens -- prevents accumulation
 		void adapter.deleteExpiredTokens().catch(() => {});
 
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
-
-		// Check for a stored redirect URL (from original request)
-		// Validate redirect is a safe local path (prevent open redirect via //evil.com or /\evil.com)
-		const rawRedirect = url.searchParams.get("redirect");
-		const redirectUrl = isSafeRedirect(rawRedirect) ? rawRedirect : "/_emdash/admin";
+		session?.set("user", { id: user.id });
 
-		// Redirect to admin dashboard or original URL
-		return redirect(redirectUrl);
+		return apiSuccess({ success: true });
 	} catch (error) {
-		console.error("Magic link verify error:", error);
-
-		// Handle specific errors
 		if (error instanceof MagicLinkError) {
-			switch (error.code) {
-				case "invalid_token":
-					return redirect("/_emdash/admin/login?error=invalid_link");
-				case "token_expired":
-					return redirect("/_emdash/admin/login?error=link_expired");
-				case "user_not_found":
-					return redirect("/_emdash/admin/login?error=user_not_found");
-			}
+			const statusMap: Record<MagicLinkError["code"], number> = {
+				invalid_token: 400,
+				token_expired: 410,
+				user_not_found: 404,
+				email_not_configured: 500,
+			};
+			return apiError(error.code.toUpperCase(), error.message, statusMap[error.code]);
 		}
 
-		// Generic error
-		return redirect("/_emdash/admin/login?error=verification_failed");
+		return handleError(error, "Failed to verify magic link", "MAGIC_LINK_VERIFY_ERROR");
 	}
 };

package/src/astro/routes/api/auth/passkey/options.ts

@@ -10,7 +10,6 @@ import type { APIRoute } from "astro";
 
 export const prerender = false;
 
-import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateAuthenticationOptions } from "@emdash-cms/auth/passkey";
 
 import { apiError, apiSuccess, handleError } from "#api/error.js";
@@ -45,21 +44,6 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			return rateLimitResponse(60);
 		}
 
-		const adapter = createKyselyAdapter(emdash.db);
-
-		// Get credentials to allow
-		let credentials: Awaited<ReturnType<typeof adapter.getCredentialsByUserId>> = [];
-
-		if (body.email) {
-			// Get credentials for specific user
-			const user = await adapter.getUserByEmail(body.email);
-			if (user) {
-				credentials = await adapter.getCredentialsByUserId(user.id);
-			}
-			// Don't reveal if user exists - just return empty allowCredentials
-		}
-		// If no email provided, allowCredentials will be undefined (allow any discoverable credential)
-
 		// Get passkey config
 		const url = new URL(request.url);
 		const options = new OptionsRepository(emdash.db);
@@ -69,11 +53,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 		// Generate authentication options
 		const challengeStore = createChallengeStore(emdash.db);
-		const authOptions = await generateAuthenticationOptions(
-			passkeyConfig,
-			credentials,
-			challengeStore,
-		);
+		// Never scope to the submitted email: allowCredentials would reveal whether the account exists.
+		const authOptions = await generateAuthenticationOptions(passkeyConfig, [], challengeStore);
 
 		return apiSuccess({
 			success: true,