emdash 0.39.0 → 0.40.0

package/dist/astro/routes/api/menus/_name_/reorder.mjs

@@ -1,19 +1,25 @@
-import "../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../after-PcEvMY_6.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { o as handleMenuItemReorder } from "../../../../../menus-Wy8m5NcH.mjs";
-import { t as menuTag } from "../../../../../chrome-tags-D7LGB91U.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import { b as localeFilterQuery } from "../../../../../redirects-BCiTaIQ-.mjs";
-import { ot as reorderMenuItemsBody } from "../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import { o as handleMenuItemReorder } from "../../../../../menus-ITeAbcIF.mjs";
+import { t as menuTag } from "../../../../../chrome-tags-DApCQSIk.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import { b as localeFilterQuery } from "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../relations-CK9CYUyr.mjs";
+import { l as reorderMenuItemsBody } from "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/menus/[name]/reorder.ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_/reorder.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"reorder.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/reorder.ts"],"sourcesContent":["/**\n * Menu items reorder endpoint\n *\n * POST /_emdash/api/menus/:name/reorder - Batch update positions\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemReorder } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, reorderMenuItemsBody } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, reorderMenuItemsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemReorder(emdash.db, name, body.items, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to reorder menu items\", \"MENU_REORDER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,sBAAsB,OAAO,IAAI,MAAM,KAAK,OAAO,EACvE,QAAQ,QAAQ,QAChB,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}
+{"version":3,"file":"reorder.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/reorder.ts"],"sourcesContent":["/**\n * Menu items reorder endpoint\n *\n * POST /_emdash/api/menus/:name/reorder - Batch update positions\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuItemReorder } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, reorderMenuItemsBody } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, reorderMenuItemsBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuItemReorder(emdash.db, name, body.items, {\n\t\t\tlocale: localeQ.locale,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to reorder menu items\", \"MENU_REORDER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,qBAAqB;AAC3D,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,sBAAsB,OAAO,IAAI,MAAM,KAAK,OAAO,EACvE,QAAQ,QAAQ,QAChB,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,qBAAqB"}

package/dist/astro/routes/api/menus/_name_/translations.mjs

@@ -1,19 +1,25 @@
-import "../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../after-PcEvMY_6.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { l as handleMenuTranslations, r as handleMenuGet, t as handleMenuCreate } from "../../../../../menus-Wy8m5NcH.mjs";
-import { t as menuTag } from "../../../../../chrome-tags-D7LGB91U.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import { b as localeFilterQuery } from "../../../../../redirects-BCiTaIQ-.mjs";
-import "../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../status-DLoBmcDz.mjs";
+import { l as handleMenuTranslations, r as handleMenuGet, t as handleMenuCreate } from "../../../../../menus-ITeAbcIF.mjs";
+import { t as menuTag } from "../../../../../chrome-tags-DApCQSIk.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../settings-DYidIB26.mjs";
+import "../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import { b as localeFilterQuery } from "../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../media-Pu1L6xir.mjs";
+import "../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../status-DZKIG4a9.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../../authorize-seCifOMJ.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/menus/[name]/translations.ts

package/dist/astro/routes/api/menus/_name_/translations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/translations.ts"],"sourcesContent":["/**\n * Menu translation endpoints\n *\n * GET  /_emdash/api/menus/:name/translations       — list translations for a menu (uses any locale row)\n * POST /_emdash/api/menus/:name/translations       — create a new locale translation (body: { locale, label })\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuGet, handleMenuTranslations } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nconst createTranslationBody = z\n\t.object({\n\t\tlocale: z.string().min(1),\n\t\tlabel: z.string().min(1).optional(),\n\t})\n\t.meta({ id: \"CreateMenuTranslationBody\" });\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\t// Look up any menu row matching the name so we can get its translation_group.\n\t\tconst anchor = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!anchor.success) return unwrapResult(anchor);\n\t\tconst result = await handleMenuTranslations(emdash.db, anchor.data.id);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu translations\", \"MENU_TRANSLATIONS_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createTranslationBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Resolve the source menu (either by explicit locale in query, or the\n\t\t// first matching row). Its id becomes the `translationOf` for the new row.\n\t\tconst source = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!source.success) return unwrapResult(source);\n\n\t\tconst result = await handleMenuCreate(emdash.db, {\n\t\t\tname,\n\t\t\tlabel: body.label ?? source.data.label,\n\t\t\tlocale: body.locale,\n\t\t\ttranslationOf: source.data.id,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result, 201);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu translation\", \"MENU_TRANSLATION_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAM,wBAAwB,EAC5B,OAAO;CACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CACzB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnC,CAAC,CACD,KAAK,EAAE,IAAI,6BAA6B,CAAC;AAE3C,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EAEH,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,SAAO,aADQ,MAAM,uBAAuB,OAAO,IAAI,OAAO,KAAK,GAAG,CAC3C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,0BAA0B;;;AAI3F,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;EAEhD,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI;GAChD;GACA,OAAO,KAAK,SAAS,OAAO,KAAK;GACjC,QAAQ,KAAK;GACb,eAAe,OAAO,KAAK;GAC3B,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,QAAQ,IAAI;AACrD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,gCAAgC"}
+{"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/menus/[name]/translations.ts"],"sourcesContent":["/**\n * Menu translation endpoints\n *\n * GET  /_emdash/api/menus/:name/translations       — list translations for a menu (uses any locale row)\n * POST /_emdash/api/menus/:name/translations       — create a new locale translation (body: { locale, label })\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuGet, handleMenuTranslations } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nconst createTranslationBody = z\n\t.object({\n\t\tlocale: z.string().min(1),\n\t\tlabel: z.string().min(1).optional(),\n\t})\n\t.meta({ id: \"CreateMenuTranslationBody\" });\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\t// Look up any menu row matching the name so we can get its translation_group.\n\t\tconst anchor = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!anchor.success) return unwrapResult(anchor);\n\t\tconst result = await handleMenuTranslations(emdash.db, anchor.data.id);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu translations\", \"MENU_TRANSLATIONS_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst localeQ = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(localeQ)) return localeQ;\n\n\ttry {\n\t\tconst body = await parseBody(request, createTranslationBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Resolve the source menu (either by explicit locale in query, or the\n\t\t// first matching row). Its id becomes the `translationOf` for the new row.\n\t\tconst source = await handleMenuGet(emdash.db, name, { locale: localeQ.locale });\n\t\tif (!source.success) return unwrapResult(source);\n\n\t\tconst result = await handleMenuCreate(emdash.db, {\n\t\t\tname,\n\t\t\tlabel: body.label ?? source.data.label,\n\t\t\tlocale: body.locale,\n\t\t\ttranslationOf: source.data.id,\n\t\t});\n\t\tif (!result.success) return unwrapResult(result, 201);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu translation\", \"MENU_TRANSLATION_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAM,wBAAwB,EAC5B,OAAO;CACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CACzB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnC,CAAC,CACD,KAAK,EAAE,IAAI,6BAA6B,CAAC;AAE3C,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EAEH,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,SAAO,aADQ,MAAM,uBAAuB,OAAO,IAAI,OAAO,KAAK,GAAG,CAC3C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,0BAA0B;;;AAI3F,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACnE,KAAI,aAAa,QAAQ,CAAE,QAAO;AAElC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,MAAI,aAAa,KAAK,CAAE,QAAO;EAI/B,MAAM,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC/E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;EAEhD,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI;GAChD;GACA,OAAO,KAAK,SAAS,OAAO,KAAK;GACjC,QAAQ,KAAK;GACb,eAAe,OAAO,KAAK;GAC3B,CAAC;AACF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,QAAQ,IAAI;AACrD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,qCAAqC,gCAAgC"}

package/dist/astro/routes/api/menus/_name_.mjs

@@ -1,19 +1,25 @@
-import "../../../../config-CGVeT8Hc.mjs";
+import "../../../../config-CvmjJcVw.mjs";
 import "../../../../after-PcEvMY_6.mjs";
 import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import { n as handleMenuDelete, r as handleMenuGet, u as handleMenuUpdate } from "../../../../menus-Wy8m5NcH.mjs";
-import { t as menuTag } from "../../../../chrome-tags-D7LGB91U.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-Cr379Av9.mjs";
-import { b as localeFilterQuery } from "../../../../redirects-BCiTaIQ-.mjs";
-import { st as updateMenuBody } from "../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../comments-BVzzt6x5.mjs";
-import "../../../../relations-B4w-G5U9.mjs";
-import "../../../../status-DLoBmcDz.mjs";
+import { n as handleMenuDelete, r as handleMenuGet, u as handleMenuUpdate } from "../../../../menus-ITeAbcIF.mjs";
+import { t as menuTag } from "../../../../chrome-tags-DApCQSIk.mjs";
+import "../../../../errors-DgE1zJGG.mjs";
+import "../../../../settings-DYidIB26.mjs";
+import "../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-DY6OD1j_.mjs";
+import { b as localeFilterQuery } from "../../../../redirects-Cv9apQKj.mjs";
+import "../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../media-Pu1L6xir.mjs";
+import "../../../../comments-fHZ8ON9O.mjs";
+import "../../../../relations-CK9CYUyr.mjs";
+import { d as updateMenuBody } from "../../../../menus-BM7BPLOb.mjs";
+import "../../../../status-DZKIG4a9.mjs";
 import "../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/menus/[name].ts
 const prerender = false;

package/dist/astro/routes/api/menus/_name_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_name_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/[name].ts"],"sourcesContent":["/**\n * Single menu endpoint\n *\n * GET    /_emdash/api/menus/:name[?locale=xx]\n * PUT    /_emdash/api/menus/:name[?locale=xx]\n * DELETE /_emdash/api/menus/:name[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuDelete, handleMenuGet, handleMenuUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuBody } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuGet(emdash.db, name, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu\", \"MENU_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuUpdate(emdash.db, name, { ...body, locale: query.locale });\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu\", \"MENU_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuDelete(emdash.db, name, { locale: query.locale });\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu\", \"MENU_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAClD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,iBAAiB;;;AAIrE,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC1E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI,MAAM;GAAE,GAAG;GAAM,QAAQ,MAAM;GAAQ,CAAC;AACzF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB;;;AAIzE,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC7E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;EACH,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC;AAChF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}
+{"version":3,"file":"_name_.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/[name].ts"],"sourcesContent":["/**\n * Single menu endpoint\n *\n * GET    /_emdash/api/menus/:name[?locale=xx]\n * PUT    /_emdash/api/menus/:name[?locale=xx]\n * DELETE /_emdash/api/menus/:name[?locale=xx]\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuDelete, handleMenuGet, handleMenuUpdate } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { localeFilterQuery, updateMenuBody } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuGet(emdash.db, name, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menu\", \"MENU_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst body = await parseBody(request, updateMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuUpdate(emdash.db, name, { ...body, locale: query.locale });\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update menu\", \"MENU_UPDATE_ERROR\");\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst name = params.name!;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuDelete(emdash.db, name, { locale: query.locale });\n\t\tif (!result.success) return unwrapResult(result);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete menu\", \"MENU_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,cAAc,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAClD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,iBAAiB;;;AAIrE,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC1E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI,MAAM;GAAE,GAAG;GAAM,QAAQ,MAAM;GAAQ,CAAC;AACzF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB;;;AAIzE,MAAa,SAAmB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC7E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,OAAO,OAAO;CAEpB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;EACH,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI,MAAM,EAAE,QAAQ,MAAM,QAAQ,CAAC;AAChF,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;AACrE,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/menus/index.mjs

@@ -1,19 +1,25 @@
-import "../../../../config-CGVeT8Hc.mjs";
+import "../../../../config-CvmjJcVw.mjs";
 import "../../../../after-PcEvMY_6.mjs";
 import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import { c as handleMenuList, t as handleMenuCreate } from "../../../../menus-Wy8m5NcH.mjs";
-import { t as menuTag } from "../../../../chrome-tags-D7LGB91U.mjs";
-import { a as unwrapResult, r as handleError } from "../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-Cr379Av9.mjs";
-import { b as localeFilterQuery } from "../../../../redirects-BCiTaIQ-.mjs";
-import { Q as createMenuBody } from "../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../comments-BVzzt6x5.mjs";
-import "../../../../relations-B4w-G5U9.mjs";
-import "../../../../status-DLoBmcDz.mjs";
+import { c as handleMenuList, t as handleMenuCreate } from "../../../../menus-ITeAbcIF.mjs";
+import { t as menuTag } from "../../../../chrome-tags-DApCQSIk.mjs";
+import "../../../../errors-DgE1zJGG.mjs";
+import "../../../../settings-DYidIB26.mjs";
+import "../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError } from "../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../parse-DY6OD1j_.mjs";
+import { b as localeFilterQuery } from "../../../../redirects-Cv9apQKj.mjs";
+import "../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../media-Pu1L6xir.mjs";
+import "../../../../comments-fHZ8ON9O.mjs";
+import "../../../../relations-CK9CYUyr.mjs";
+import { t as createMenuBody } from "../../../../menus-BM7BPLOb.mjs";
+import "../../../../status-DZKIG4a9.mjs";
 import "../../../../api/schemas/index.mjs";
-import { r as requirePerm } from "../../../../authorize-BXpfMpp0.mjs";
+import { i as requirePerm } from "../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/menus/index.ts
 const prerender = false;

package/dist/astro/routes/api/menus/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/index.ts"],"sourcesContent":["/**\n * Menus list and create endpoints\n *\n * GET  /_emdash/api/menus[?locale=xx] - List menus (optionally filtered by locale)\n * POST /_emdash/api/menus              - Create menu (body may include locale & translationOf)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuList } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuBody, localeFilterQuery } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuList(emdash.db, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menus\", \"MENU_LIST_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuCreate(emdash.db, body);\n\t\tif (!result.success) return unwrapResult(result, 201);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(result.data.name)] });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu\", \"MENU_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,eAAe,OAAO,IAAI,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAC7C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,kBAAkB;;;AAIvE,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,YAAY;CACnE,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI,KAAK;AACtD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,QAAQ,IAAI;AACrD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;AACjF,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/astro/routes/api/menus/index.ts"],"sourcesContent":["/**\n * Menus list and create endpoints\n *\n * GET  /_emdash/api/menus[?locale=xx] - List menus (optionally filtered by locale)\n * POST /_emdash/api/menus              - Create menu (body may include locale & translationOf)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { handleError, unwrapResult } from \"#api/error.js\";\nimport { handleMenuCreate, handleMenuList } from \"#api/handlers/menus.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { createMenuBody, localeFilterQuery } from \"#api/schemas.js\";\nimport { menuTag } from \"#cache/chrome-tags.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:read\");\n\tif (denied) return denied;\n\n\tconst query = parseQuery(new URL(request.url), localeFilterQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleMenuList(emdash.db, { locale: query.locale });\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to fetch menus\", \"MENU_LIST_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\n\tconst denied = requirePerm(user, \"menus:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, createMenuBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleMenuCreate(emdash.db, body);\n\t\tif (!result.success) return unwrapResult(result, 201);\n\t\tif (cache?.enabled) await cache.invalidate({ tags: [menuTag(result.data.name)] });\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create menu\", \"MENU_CREATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,SAAS,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,kBAAkB;AACjE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AAEH,SAAO,aADQ,MAAM,eAAe,OAAO,IAAI,EAAE,QAAQ,MAAM,QAAQ,CAAC,CAC7C;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,kBAAkB;;;AAIvE,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,YAAY;CACnE,MAAM,EAAE,QAAQ,SAAS;CAEzB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,SAAS,MAAM,iBAAiB,OAAO,IAAI,KAAK;AACtD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,QAAQ,IAAI;AACrD,MAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;AACjF,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/oauth/authorize.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"mappings":";;;cA2Ba,SAAA;AAAA,cA6DA,GAAA,EAAK,QAAA;AAAA,cAoGL,IAAA,EAAM,QAAA"}
+{"version":3,"file":"authorize.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"mappings":";;;cA2Ba,SAAA;AAAA,cAiEA,GAAA,EAAK,QAAA;AAAA,cAoGL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/oauth/authorize.mjs

@@ -1,9 +1,9 @@
-import { r as getPublicOrigin } from "../../../../public-url-BWVHsfQv.mjs";
-import { t as escapeHtml } from "../../../../escape-DN4Qmjsl.mjs";
-import { o as isValidScope } from "../../../../api-tokens-DS1VzN7_.mjs";
-import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "../../../../oauth-clients-BMPA8vjl.mjs";
-import "../../../../oauth-user-lookup-ChVW4UWu.mjs";
-import { n as handleAuthorizationApproval, t as buildDeniedRedirect } from "../../../../oauth-authorization-DZ-R-hmx.mjs";
+import { r as getPublicOrigin } from "../../../../public-url-Bn7U0D7-.mjs";
+import { t as escapeHtml } from "../../../../escape-CuaZhZvL.mjs";
+import { s as isValidScope } from "../../../../api-tokens-CE1ECIg0.mjs";
+import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "../../../../oauth-clients-Djq9r_KP.mjs";
+import "../../../../oauth-user-lookup-vue9a64A.mjs";
+import { n as handleAuthorizationApproval, t as buildDeniedRedirect } from "../../../../oauth-authorization-DlMIL5_h.mjs";
 
 //#region src/astro/routes/api/oauth/authorize.ts
 const prerender = false;
@@ -36,6 +36,9 @@ const SCOPE_LABELS = {
 	"settings:read": "View site settings",
 	"settings:manage": "Modify site settings",
 	"mcp:tools": "Use MCP tools from all enabled plugins",
+	"transfer:export": "Export a copy of the entire site: all content, drafts, media, settings, and author names and emails",
+	"transfer:analyze": "Upload site packages and check whether they can be imported into this site",
+	"transfer:execute": "Import a site package into this empty site, overwriting its initial setup",
 	admin: "Full administrative access"
 };
 const GET = async ({ url, request, locals }) => {

package/dist/astro/routes/api/oauth/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"sourcesContent":["/**\n * GET/POST /_emdash/oauth/authorize\n *\n * OAuth 2.1 Authorization Endpoint. Handles both the consent page (GET)\n * and consent submission (POST).\n *\n * GET: Renders an HTML consent page showing which client is requesting\n *      access and which scopes are being requested.\n * POST: Processes the user's decision (approve/deny) and redirects\n *       to the client's redirect_uri with an authorization code or error.\n *\n * Requires an authenticated session (not token auth). If unauthenticated,\n * redirects to login with a return URL.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { escapeHtml } from \"#api/escape.js\";\nimport {\n\tbuildDeniedRedirect,\n\thandleAuthorizationApproval,\n\tvalidateRedirectUri,\n} from \"#api/handlers/oauth-authorization.js\";\nimport { lookupOAuthClient, validateClientRedirectUri } from \"#api/handlers/oauth-clients.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isValidScope } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\n// ---------------------------------------------------------------------------\n// CSRF (SEC-18): Double-submit cookie pattern\n// ---------------------------------------------------------------------------\n\nconst CSRF_COOKIE_NAME = \"emdash_oauth_csrf\";\n\n/** Generate a 32-byte random token as hex. */\nfunction generateCsrfToken(): string {\n\tconst bytes = new Uint8Array(32);\n\tcrypto.getRandomValues(bytes);\n\treturn Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** Build the Set-Cookie header value for the CSRF token. */\nfunction csrfCookieHeader(token: string, request: Request, siteUrl?: string): string {\n\t// SameSite=Strict prevents cross-site form submission.\n\t// HttpOnly: the token value is embedded in the form hidden field server-side,\n\t// so JS never needs to read the cookie. HttpOnly adds defense-in-depth.\n\t// Secure is set when:\n\t//   - siteUrl is configured and uses https (proxy case — request may be http internally), OR\n\t//   - the actual request is over https (non-proxy case, preserve existing behaviour)\n\tconst isSecure = siteUrl\n\t\t? siteUrl.startsWith(\"https:\")\n\t\t: new URL(request.url).protocol === \"https:\";\n\tconst secure = isSecure ? \"; Secure\" : \"\";\n\treturn `${CSRF_COOKIE_NAME}=${token}; Path=/_emdash/oauth/authorize; HttpOnly; SameSite=Strict${secure}`;\n}\n\n/** Extract the CSRF token from the request's cookies. */\nfunction getCsrfCookie(request: Request): string | null {\n\tconst cookieHeader = request.headers.get(\"Cookie\");\n\tif (!cookieHeader) return null;\n\tconst match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${CSRF_COOKIE_NAME}=([^;]+)`));\n\treturn match?.[1] ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// Human-readable scope labels\n// ---------------------------------------------------------------------------\n\nconst SCOPE_LABELS: Record<string, string> = {\n\t\"content:read\": \"Read content (posts, pages, etc.)\",\n\t\"content:write\": \"Create, edit, and delete content; manage menus and taxonomies\",\n\t\"media:read\": \"View media files\",\n\t\"media:write\": \"Upload and manage media files\",\n\t\"schema:read\": \"View collection schemas\",\n\t\"schema:write\": \"Create and modify collection schemas\",\n\t\"taxonomies:manage\": \"Manage taxonomies\",\n\t\"menus:manage\": \"Manage navigation menus\",\n\t\"settings:read\": \"View site settings\",\n\t\"settings:manage\": \"Modify site settings\",\n\t\"mcp:tools\": \"Use MCP tools from all enabled plugins\",\n\tadmin: \"Full administrative access\",\n};\n\n// ---------------------------------------------------------------------------\n// GET: Render consent page\n// ---------------------------------------------------------------------------\n\nexport const GET: APIRoute = async ({ url, request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\t// Validate required OAuth params before rendering\n\tconst clientId = url.searchParams.get(\"client_id\");\n\tconst redirectUri = url.searchParams.get(\"redirect_uri\");\n\tconst responseType = url.searchParams.get(\"response_type\");\n\tconst codeChallenge = url.searchParams.get(\"code_challenge\");\n\tconst codeChallengeMethod = url.searchParams.get(\"code_challenge_method\");\n\tconst scope = url.searchParams.get(\"scope\");\n\tconst state = url.searchParams.get(\"state\");\n\n\t// Basic validation — detailed validation happens on POST\n\tif (!clientId || !redirectUri || responseType !== \"code\" || !codeChallenge) {\n\t\treturn new Response(\n\t\t\trenderErrorPage(\"Invalid authorization request. Missing required parameters.\"),\n\t\t\t{\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t},\n\t\t);\n\t}\n\n\tif (codeChallengeMethod && codeChallengeMethod !== \"S256\") {\n\t\treturn new Response(renderErrorPage(\"Only S256 code challenge method is supported.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate client_id is registered and redirect_uri is in the allowlist.\n\t// This check happens BEFORE authentication so we never redirect to an\n\t// unregistered URI (even for the login redirect, we only redirect to our\n\t// own login page, not to the client's redirect_uri).\n\tif (emdash?.db) {\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\t// If not authenticated, redirect to login with return URL\n\tif (!user) {\n\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\tloginUrl.searchParams.set(\"redirect\", url.pathname + url.search);\n\t\treturn Response.redirect(loginUrl.toString(), 302);\n\t}\n\n\t// Parse and validate scopes\n\tconst requestedScopes = [\n\t\t...new Set((scope ?? \"\").split(\" \").filter(Boolean).filter(isValidScope)),\n\t];\n\n\tif (requestedScopes.length === 0) {\n\t\treturn new Response(renderErrorPage(\"No valid scopes requested.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// SEC-18: Generate CSRF token for the consent form (double-submit cookie pattern)\n\tconst csrfToken = generateCsrfToken();\n\n\t// Render the consent page\n\tconst html = renderConsentPage({\n\t\tclientId,\n\t\tscopes: requestedScopes,\n\t\tredirectUri,\n\t\tresponseType,\n\t\tcodeChallenge,\n\t\tcodeChallengeMethod: codeChallengeMethod ?? \"S256\",\n\t\tstate: state ?? \"\",\n\t\tresource: url.searchParams.get(\"resource\") ?? \"\",\n\t\tuserName: user.name ?? user.email,\n\t\tcsrfToken,\n\t});\n\n\treturn new Response(html, {\n\t\theaders: {\n\t\t\t\"Content-Type\": \"text/html; charset=utf-8\",\n\t\t\t\"Set-Cookie\": csrfCookieHeader(csrfToken, request, getPublicOrigin(url, emdash?.config)),\n\t\t},\n\t});\n};\n\n// ---------------------------------------------------------------------------\n// POST: Process consent\n// ---------------------------------------------------------------------------\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn new Response(renderErrorPage(\"EmDash is not initialized.\"), {\n\t\t\tstatus: 500,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tif (!user) {\n\t\treturn new Response(renderErrorPage(\"Authentication required.\"), {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tconst formData = await request.formData();\n\tconst field = (name: string, fallback = \"\"): string => {\n\t\tconst v = formData.get(name);\n\t\treturn typeof v === \"string\" ? v : fallback;\n\t};\n\tconst requestedScopes = new Set(\n\t\t(new URL(request.url).searchParams.get(\"scope\") ?? \"\")\n\t\t\t.split(\" \")\n\t\t\t.filter(Boolean)\n\t\t\t.filter(isValidScope),\n\t);\n\tconst selectedScopes = [\n\t\t...new Set(\n\t\t\tformData\n\t\t\t\t.getAll(\"scope\")\n\t\t\t\t.filter((value): value is string => typeof value === \"string\")\n\t\t\t\t.filter(isValidScope)\n\t\t\t\t.filter((scope) => requestedScopes.has(scope)),\n\t\t),\n\t];\n\n\t// SEC-18: Validate CSRF token (double-submit cookie pattern).\n\t// The form includes a hidden csrf_token field; the cookie has the same value.\n\t// An attacker cannot read the cookie to forge the form field (HttpOnly + SameSite=Strict).\n\tconst formCsrf = field(\"csrf_token\");\n\tconst cookieCsrf = getCsrfCookie(request);\n\tconst csrfError = new Response(\n\t\trenderErrorPage(\"Invalid or missing CSRF token. Please try again.\"),\n\t\t{ status: 403, headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n\t);\n\tif (!formCsrf || !cookieCsrf) return csrfError;\n\n\t// Constant-time comparison: hash both values to fixed-length 32-byte digests,\n\t// then XOR every byte pair. This avoids crypto.subtle.timingSafeEqual which is\n\t// a Cloudflare Workers extension and doesn't exist in Node.js.\n\t// The SHA-256 pre-hash ensures fixed length, eliminating length-leaking.\n\tconst csrfEncoder = new TextEncoder();\n\tconst [csrfHashA, csrfHashB] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(formCsrf)),\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(cookieCsrf)),\n\t]);\n\tconst a = new Uint8Array(csrfHashA);\n\tconst b = new Uint8Array(csrfHashB);\n\tlet diff = 0;\n\t// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- tsgo needs these\n\tfor (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;\n\tif (diff !== 0) return csrfError;\n\n\tconst action = field(\"action\");\n\tconst redirectUri = field(\"redirect_uri\");\n\tconst state = field(\"state\") || undefined;\n\n\tif (!redirectUri) {\n\t\treturn new Response(renderErrorPage(\"Missing redirect_uri.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate redirect_uri scheme/host before using it for any redirect\n\tconst uriError = validateRedirectUri(redirectUri);\n\tif (uriError) {\n\t\treturn new Response(renderErrorPage(escapeHtml(uriError)), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// User denied — SEC-44: validate redirect_uri against client's registered URIs\n\t// before redirecting, to prevent open redirect on the deny path.\n\tif (action === \"deny\") {\n\t\tconst clientId = field(\"client_id\");\n\t\tif (!clientId) {\n\t\t\treturn new Response(renderErrorPage(\"Missing client_id.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst denyUrl = buildDeniedRedirect(redirectUri, state);\n\t\treturn Response.redirect(denyUrl, 302);\n\t}\n\n\t// User approved — process the authorization\n\tconst result = await handleAuthorizationApproval(emdash.db, user.id, user.role, {\n\t\tresponse_type: field(\"response_type\", \"code\"),\n\t\tclient_id: field(\"client_id\"),\n\t\tredirect_uri: redirectUri,\n\t\tscope: selectedScopes.join(\" \"),\n\t\tstate,\n\t\tcode_challenge: field(\"code_challenge\"),\n\t\tcode_challenge_method: field(\"code_challenge_method\", \"S256\"),\n\t\tresource: field(\"resource\") || undefined,\n\t});\n\n\tif (!result.success) {\n\t\tconst errMsg = result.error?.message ?? \"Authorization failed\";\n\t\tconst invalidScope = result.error?.code === \"INVALID_SCOPE\";\n\t\t// On error, redirect back with error params — use generic description to avoid\n\t\t// leaking internal error details to the (already-validated) redirect target\n\t\ttry {\n\t\t\tconst errorUrl = new URL(redirectUri);\n\t\t\terrorUrl.searchParams.set(\"error\", invalidScope ? \"invalid_scope\" : \"server_error\");\n\t\t\terrorUrl.searchParams.set(\n\t\t\t\t\"error_description\",\n\t\t\t\tinvalidScope ? \"No selected permission can be granted\" : \"Authorization failed\",\n\t\t\t);\n\t\t\tif (state) errorUrl.searchParams.set(\"state\", state);\n\t\t\treturn Response.redirect(errorUrl.toString(), 302);\n\t\t} catch {\n\t\t\treturn new Response(renderErrorPage(escapeHtml(errMsg)), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\treturn Response.redirect(result.data.redirect_url, 302);\n};\n\n// ---------------------------------------------------------------------------\n// HTML rendering\n// ---------------------------------------------------------------------------\n\nfunction renderConsentPage(params: {\n\tclientId: string;\n\tscopes: string[];\n\tredirectUri: string;\n\tresponseType: string;\n\tcodeChallenge: string;\n\tcodeChallengeMethod: string;\n\tstate: string;\n\tresource: string;\n\tuserName: string;\n\tcsrfToken: string;\n}): string {\n\tconst scopeList = params.scopes\n\t\t.map((s) => {\n\t\t\tconst label = SCOPE_LABELS[s] ?? getPluginScopeLabel(s) ?? s;\n\t\t\treturn `<li><label><input type=\"checkbox\" name=\"scope\" value=\"${escapeHtml(s)}\" checked><span>${escapeHtml(label)}</span></label></li>`;\n\t\t})\n\t\t.join(\"\\n\");\n\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize Application — EmDash</title>\n<style>\n  * { margin: 0; padding: 0; box-sizing: border-box; }\n  body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n  .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n  h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 0.5rem; }\n  .client-id { color: #a3a3a3; font-size: 0.875rem; word-break: break-all; margin-bottom: 1.5rem; }\n  .user { color: #a3a3a3; font-size: 0.875rem; margin-bottom: 1rem; }\n  h2 { font-size: 0.875rem; font-weight: 500; color: #a3a3a3; text-transform: uppercase; letter-spacing: 0.05em; margin-bottom: 0.75rem; }\n  ul { list-style: none; margin-bottom: 1.5rem; }\n  li { padding: 0.5rem 0; border-bottom: 1px solid #262626; font-size: 0.875rem; }\n  li:last-child { border-bottom: none; }\n  label { display: flex; align-items: flex-start; gap: 0.625rem; cursor: pointer; }\n  input[type=\"checkbox\"] { margin-top: 0.125rem; accent-color: #2563eb; }\n  .actions { display: flex; gap: 0.75rem; }\n  button { flex: 1; padding: 0.625rem 1rem; border-radius: 8px; border: none; font-size: 0.875rem; font-weight: 500; cursor: pointer; }\n  .approve { background: #2563eb; color: white; }\n  .approve:hover { background: #1d4ed8; }\n  .deny { background: #262626; color: #e5e5e5; }\n  .deny:hover { background: #333; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Authorize Application</h1>\n  <p class=\"client-id\">${escapeHtml(params.clientId)}</p>\n  <p class=\"user\">Signed in as <strong>${escapeHtml(params.userName)}</strong></p>\n  <form method=\"POST\">\n    <h2>Permissions requested</h2>\n    <ul>${scopeList}</ul>\n    <input type=\"hidden\" name=\"csrf_token\" value=\"${escapeHtml(params.csrfToken)}\">\n    <input type=\"hidden\" name=\"response_type\" value=\"${escapeHtml(params.responseType)}\">\n    <input type=\"hidden\" name=\"client_id\" value=\"${escapeHtml(params.clientId)}\">\n    <input type=\"hidden\" name=\"redirect_uri\" value=\"${escapeHtml(params.redirectUri)}\">\n    <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(params.state)}\">\n    <input type=\"hidden\" name=\"code_challenge\" value=\"${escapeHtml(params.codeChallenge)}\">\n    <input type=\"hidden\" name=\"code_challenge_method\" value=\"${escapeHtml(params.codeChallengeMethod)}\">\n    <input type=\"hidden\" name=\"resource\" value=\"${escapeHtml(params.resource)}\">\n    <div class=\"actions\">\n      <button type=\"submit\" name=\"action\" value=\"deny\" class=\"deny\">Deny</button>\n      <button type=\"submit\" name=\"action\" value=\"approve\" class=\"approve\">Approve</button>\n    </div>\n  </form>\n</div>\n</body>\n</html>`;\n}\n\nfunction getPluginScopeLabel(scope: string): string | null {\n\tconst pluginId = scope.startsWith(\"mcp:tools:\") ? scope.slice(\"mcp:tools:\".length) : \"\";\n\treturn pluginId ? `Use MCP tools from ${pluginId}` : null;\n}\n\nfunction renderErrorPage(message: string): string {\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorization Error — EmDash</title>\n<style>\n  * { margin: 0; padding: 0; box-sizing: border-box; }\n  body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n  .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n  h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 1rem; color: #ef4444; }\n  p { font-size: 0.875rem; color: #a3a3a3; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Authorization Error</h1>\n  <p>${escapeHtml(message)}</p>\n</div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;AA2BA,MAAa,YAAY;AAMzB,MAAM,mBAAmB;;AAGzB,SAAS,oBAA4B;CACpC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;;AAI1E,SAAS,iBAAiB,OAAe,SAAkB,SAA0B;AAWpF,QAAO,GAAG,iBAAiB,GAAG,MAAM,6DAJnB,UACd,QAAQ,WAAW,SAAS,GAC5B,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,YACX,aAAa;;;AAKxC,SAAS,cAAc,SAAiC;CACvD,MAAM,eAAe,QAAQ,QAAQ,IAAI,SAAS;AAClD,KAAI,CAAC,aAAc,QAAO;AAE1B,QADc,aAAa,MAAM,IAAI,OAAO,cAAc,iBAAiB,UAAU,CAAC,GACvE,MAAM;;AAOtB,MAAM,eAAuC;CAC5C,gBAAgB;CAChB,iBAAiB;CACjB,cAAc;CACd,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,qBAAqB;CACrB,gBAAgB;CAChB,iBAAiB;CACjB,mBAAmB;CACnB,aAAa;CACb,OAAO;CACP;AAMD,MAAa,MAAgB,OAAO,EAAE,KAAK,SAAS,aAAa;CAChE,MAAM,EAAE,QAAQ,SAAS;CAGzB,MAAM,WAAW,IAAI,aAAa,IAAI,YAAY;CAClD,MAAM,cAAc,IAAI,aAAa,IAAI,eAAe;CACxD,MAAM,eAAe,IAAI,aAAa,IAAI,gBAAgB;CAC1D,MAAM,gBAAgB,IAAI,aAAa,IAAI,iBAAiB;CAC5D,MAAM,sBAAsB,IAAI,aAAa,IAAI,wBAAwB;CACzE,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAG3C,KAAI,CAAC,YAAY,CAAC,eAAe,iBAAiB,UAAU,CAAC,cAC5D,QAAO,IAAI,SACV,gBAAgB,8DAA8D,EAC9E;EACC,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CACD;AAGF,KAAI,uBAAuB,wBAAwB,OAClD,QAAO,IAAI,SAAS,gBAAgB,gDAAgD,EAAE;EACrF,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAOH,KAAI,QAAQ,IAAI;EACf,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;;AAKJ,KAAI,CAAC,MAAM;EACV,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,WAAS,aAAa,IAAI,YAAY,IAAI,WAAW,IAAI,OAAO;AAChE,SAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;;CAInD,MAAM,kBAAkB,CACvB,GAAG,IAAI,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,aAAa,CAAC,CACzE;AAED,KAAI,gBAAgB,WAAW,EAC9B,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,YAAY,mBAAmB;CAGrC,MAAM,OAAO,kBAAkB;EAC9B;EACA,QAAQ;EACR;EACA;EACA;EACA,qBAAqB,uBAAuB;EAC5C,OAAO,SAAS;EAChB,UAAU,IAAI,aAAa,IAAI,WAAW,IAAI;EAC9C,UAAU,KAAK,QAAQ,KAAK;EAC5B;EACA,CAAC;AAEF,QAAO,IAAI,SAAS,MAAM,EACzB,SAAS;EACR,gBAAgB;EAChB,cAAc,iBAAiB,WAAW,SAAS,gBAAgB,KAAK,QAAQ,OAAO,CAAC;EACxF,EACD,CAAC;;AAOH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAGH,KAAI,CAAC,KACJ,QAAO,IAAI,SAAS,gBAAgB,2BAA2B,EAAE;EAChE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAGH,MAAM,WAAW,MAAM,QAAQ,UAAU;CACzC,MAAM,SAAS,MAAc,WAAW,OAAe;EACtD,MAAM,IAAI,SAAS,IAAI,KAAK;AAC5B,SAAO,OAAO,MAAM,WAAW,IAAI;;CAEpC,MAAM,kBAAkB,IAAI,KAC1B,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,IACjD,MAAM,IAAI,CACV,OAAO,QAAQ,CACf,OAAO,aAAa,CACtB;CACD,MAAM,iBAAiB,CACtB,GAAG,IAAI,IACN,SACE,OAAO,QAAQ,CACf,QAAQ,UAA2B,OAAO,UAAU,SAAS,CAC7D,OAAO,aAAa,CACpB,QAAQ,UAAU,gBAAgB,IAAI,MAAM,CAAC,CAC/C,CACD;CAKD,MAAM,WAAW,MAAM,aAAa;CACpC,MAAM,aAAa,cAAc,QAAQ;CACzC,MAAM,YAAY,IAAI,SACrB,gBAAgB,mDAAmD,EACnE;EAAE,QAAQ;EAAK,SAAS,EAAE,gBAAgB,4BAA4B;EAAE,CACxE;AACD,KAAI,CAAC,YAAY,CAAC,WAAY,QAAO;CAMrC,MAAM,cAAc,IAAI,aAAa;CACrC,MAAM,CAAC,WAAW,aAAa,MAAM,QAAQ,IAAI,CAChD,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC,EAC7D,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,CAAC,CAC/D,CAAC;CACF,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,IAAI,OAAO;AAEX,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,KAAM,EAAE;AACrD,KAAI,SAAS,EAAG,QAAO;CAEvB,MAAM,SAAS,MAAM,SAAS;CAC9B,MAAM,cAAc,MAAM,eAAe;CACzC,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAEhC,KAAI,CAAC,YACJ,QAAO,IAAI,SAAS,gBAAgB,wBAAwB,EAAE;EAC7D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,WAAW,oBAAoB,YAAY;AACjD,KAAI,SACH,QAAO,IAAI,SAAS,gBAAgB,WAAW,SAAS,CAAC,EAAE;EAC1D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAKH,KAAI,WAAW,QAAQ;EACtB,MAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SACJ,QAAO,IAAI,SAAS,gBAAgB,qBAAqB,EAAE;GAC1D,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,UAAU,oBAAoB,aAAa,MAAM;AACvD,SAAO,SAAS,SAAS,SAAS,IAAI;;CAIvC,MAAM,SAAS,MAAM,4BAA4B,OAAO,IAAI,KAAK,IAAI,KAAK,MAAM;EAC/E,eAAe,MAAM,iBAAiB,OAAO;EAC7C,WAAW,MAAM,YAAY;EAC7B,cAAc;EACd,OAAO,eAAe,KAAK,IAAI;EAC/B;EACA,gBAAgB,MAAM,iBAAiB;EACvC,uBAAuB,MAAM,yBAAyB,OAAO;EAC7D,UAAU,MAAM,WAAW,IAAI;EAC/B,CAAC;AAEF,KAAI,CAAC,OAAO,SAAS;EACpB,MAAM,SAAS,OAAO,OAAO,WAAW;EACxC,MAAM,eAAe,OAAO,OAAO,SAAS;AAG5C,MAAI;GACH,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,YAAS,aAAa,IAAI,SAAS,eAAe,kBAAkB,eAAe;AACnF,YAAS,aAAa,IACrB,qBACA,eAAe,0CAA0C,uBACzD;AACD,OAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,UAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;UAC3C;AACP,UAAO,IAAI,SAAS,gBAAgB,WAAW,OAAO,CAAC,EAAE;IACxD,QAAQ;IACR,SAAS,EAAE,gBAAgB,4BAA4B;IACvD,CAAC;;;AAIJ,QAAO,SAAS,SAAS,OAAO,KAAK,cAAc,IAAI;;AAOxD,SAAS,kBAAkB,QAWhB;CACV,MAAM,YAAY,OAAO,OACvB,KAAK,MAAM;EACX,MAAM,QAAQ,aAAa,MAAM,oBAAoB,EAAE,IAAI;AAC3D,SAAO,yDAAyD,WAAW,EAAE,CAAC,kBAAkB,WAAW,MAAM,CAAC;GACjH,CACD,KAAK,KAAK;AAEZ,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA8BiB,WAAW,OAAO,SAAS,CAAC;yCACZ,WAAW,OAAO,SAAS,CAAC;;;UAG3D,UAAU;oDACgC,WAAW,OAAO,UAAU,CAAC;uDAC1B,WAAW,OAAO,aAAa,CAAC;mDACpC,WAAW,OAAO,SAAS,CAAC;sDACzB,WAAW,OAAO,YAAY,CAAC;+CACtC,WAAW,OAAO,MAAM,CAAC;wDAChB,WAAW,OAAO,cAAc,CAAC;+DAC1B,WAAW,OAAO,oBAAoB,CAAC;kDACpD,WAAW,OAAO,SAAS,CAAC;;;;;;;;;;AAW9E,SAAS,oBAAoB,OAA8B;CAC1D,MAAM,WAAW,MAAM,WAAW,aAAa,GAAG,MAAM,MAAM,GAAoB,GAAG;AACrF,QAAO,WAAW,sBAAsB,aAAa;;AAGtD,SAAS,gBAAgB,SAAyB;AACjD,QAAO;;;;;;;;;;;;;;;;;OAiBD,WAAW,QAAQ,CAAC"}
+{"version":3,"file":"authorize.mjs","names":[],"sources":["../../../../../src/astro/routes/api/oauth/authorize.ts"],"sourcesContent":["/**\n * GET/POST /_emdash/oauth/authorize\n *\n * OAuth 2.1 Authorization Endpoint. Handles both the consent page (GET)\n * and consent submission (POST).\n *\n * GET: Renders an HTML consent page showing which client is requesting\n *      access and which scopes are being requested.\n * POST: Processes the user's decision (approve/deny) and redirects\n *       to the client's redirect_uri with an authorization code or error.\n *\n * Requires an authenticated session (not token auth). If unauthenticated,\n * redirects to login with a return URL.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { escapeHtml } from \"#api/escape.js\";\nimport {\n\tbuildDeniedRedirect,\n\thandleAuthorizationApproval,\n\tvalidateRedirectUri,\n} from \"#api/handlers/oauth-authorization.js\";\nimport { lookupOAuthClient, validateClientRedirectUri } from \"#api/handlers/oauth-clients.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { isValidScope } from \"#auth/api-tokens.js\";\n\nexport const prerender = false;\n\n// ---------------------------------------------------------------------------\n// CSRF (SEC-18): Double-submit cookie pattern\n// ---------------------------------------------------------------------------\n\nconst CSRF_COOKIE_NAME = \"emdash_oauth_csrf\";\n\n/** Generate a 32-byte random token as hex. */\nfunction generateCsrfToken(): string {\n\tconst bytes = new Uint8Array(32);\n\tcrypto.getRandomValues(bytes);\n\treturn Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** Build the Set-Cookie header value for the CSRF token. */\nfunction csrfCookieHeader(token: string, request: Request, siteUrl?: string): string {\n\t// SameSite=Strict prevents cross-site form submission.\n\t// HttpOnly: the token value is embedded in the form hidden field server-side,\n\t// so JS never needs to read the cookie. HttpOnly adds defense-in-depth.\n\t// Secure is set when:\n\t//   - siteUrl is configured and uses https (proxy case — request may be http internally), OR\n\t//   - the actual request is over https (non-proxy case, preserve existing behaviour)\n\tconst isSecure = siteUrl\n\t\t? siteUrl.startsWith(\"https:\")\n\t\t: new URL(request.url).protocol === \"https:\";\n\tconst secure = isSecure ? \"; Secure\" : \"\";\n\treturn `${CSRF_COOKIE_NAME}=${token}; Path=/_emdash/oauth/authorize; HttpOnly; SameSite=Strict${secure}`;\n}\n\n/** Extract the CSRF token from the request's cookies. */\nfunction getCsrfCookie(request: Request): string | null {\n\tconst cookieHeader = request.headers.get(\"Cookie\");\n\tif (!cookieHeader) return null;\n\tconst match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${CSRF_COOKIE_NAME}=([^;]+)`));\n\treturn match?.[1] ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// Human-readable scope labels\n// ---------------------------------------------------------------------------\n\nconst SCOPE_LABELS: Record<string, string> = {\n\t\"content:read\": \"Read content (posts, pages, etc.)\",\n\t\"content:write\": \"Create, edit, and delete content; manage menus and taxonomies\",\n\t\"media:read\": \"View media files\",\n\t\"media:write\": \"Upload and manage media files\",\n\t\"schema:read\": \"View collection schemas\",\n\t\"schema:write\": \"Create and modify collection schemas\",\n\t\"taxonomies:manage\": \"Manage taxonomies\",\n\t\"menus:manage\": \"Manage navigation menus\",\n\t\"settings:read\": \"View site settings\",\n\t\"settings:manage\": \"Modify site settings\",\n\t\"mcp:tools\": \"Use MCP tools from all enabled plugins\",\n\t\"transfer:export\":\n\t\t\"Export a copy of the entire site: all content, drafts, media, settings, and author names and emails\",\n\t\"transfer:analyze\": \"Upload site packages and check whether they can be imported into this site\",\n\t\"transfer:execute\": \"Import a site package into this empty site, overwriting its initial setup\",\n\tadmin: \"Full administrative access\",\n};\n\n// ---------------------------------------------------------------------------\n// GET: Render consent page\n// ---------------------------------------------------------------------------\n\nexport const GET: APIRoute = async ({ url, request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\t// Validate required OAuth params before rendering\n\tconst clientId = url.searchParams.get(\"client_id\");\n\tconst redirectUri = url.searchParams.get(\"redirect_uri\");\n\tconst responseType = url.searchParams.get(\"response_type\");\n\tconst codeChallenge = url.searchParams.get(\"code_challenge\");\n\tconst codeChallengeMethod = url.searchParams.get(\"code_challenge_method\");\n\tconst scope = url.searchParams.get(\"scope\");\n\tconst state = url.searchParams.get(\"state\");\n\n\t// Basic validation — detailed validation happens on POST\n\tif (!clientId || !redirectUri || responseType !== \"code\" || !codeChallenge) {\n\t\treturn new Response(\n\t\t\trenderErrorPage(\"Invalid authorization request. Missing required parameters.\"),\n\t\t\t{\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t},\n\t\t);\n\t}\n\n\tif (codeChallengeMethod && codeChallengeMethod !== \"S256\") {\n\t\treturn new Response(renderErrorPage(\"Only S256 code challenge method is supported.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate client_id is registered and redirect_uri is in the allowlist.\n\t// This check happens BEFORE authentication so we never redirect to an\n\t// unregistered URI (even for the login redirect, we only redirect to our\n\t// own login page, not to the client's redirect_uri).\n\tif (emdash?.db) {\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\t// If not authenticated, redirect to login with return URL\n\tif (!user) {\n\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\tloginUrl.searchParams.set(\"redirect\", url.pathname + url.search);\n\t\treturn Response.redirect(loginUrl.toString(), 302);\n\t}\n\n\t// Parse and validate scopes\n\tconst requestedScopes = [\n\t\t...new Set((scope ?? \"\").split(\" \").filter(Boolean).filter(isValidScope)),\n\t];\n\n\tif (requestedScopes.length === 0) {\n\t\treturn new Response(renderErrorPage(\"No valid scopes requested.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// SEC-18: Generate CSRF token for the consent form (double-submit cookie pattern)\n\tconst csrfToken = generateCsrfToken();\n\n\t// Render the consent page\n\tconst html = renderConsentPage({\n\t\tclientId,\n\t\tscopes: requestedScopes,\n\t\tredirectUri,\n\t\tresponseType,\n\t\tcodeChallenge,\n\t\tcodeChallengeMethod: codeChallengeMethod ?? \"S256\",\n\t\tstate: state ?? \"\",\n\t\tresource: url.searchParams.get(\"resource\") ?? \"\",\n\t\tuserName: user.name ?? user.email,\n\t\tcsrfToken,\n\t});\n\n\treturn new Response(html, {\n\t\theaders: {\n\t\t\t\"Content-Type\": \"text/html; charset=utf-8\",\n\t\t\t\"Set-Cookie\": csrfCookieHeader(csrfToken, request, getPublicOrigin(url, emdash?.config)),\n\t\t},\n\t});\n};\n\n// ---------------------------------------------------------------------------\n// POST: Process consent\n// ---------------------------------------------------------------------------\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn new Response(renderErrorPage(\"EmDash is not initialized.\"), {\n\t\t\tstatus: 500,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tif (!user) {\n\t\treturn new Response(renderErrorPage(\"Authentication required.\"), {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\tconst formData = await request.formData();\n\tconst field = (name: string, fallback = \"\"): string => {\n\t\tconst v = formData.get(name);\n\t\treturn typeof v === \"string\" ? v : fallback;\n\t};\n\tconst requestedScopes = new Set(\n\t\t(new URL(request.url).searchParams.get(\"scope\") ?? \"\")\n\t\t\t.split(\" \")\n\t\t\t.filter(Boolean)\n\t\t\t.filter(isValidScope),\n\t);\n\tconst selectedScopes = [\n\t\t...new Set(\n\t\t\tformData\n\t\t\t\t.getAll(\"scope\")\n\t\t\t\t.filter((value): value is string => typeof value === \"string\")\n\t\t\t\t.filter(isValidScope)\n\t\t\t\t.filter((scope) => requestedScopes.has(scope)),\n\t\t),\n\t];\n\n\t// SEC-18: Validate CSRF token (double-submit cookie pattern).\n\t// The form includes a hidden csrf_token field; the cookie has the same value.\n\t// An attacker cannot read the cookie to forge the form field (HttpOnly + SameSite=Strict).\n\tconst formCsrf = field(\"csrf_token\");\n\tconst cookieCsrf = getCsrfCookie(request);\n\tconst csrfError = new Response(\n\t\trenderErrorPage(\"Invalid or missing CSRF token. Please try again.\"),\n\t\t{ status: 403, headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n\t);\n\tif (!formCsrf || !cookieCsrf) return csrfError;\n\n\t// Constant-time comparison: hash both values to fixed-length 32-byte digests,\n\t// then XOR every byte pair. This avoids crypto.subtle.timingSafeEqual which is\n\t// a Cloudflare Workers extension and doesn't exist in Node.js.\n\t// The SHA-256 pre-hash ensures fixed length, eliminating length-leaking.\n\tconst csrfEncoder = new TextEncoder();\n\tconst [csrfHashA, csrfHashB] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(formCsrf)),\n\t\tcrypto.subtle.digest(\"SHA-256\", csrfEncoder.encode(cookieCsrf)),\n\t]);\n\tconst a = new Uint8Array(csrfHashA);\n\tconst b = new Uint8Array(csrfHashB);\n\tlet diff = 0;\n\t// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- tsgo needs these\n\tfor (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;\n\tif (diff !== 0) return csrfError;\n\n\tconst action = field(\"action\");\n\tconst redirectUri = field(\"redirect_uri\");\n\tconst state = field(\"state\") || undefined;\n\n\tif (!redirectUri) {\n\t\treturn new Response(renderErrorPage(\"Missing redirect_uri.\"), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// Validate redirect_uri scheme/host before using it for any redirect\n\tconst uriError = validateRedirectUri(redirectUri);\n\tif (uriError) {\n\t\treturn new Response(renderErrorPage(escapeHtml(uriError)), {\n\t\t\tstatus: 400,\n\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t});\n\t}\n\n\t// User denied — SEC-44: validate redirect_uri against client's registered URIs\n\t// before redirecting, to prevent open redirect on the deny path.\n\tif (action === \"deny\") {\n\t\tconst clientId = field(\"client_id\");\n\t\tif (!clientId) {\n\t\t\treturn new Response(renderErrorPage(\"Missing client_id.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst client = await lookupOAuthClient(emdash.db, clientId);\n\t\tif (!client) {\n\t\t\treturn new Response(renderErrorPage(\"Unknown client application.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst clientUriError = validateClientRedirectUri(redirectUri, client.redirectUris);\n\t\tif (clientUriError) {\n\t\t\treturn new Response(renderErrorPage(\"The redirect URI is not registered for this client.\"), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\n\t\tconst denyUrl = buildDeniedRedirect(redirectUri, state);\n\t\treturn Response.redirect(denyUrl, 302);\n\t}\n\n\t// User approved — process the authorization\n\tconst result = await handleAuthorizationApproval(emdash.db, user.id, user.role, {\n\t\tresponse_type: field(\"response_type\", \"code\"),\n\t\tclient_id: field(\"client_id\"),\n\t\tredirect_uri: redirectUri,\n\t\tscope: selectedScopes.join(\" \"),\n\t\tstate,\n\t\tcode_challenge: field(\"code_challenge\"),\n\t\tcode_challenge_method: field(\"code_challenge_method\", \"S256\"),\n\t\tresource: field(\"resource\") || undefined,\n\t});\n\n\tif (!result.success) {\n\t\tconst errMsg = result.error?.message ?? \"Authorization failed\";\n\t\tconst invalidScope = result.error?.code === \"INVALID_SCOPE\";\n\t\t// On error, redirect back with error params — use generic description to avoid\n\t\t// leaking internal error details to the (already-validated) redirect target\n\t\ttry {\n\t\t\tconst errorUrl = new URL(redirectUri);\n\t\t\terrorUrl.searchParams.set(\"error\", invalidScope ? \"invalid_scope\" : \"server_error\");\n\t\t\terrorUrl.searchParams.set(\n\t\t\t\t\"error_description\",\n\t\t\t\tinvalidScope ? \"No selected permission can be granted\" : \"Authorization failed\",\n\t\t\t);\n\t\t\tif (state) errorUrl.searchParams.set(\"state\", state);\n\t\t\treturn Response.redirect(errorUrl.toString(), 302);\n\t\t} catch {\n\t\t\treturn new Response(renderErrorPage(escapeHtml(errMsg)), {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n\t\t\t});\n\t\t}\n\t}\n\n\treturn Response.redirect(result.data.redirect_url, 302);\n};\n\n// ---------------------------------------------------------------------------\n// HTML rendering\n// ---------------------------------------------------------------------------\n\nfunction renderConsentPage(params: {\n\tclientId: string;\n\tscopes: string[];\n\tredirectUri: string;\n\tresponseType: string;\n\tcodeChallenge: string;\n\tcodeChallengeMethod: string;\n\tstate: string;\n\tresource: string;\n\tuserName: string;\n\tcsrfToken: string;\n}): string {\n\tconst scopeList = params.scopes\n\t\t.map((s) => {\n\t\t\tconst label = SCOPE_LABELS[s] ?? getPluginScopeLabel(s) ?? s;\n\t\t\treturn `<li><label><input type=\"checkbox\" name=\"scope\" value=\"${escapeHtml(s)}\" checked><span>${escapeHtml(label)}</span></label></li>`;\n\t\t})\n\t\t.join(\"\\n\");\n\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize Application — EmDash</title>\n<style>\n  * { margin: 0; padding: 0; box-sizing: border-box; }\n  body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n  .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n  h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 0.5rem; }\n  .client-id { color: #a3a3a3; font-size: 0.875rem; word-break: break-all; margin-bottom: 1.5rem; }\n  .user { color: #a3a3a3; font-size: 0.875rem; margin-bottom: 1rem; }\n  h2 { font-size: 0.875rem; font-weight: 500; color: #a3a3a3; text-transform: uppercase; letter-spacing: 0.05em; margin-bottom: 0.75rem; }\n  ul { list-style: none; margin-bottom: 1.5rem; }\n  li { padding: 0.5rem 0; border-bottom: 1px solid #262626; font-size: 0.875rem; }\n  li:last-child { border-bottom: none; }\n  label { display: flex; align-items: flex-start; gap: 0.625rem; cursor: pointer; }\n  input[type=\"checkbox\"] { margin-top: 0.125rem; accent-color: #2563eb; }\n  .actions { display: flex; gap: 0.75rem; }\n  button { flex: 1; padding: 0.625rem 1rem; border-radius: 8px; border: none; font-size: 0.875rem; font-weight: 500; cursor: pointer; }\n  .approve { background: #2563eb; color: white; }\n  .approve:hover { background: #1d4ed8; }\n  .deny { background: #262626; color: #e5e5e5; }\n  .deny:hover { background: #333; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Authorize Application</h1>\n  <p class=\"client-id\">${escapeHtml(params.clientId)}</p>\n  <p class=\"user\">Signed in as <strong>${escapeHtml(params.userName)}</strong></p>\n  <form method=\"POST\">\n    <h2>Permissions requested</h2>\n    <ul>${scopeList}</ul>\n    <input type=\"hidden\" name=\"csrf_token\" value=\"${escapeHtml(params.csrfToken)}\">\n    <input type=\"hidden\" name=\"response_type\" value=\"${escapeHtml(params.responseType)}\">\n    <input type=\"hidden\" name=\"client_id\" value=\"${escapeHtml(params.clientId)}\">\n    <input type=\"hidden\" name=\"redirect_uri\" value=\"${escapeHtml(params.redirectUri)}\">\n    <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(params.state)}\">\n    <input type=\"hidden\" name=\"code_challenge\" value=\"${escapeHtml(params.codeChallenge)}\">\n    <input type=\"hidden\" name=\"code_challenge_method\" value=\"${escapeHtml(params.codeChallengeMethod)}\">\n    <input type=\"hidden\" name=\"resource\" value=\"${escapeHtml(params.resource)}\">\n    <div class=\"actions\">\n      <button type=\"submit\" name=\"action\" value=\"deny\" class=\"deny\">Deny</button>\n      <button type=\"submit\" name=\"action\" value=\"approve\" class=\"approve\">Approve</button>\n    </div>\n  </form>\n</div>\n</body>\n</html>`;\n}\n\nfunction getPluginScopeLabel(scope: string): string | null {\n\tconst pluginId = scope.startsWith(\"mcp:tools:\") ? scope.slice(\"mcp:tools:\".length) : \"\";\n\treturn pluginId ? `Use MCP tools from ${pluginId}` : null;\n}\n\nfunction renderErrorPage(message: string): string {\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorization Error — EmDash</title>\n<style>\n  * { margin: 0; padding: 0; box-sizing: border-box; }\n  body { font-family: system-ui, -apple-system, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; justify-content: center; align-items: center; min-height: 100vh; padding: 1rem; }\n  .card { background: #171717; border: 1px solid #262626; border-radius: 12px; max-width: 420px; width: 100%; padding: 2rem; }\n  h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 1rem; color: #ef4444; }\n  p { font-size: 0.875rem; color: #a3a3a3; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Authorization Error</h1>\n  <p>${escapeHtml(message)}</p>\n</div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;AA2BA,MAAa,YAAY;AAMzB,MAAM,mBAAmB;;AAGzB,SAAS,oBAA4B;CACpC,MAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;;AAI1E,SAAS,iBAAiB,OAAe,SAAkB,SAA0B;AAWpF,QAAO,GAAG,iBAAiB,GAAG,MAAM,6DAJnB,UACd,QAAQ,WAAW,SAAS,GAC5B,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,YACX,aAAa;;;AAKxC,SAAS,cAAc,SAAiC;CACvD,MAAM,eAAe,QAAQ,QAAQ,IAAI,SAAS;AAClD,KAAI,CAAC,aAAc,QAAO;AAE1B,QADc,aAAa,MAAM,IAAI,OAAO,cAAc,iBAAiB,UAAU,CAAC,GACvE,MAAM;;AAOtB,MAAM,eAAuC;CAC5C,gBAAgB;CAChB,iBAAiB;CACjB,cAAc;CACd,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,qBAAqB;CACrB,gBAAgB;CAChB,iBAAiB;CACjB,mBAAmB;CACnB,aAAa;CACb,mBACC;CACD,oBAAoB;CACpB,oBAAoB;CACpB,OAAO;CACP;AAMD,MAAa,MAAgB,OAAO,EAAE,KAAK,SAAS,aAAa;CAChE,MAAM,EAAE,QAAQ,SAAS;CAGzB,MAAM,WAAW,IAAI,aAAa,IAAI,YAAY;CAClD,MAAM,cAAc,IAAI,aAAa,IAAI,eAAe;CACxD,MAAM,eAAe,IAAI,aAAa,IAAI,gBAAgB;CAC1D,MAAM,gBAAgB,IAAI,aAAa,IAAI,iBAAiB;CAC5D,MAAM,sBAAsB,IAAI,aAAa,IAAI,wBAAwB;CACzE,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAG3C,KAAI,CAAC,YAAY,CAAC,eAAe,iBAAiB,UAAU,CAAC,cAC5D,QAAO,IAAI,SACV,gBAAgB,8DAA8D,EAC9E;EACC,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CACD;AAGF,KAAI,uBAAuB,wBAAwB,OAClD,QAAO,IAAI,SAAS,gBAAgB,gDAAgD,EAAE;EACrF,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAOH,KAAI,QAAQ,IAAI;EACf,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;;AAKJ,KAAI,CAAC,MAAM;EACV,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,WAAS,aAAa,IAAI,YAAY,IAAI,WAAW,IAAI,OAAO;AAChE,SAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;;CAInD,MAAM,kBAAkB,CACvB,GAAG,IAAI,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,aAAa,CAAC,CACzE;AAED,KAAI,gBAAgB,WAAW,EAC9B,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,YAAY,mBAAmB;CAGrC,MAAM,OAAO,kBAAkB;EAC9B;EACA,QAAQ;EACR;EACA;EACA;EACA,qBAAqB,uBAAuB;EAC5C,OAAO,SAAS;EAChB,UAAU,IAAI,aAAa,IAAI,WAAW,IAAI;EAC9C,UAAU,KAAK,QAAQ,KAAK;EAC5B;EACA,CAAC;AAEF,QAAO,IAAI,SAAS,MAAM,EACzB,SAAS;EACR,gBAAgB;EAChB,cAAc,iBAAiB,WAAW,SAAS,gBAAgB,KAAK,QAAQ,OAAO,CAAC;EACxF,EACD,CAAC;;AAOH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,IAAI,SAAS,gBAAgB,6BAA6B,EAAE;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAGH,KAAI,CAAC,KACJ,QAAO,IAAI,SAAS,gBAAgB,2BAA2B,EAAE;EAChE,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAGH,MAAM,WAAW,MAAM,QAAQ,UAAU;CACzC,MAAM,SAAS,MAAc,WAAW,OAAe;EACtD,MAAM,IAAI,SAAS,IAAI,KAAK;AAC5B,SAAO,OAAO,MAAM,WAAW,IAAI;;CAEpC,MAAM,kBAAkB,IAAI,KAC1B,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,IACjD,MAAM,IAAI,CACV,OAAO,QAAQ,CACf,OAAO,aAAa,CACtB;CACD,MAAM,iBAAiB,CACtB,GAAG,IAAI,IACN,SACE,OAAO,QAAQ,CACf,QAAQ,UAA2B,OAAO,UAAU,SAAS,CAC7D,OAAO,aAAa,CACpB,QAAQ,UAAU,gBAAgB,IAAI,MAAM,CAAC,CAC/C,CACD;CAKD,MAAM,WAAW,MAAM,aAAa;CACpC,MAAM,aAAa,cAAc,QAAQ;CACzC,MAAM,YAAY,IAAI,SACrB,gBAAgB,mDAAmD,EACnE;EAAE,QAAQ;EAAK,SAAS,EAAE,gBAAgB,4BAA4B;EAAE,CACxE;AACD,KAAI,CAAC,YAAY,CAAC,WAAY,QAAO;CAMrC,MAAM,cAAc,IAAI,aAAa;CACrC,MAAM,CAAC,WAAW,aAAa,MAAM,QAAQ,IAAI,CAChD,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,SAAS,CAAC,EAC7D,OAAO,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,CAAC,CAC/D,CAAC;CACF,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,MAAM,IAAI,IAAI,WAAW,UAAU;CACnC,IAAI,OAAO;AAEX,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,KAAM,EAAE;AACrD,KAAI,SAAS,EAAG,QAAO;CAEvB,MAAM,SAAS,MAAM,SAAS;CAC9B,MAAM,cAAc,MAAM,eAAe;CACzC,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAEhC,KAAI,CAAC,YACJ,QAAO,IAAI,SAAS,gBAAgB,wBAAwB,EAAE;EAC7D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;CAIH,MAAM,WAAW,oBAAoB,YAAY;AACjD,KAAI,SACH,QAAO,IAAI,SAAS,gBAAgB,WAAW,SAAS,CAAC,EAAE;EAC1D,QAAQ;EACR,SAAS,EAAE,gBAAgB,4BAA4B;EACvD,CAAC;AAKH,KAAI,WAAW,QAAQ;EACtB,MAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SACJ,QAAO,IAAI,SAAS,gBAAgB,qBAAqB,EAAE;GAC1D,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,SAAS,MAAM,kBAAkB,OAAO,IAAI,SAAS;AAC3D,MAAI,CAAC,OACJ,QAAO,IAAI,SAAS,gBAAgB,8BAA8B,EAAE;GACnE,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;AAIH,MADuB,0BAA0B,aAAa,OAAO,aAAa,CAEjF,QAAO,IAAI,SAAS,gBAAgB,sDAAsD,EAAE;GAC3F,QAAQ;GACR,SAAS,EAAE,gBAAgB,4BAA4B;GACvD,CAAC;EAGH,MAAM,UAAU,oBAAoB,aAAa,MAAM;AACvD,SAAO,SAAS,SAAS,SAAS,IAAI;;CAIvC,MAAM,SAAS,MAAM,4BAA4B,OAAO,IAAI,KAAK,IAAI,KAAK,MAAM;EAC/E,eAAe,MAAM,iBAAiB,OAAO;EAC7C,WAAW,MAAM,YAAY;EAC7B,cAAc;EACd,OAAO,eAAe,KAAK,IAAI;EAC/B;EACA,gBAAgB,MAAM,iBAAiB;EACvC,uBAAuB,MAAM,yBAAyB,OAAO;EAC7D,UAAU,MAAM,WAAW,IAAI;EAC/B,CAAC;AAEF,KAAI,CAAC,OAAO,SAAS;EACpB,MAAM,SAAS,OAAO,OAAO,WAAW;EACxC,MAAM,eAAe,OAAO,OAAO,SAAS;AAG5C,MAAI;GACH,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,YAAS,aAAa,IAAI,SAAS,eAAe,kBAAkB,eAAe;AACnF,YAAS,aAAa,IACrB,qBACA,eAAe,0CAA0C,uBACzD;AACD,OAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,UAAO,SAAS,SAAS,SAAS,UAAU,EAAE,IAAI;UAC3C;AACP,UAAO,IAAI,SAAS,gBAAgB,WAAW,OAAO,CAAC,EAAE;IACxD,QAAQ;IACR,SAAS,EAAE,gBAAgB,4BAA4B;IACvD,CAAC;;;AAIJ,QAAO,SAAS,SAAS,OAAO,KAAK,cAAc,IAAI;;AAOxD,SAAS,kBAAkB,QAWhB;CACV,MAAM,YAAY,OAAO,OACvB,KAAK,MAAM;EACX,MAAM,QAAQ,aAAa,MAAM,oBAAoB,EAAE,IAAI;AAC3D,SAAO,yDAAyD,WAAW,EAAE,CAAC,kBAAkB,WAAW,MAAM,CAAC;GACjH,CACD,KAAK,KAAK;AAEZ,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA8BiB,WAAW,OAAO,SAAS,CAAC;yCACZ,WAAW,OAAO,SAAS,CAAC;;;UAG3D,UAAU;oDACgC,WAAW,OAAO,UAAU,CAAC;uDAC1B,WAAW,OAAO,aAAa,CAAC;mDACpC,WAAW,OAAO,SAAS,CAAC;sDACzB,WAAW,OAAO,YAAY,CAAC;+CACtC,WAAW,OAAO,MAAM,CAAC;wDAChB,WAAW,OAAO,cAAc,CAAC;+DAC1B,WAAW,OAAO,oBAAoB,CAAC;kDACpD,WAAW,OAAO,SAAS,CAAC;;;;;;;;;;AAW9E,SAAS,oBAAoB,OAA8B;CAC1D,MAAM,WAAW,MAAM,WAAW,aAAa,GAAG,MAAM,MAAM,GAAoB,GAAG;AACrF,QAAO,WAAW,sBAAsB,aAAa;;AAGtD,SAAS,gBAAgB,SAAyB;AACjD,QAAO;;;;;;;;;;;;;;;;;OAiBD,WAAW,QAAQ,CAAC"}

package/dist/astro/routes/api/oauth/device/authorize.mjs

@@ -1,10 +1,12 @@
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import "../../../../../api-tokens-DS1VzN7_.mjs";
-import "../../../../../oauth-user-lookup-ChVW4UWu.mjs";
-import { t as handleDeviceAuthorize } from "../../../../../device-flow-3E5l0fpH.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../api-tokens-CE1ECIg0.mjs";
+import "../../../../../oauth-user-lookup-vue9a64A.mjs";
+import { t as handleDeviceAuthorize } from "../../../../../device-flow-CRd6DXmW.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/device/authorize.ts

package/dist/astro/routes/api/oauth/device/authorize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/authorize.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/authorize\n *\n * User submits the user code after logging in via the browser.\n * This endpoint requires authentication (the user must be logged in).\n */\n\n/// <reference types=\"emdash/locals\" />\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceAuthorize } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\n\nexport const prerender = false;\n\nconst authorizeSchema = z.object({\n\tuser_code: z.string().min(1),\n\taction: z.enum([\"approve\", \"deny\"]).optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\tconst { user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Authentication required\", 401);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, authorizeSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleDeviceAuthorize(emdash.db, user.id, user.role, body);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to authorize device\", \"AUTHORIZE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAM,kBAAkB,EAAE,OAAO;CAChC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,QAAQ,EAAE,KAAK,CAAC,WAAW,OAAO,CAAC,CAAC,UAAU;CAC9C,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,SAAS;AAEjB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,2BAA2B,IAAI;AAGrE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,sBAAsB,OAAO,IAAI,KAAK,IAAI,KAAK,MAAM,KAAK,CACpD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,kBAAkB"}
+{"version":3,"file":"authorize.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/authorize.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/authorize\n *\n * User submits the user code after logging in via the browser.\n * This endpoint requires authentication (the user must be logged in).\n */\n\n/// <reference types=\"emdash/locals\" />\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceAuthorize } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\n\nexport const prerender = false;\n\nconst authorizeSchema = z.object({\n\tuser_code: z.string().min(1),\n\taction: z.enum([\"approve\", \"deny\"]).optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\tconst { user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Authentication required\", 401);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, authorizeSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleDeviceAuthorize(emdash.db, user.id, user.role, body);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to authorize device\", \"AUTHORIZE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAM,kBAAkB,EAAE,OAAO;CAChC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,QAAQ,EAAE,KAAK,CAAC,WAAW,OAAO,CAAC,CAAC,UAAU;CAC9C,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,SAAS;AAEjB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,2BAA2B,IAAI;AAGrE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,gBAAgB;AACtD,MAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,SAAO,aADQ,MAAM,sBAAsB,OAAO,IAAI,KAAK,IAAI,KAAK,MAAM,KAAK,CACpD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,kBAAkB"}

package/dist/astro/routes/api/oauth/device/code.mjs

@@ -1,13 +1,15 @@
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-Cg7SuD15.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-BWVHsfQv.mjs";
-import "../../../../../api-tokens-DS1VzN7_.mjs";
-import "../../../../../oauth-user-lookup-ChVW4UWu.mjs";
-import { n as handleDeviceCodeRequest } from "../../../../../device-flow-3E5l0fpH.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-CqJn-w4h.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-tKiVtyTD.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-Bn7U0D7-.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-BZ6nybgc.mjs";
+import "../../../../../api-tokens-CE1ECIg0.mjs";
+import "../../../../../oauth-user-lookup-vue9a64A.mjs";
+import { n as handleDeviceCodeRequest } from "../../../../../device-flow-CRd6DXmW.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/device/code.ts

package/dist/astro/routes/api/oauth/device/code.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"code.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/code.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/code\n *\n * Issue a device code + user code for the OAuth Device Flow.\n * This is an unauthenticated endpoint (the CLI doesn't have a token yet).\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceCodeRequest } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceCodeSchema = z.object({\n\tclient_id: z.string().optional(),\n\tscope: z.string().optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals, url }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceCodeSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/code\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Build the verification URI — device page lives inside the admin SPA\n\t\tconst verificationUri = new URL(\n\t\t\t\"/_emdash/admin/device\",\n\t\t\tgetPublicOrigin(url, emdash?.config),\n\t\t).toString();\n\n\t\tconst result = await handleDeviceCodeRequest(emdash.db, body, verificationUri);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create device code\", \"DEVICE_CODE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAEzB,MAAM,mBAAmB,EAAE,OAAO;CACjC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,UAAU;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,eAAe,IAAI,GAAG,EAC7D,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,kBAAkB,IAAI,IAC3B,yBACA,gBAAgB,KAAK,QAAQ,OAAO,CACpC,CAAC,UAAU;AAGZ,SAAO,aADQ,MAAM,wBAAwB,OAAO,IAAI,MAAM,gBAAgB,CACnD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,oBAAoB"}
+{"version":3,"file":"code.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/code.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/code\n *\n * Issue a device code + user code for the OAuth Device Flow.\n * This is an unauthenticated endpoint (the CLI doesn't have a token yet).\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceCodeRequest } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceCodeSchema = z.object({\n\tclient_id: z.string().optional(),\n\tscope: z.string().optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals, url }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceCodeSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/code\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Build the verification URI — device page lives inside the admin SPA\n\t\tconst verificationUri = new URL(\n\t\t\t\"/_emdash/admin/device\",\n\t\t\tgetPublicOrigin(url, emdash?.config),\n\t\t).toString();\n\n\t\tconst result = await handleDeviceCodeRequest(emdash.db, body, verificationUri);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create device code\", \"DEVICE_CODE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAEzB,MAAM,mBAAmB,EAAE,OAAO;CACjC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,UAAU;CACjE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,eAAe,IAAI,GAAG,EAC7D,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,kBAAkB,IAAI,IAC3B,yBACA,gBAAgB,KAAK,QAAQ,OAAO,CACpC,CAAC,UAAU;AAGZ,SAAO,aADQ,MAAM,wBAAwB,OAAO,IAAI,MAAM,gBAAgB,CACnD;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,oBAAoB"}

package/dist/astro/routes/api/oauth/device/token.mjs

@@ -1,12 +1,14 @@
 import "../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../types-BkUg2yHx.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CCTCskie.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cr379Av9.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-Cg7SuD15.mjs";
-import "../../../../../api-tokens-DS1VzN7_.mjs";
-import "../../../../../oauth-user-lookup-ChVW4UWu.mjs";
-import { r as handleDeviceTokenExchange } from "../../../../../device-flow-3E5l0fpH.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-CqJn-w4h.mjs";
+import "../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CfvOHP0M.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DY6OD1j_.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-tKiVtyTD.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-BZ6nybgc.mjs";
+import "../../../../../api-tokens-CE1ECIg0.mjs";
+import "../../../../../oauth-user-lookup-vue9a64A.mjs";
+import { r as handleDeviceTokenExchange } from "../../../../../device-flow-CRd6DXmW.mjs";
 import { z } from "zod";
 
 //#region src/astro/routes/api/oauth/device/token.ts

package/dist/astro/routes/api/oauth/device/token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"token.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/token.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/token\n *\n * CLI polls this endpoint to exchange a device code for tokens.\n * Returns RFC 8628 error codes during the polling phase.\n * This is an unauthenticated endpoint.\n *\n * Rate limited: 12 requests per minute per IP.\n * Also enforces RFC 8628 slow_down: if polled faster than the interval,\n * responds with { error: \"slow_down\", interval: N } and increases the interval by 5s.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceTokenExchange } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceTokenSchema = z.object({\n\tdevice_code: z.string().min(1),\n\tgrant_type: z.string().min(1),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceTokenSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 12 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/token\", 12, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\tconst result = await handleDeviceTokenExchange(emdash.db, body);\n\n\t\t// RFC 8628 requires specific error format for device flow errors\n\t\t// RFC 6749 §5.1 requires Cache-Control: no-store + Pragma: no-cache on token responses\n\t\tif (!result.success && result.deviceFlowError) {\n\t\t\tconst errorBody: { error: string; interval?: number } = { error: result.deviceFlowError };\n\t\t\tif (result.deviceFlowInterval !== undefined) {\n\t\t\t\terrorBody.interval = result.deviceFlowInterval;\n\t\t\t}\n\t\t\treturn Response.json(errorBody, {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"Cache-Control\": \"no-store\",\n\t\t\t\t\tPragma: \"no-cache\",\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to exchange device code\", \"TOKEN_EXCHANGE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAClC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC9B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC7B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,gBAAgB,IAAI,GAAG,EAC9D,QACd,QAAO,kBAAkB,GAAG;EAG7B,MAAM,SAAS,MAAM,0BAA0B,OAAO,IAAI,KAAK;AAI/D,MAAI,CAAC,OAAO,WAAW,OAAO,iBAAiB;GAC9C,MAAM,YAAkD,EAAE,OAAO,OAAO,iBAAiB;AACzF,OAAI,OAAO,uBAAuB,OACjC,WAAU,WAAW,OAAO;AAE7B,UAAO,SAAS,KAAK,WAAW;IAC/B,QAAQ;IACR,SAAS;KACR,gBAAgB;KAChB,iBAAiB;KACjB,QAAQ;KACR;IACD,CAAC;;AAGH,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,uBAAuB"}
+{"version":3,"file":"token.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/oauth/device/token.ts"],"sourcesContent":["/**\n * POST /_emdash/api/oauth/device/token\n *\n * CLI polls this endpoint to exchange a device code for tokens.\n * Returns RFC 8628 error codes during the polling phase.\n * This is an unauthenticated endpoint.\n *\n * Rate limited: 12 requests per minute per IP.\n * Also enforces RFC 8628 slow_down: if polled faster than the interval,\n * responds with { error: \"slow_down\", interval: N } and increases the interval by 5s.\n */\n\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleDeviceTokenExchange } from \"#api/handlers/device-flow.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\n\nexport const prerender = false;\n\nconst deviceTokenSchema = z.object({\n\tdevice_code: z.string().min(1),\n\tgrant_type: z.string().min(1),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\tconst body = await parseBody(request, deviceTokenSchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 12 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"device/token\", 12, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\tconst result = await handleDeviceTokenExchange(emdash.db, body);\n\n\t\t// RFC 8628 requires specific error format for device flow errors\n\t\t// RFC 6749 §5.1 requires Cache-Control: no-store + Pragma: no-cache on token responses\n\t\tif (!result.success && result.deviceFlowError) {\n\t\t\tconst errorBody: { error: string; interval?: number } = { error: result.deviceFlowError };\n\t\t\tif (result.deviceFlowInterval !== undefined) {\n\t\t\t\terrorBody.interval = result.deviceFlowInterval;\n\t\t\t}\n\t\t\treturn Response.json(errorBody, {\n\t\t\t\tstatus: 400,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\"Cache-Control\": \"no-store\",\n\t\t\t\t\tPragma: \"no-cache\",\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to exchange device code\", \"TOKEN_EXCHANGE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAClC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC9B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC7B,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,gBAAgB,IAAI,GAAG,EAC9D,QACd,QAAO,kBAAkB,GAAG;EAG7B,MAAM,SAAS,MAAM,0BAA0B,OAAO,IAAI,KAAK;AAI/D,MAAI,CAAC,OAAO,WAAW,OAAO,iBAAiB;GAC9C,MAAM,YAAkD,EAAE,OAAO,OAAO,iBAAiB;AACzF,OAAI,OAAO,uBAAuB,OACjC,WAAU,WAAW,OAAO;AAE7B,UAAO,SAAS,KAAK,WAAW;IAC/B,QAAQ;IACR,SAAS;KACR,gBAAgB;KAChB,iBAAiB;KACjB,QAAQ;KACR;IACD,CAAC;;AAGH,SAAO,aAAa,OAAO;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,uBAAuB"}

package/dist/astro/routes/api/oauth/register.mjs

@@ -1,7 +1,9 @@
 import "../../../../base64-DvnNgP7e.mjs";
 import "../../../../types-BkUg2yHx.mjs";
-import { r as handleError, t as apiError } from "../../../../error-CCTCskie.mjs";
-import { t as handleOAuthClientCreate } from "../../../../oauth-clients-BMPA8vjl.mjs";
+import "../../../../errors-DgE1zJGG.mjs";
+import "../../../../errors-BF0_LFhW.mjs";
+import { r as handleError, t as apiError } from "../../../../error-CfvOHP0M.mjs";
+import { t as handleOAuthClientCreate } from "../../../../oauth-clients-Djq9r_KP.mjs";
 
 //#region src/astro/routes/api/oauth/register.ts
 const prerender = false;