emdash 0.40.1 → 0.42.0

package/src/astro/integration/routes.ts

@@ -218,22 +218,13 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/translations.ts"),
 	});
 
-	// Content relation routes
-	injectRoute({
-		pattern: "/_emdash/api/relations",
-		entrypoint: resolveRoute("api/relations/index.ts"),
-	});
-
-	injectRoute({
-		pattern: "/_emdash/api/relations/[id]",
-		entrypoint: resolveRoute("api/relations/[id]/index.ts"),
-	});
-
+	// Scheduled publishing routes
 	injectRoute({
-		pattern: "/_emdash/api/relations/[id]/translations",
-		entrypoint: resolveRoute("api/relations/[id]/translations.ts"),
+		pattern: "/_emdash/api/content/[collection]/[id]/schedule",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/schedule.ts"),
 	});
 
+	// Reference field edge routes (children = parent side, parents = backlinks)
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/[id]/references/[relation]/children",
 		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/children.ts"),
@@ -244,12 +235,6 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/parents.ts"),
 	});
 
-	// Scheduled publishing routes
-	injectRoute({
-		pattern: "/_emdash/api/content/[collection]/[id]/schedule",
-		entrypoint: resolveRoute("api/content/[collection]/[id]/schedule.ts"),
-	});
-
 	// Revision management routes (for restore, etc.)
 	injectRoute({
 		pattern: "/_emdash/api/revisions/[revisionId]",
@@ -574,6 +559,17 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/terms/[taxonomy].ts"),
 	});
 
+	// Relation definition routes (reference field relations)
+	injectRoute({
+		pattern: "/_emdash/api/relations",
+		entrypoint: resolveRoute("api/relations/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/relations/[id]",
+		entrypoint: resolveRoute("api/relations/[id]/index.ts"),
+	});
+
 	// Plugin management routes (under /admin to avoid conflict with plugin API routes)
 	injectRoute({
 		pattern: "/_emdash/api/admin/plugins",
@@ -671,6 +667,12 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/admin/plugins/updates.ts"),
 	});
 
+	// Core update notice
+	injectRoute({
+		pattern: "/_emdash/api/admin/core-update",
+		entrypoint: resolveRoute("api/admin/core-update.ts"),
+	});
+
 	// Exclusive hooks admin routes
 	injectRoute({
 		pattern: "/_emdash/api/admin/hooks/exclusive",

package/src/astro/integration/runtime.ts

@@ -81,7 +81,7 @@ export interface StorageCollectionDeclaration {
 	uniqueIndexes?: string[];
 }
 
-export interface PluginDescriptor<TOptions = Record<string, unknown>> {
+export interface PluginDescriptor<TOptions extends object = object> {
 	/** Unique plugin identifier */
 	id: string;
 	/** Plugin version (semver) */
@@ -169,7 +169,7 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
  * These run in isolated V8 isolates via Worker Loader on Cloudflare.
  * The `entrypoint` is resolved to a file and bundled at build time.
  */
-export type SandboxedPluginDescriptor<TOptions = Record<string, unknown>> =
+export type SandboxedPluginDescriptor<TOptions extends object = object> =
 	PluginDescriptor<TOptions>;
 
 export interface EmDashConfig {
@@ -214,10 +214,12 @@ export interface EmDashConfig {
 	 * Preview and visual-edit requests bypass the cache, so editors previewing
 	 * see live content. All other reads — including authenticated browsing outside
 	 * edit mode — are served from the cache, which only ever stores published
-	 * content. After an edit, anonymous visitors may see stale content until other
-	 * isolates pick up the bumped epoch: immediate with the memory backend, and on
-	 * KV bounded by KV's edge-cache propagation (eventual consistency, up to ~60s)
-	 * plus the isolate-local `revalidate` window (default 1s).
+	 * content. When Astro route caching is enabled, a rendered cache fill bypasses
+	 * the object cache so a purged page cannot be rebuilt from an older snapshot.
+	 * Other requests may see stale content until isolates pick up the bumped epoch:
+	 * immediate with the memory backend, and on KV bounded by KV's edge-cache
+	 * propagation (eventual consistency, up to ~60s) plus the isolate-local
+	 * `revalidate` window (default 1s).
 	 *
 	 * Scheduled content becomes visible at query time (no write event fires when
 	 * its publish time passes), so a cached list/entry won't surface a newly-due
@@ -403,6 +405,27 @@ export interface EmDashConfig {
 	 */
 	registry?: RegistryConfigOption;
 
+	/**
+	 * Core update notice in the admin dashboard.
+	 *
+	 * When enabled (the default), EmDash checks the public npm registry
+	 * (`registry.npmjs.org`) at most once per day for published `emdash`
+	 * releases and shows a dismissible banner in the admin dashboard when
+	 * a newer version is available. The check is deferred after the
+	 * response and carries no site data — it's a plain GET to the public
+	 * registry. Sites without outbound internet simply never see the banner.
+	 *
+	 * The banner names the newest stable release that has been public for
+	 * `minimumReleaseAge`: a duration string (`"48h"`, `"7d"`) or a number
+	 * of seconds, `"24h"` by default. Set it to match a package manager's
+	 * release-age policy, such as pnpm's `minimumReleaseAge`.
+	 *
+	 * Set to `false` to disable the check entirely.
+	 *
+	 * @default true
+	 */
+	updateCheck?: boolean | { minimumReleaseAge?: string | number };
+
 	/**
 	 * Experimental features.
 	 *
@@ -628,6 +651,7 @@ export interface EmDashConfig {
 	 *   admin: {
 	 *     logo: "/images/agency-logo.webp",
 	 *     siteName: "AgencyX CMS",
+	 *     footerLabel: "AgencyX",
 	 *     favicon: "/favicon.ico",
 	 *   },
 	 * })
@@ -636,8 +660,10 @@ export interface EmDashConfig {
 	admin?: {
 		/** URL or path to a custom logo image for the admin UI (login page, sidebar). */
 		logo?: string;
-		/** Custom name displayed in the admin sidebar and browser tab. */
+		/** Custom name displayed in the admin sidebar header and browser tab. */
 		siteName?: string;
+		/** Label displayed beside the version in the sidebar footer. Set to false to hide it. */
+		footerLabel?: string | false;
 		/** URL or path to a custom favicon for the admin panel. */
 		favicon?: string;
 	};

package/src/astro/integration/virtual-modules.ts

@@ -295,6 +295,7 @@ export function generatePluginsModule(descriptors: PluginDescriptor[]): string {
 					settingsSchema: descriptor.settingsSchema,
 					portableTextBlocks: descriptor.portableTextBlocks,
 					fieldWidgets: descriptor.fieldWidgets,
+					mcp: descriptor.mcp,
 				})})`,
 			);
 		} else {

package/src/astro/integration/vite-config.ts

@@ -7,8 +7,8 @@
 
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname, isAbsolute, relative, resolve, win32 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 import type { AstroConfig } from "astro";
 import type { Plugin } from "vite";
@@ -70,16 +70,22 @@ import {
 } from "./virtual-modules.js";
 
 const LOCALE_MESSAGES_RE = /[/\\]([a-z]{2}(?:-[A-Z]{2})?)[/\\]messages\.mjs$/;
+
+export function pathToImportUrl(path: string): string {
+	return pathToFileURL(path, { windows: win32.isAbsolute(path) }).href;
+}
+
 /**
  * Vite plugin that compiles Lingui macros in admin source files.
  * Only active in dev mode when the admin package is aliased to source for HMR.
  * @babel/core is dynamically imported from admin's devDependencies —
  * not declared by core, never ships to end users.
  */
-function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string): Plugin {
-	// Resolve @babel/core from admin's devDependencies, not core's.
+export function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string): Plugin {
 	const adminRequire = createRequire(resolve(adminDistPath, "index.js"));
 	const babelCorePath = adminRequire.resolve("@babel/core");
+	const linguiMacroPluginPath = adminRequire.resolve("@lingui/babel-plugin-lingui-macro");
+	const adminSourceVitePath = adminSourcePath.replaceAll("\\", "/");
 
 	return {
 		name: "emdash-lingui-macro",
@@ -88,18 +94,20 @@ function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string): Plug
 			// Redirect relative locale catalog imports (e.g. ./de/messages.mjs) from
 			// within admin source to the compiled dist/locales/ directory, since
 			// lingui compile only runs during build — not in dev watch mode.
-			if (!importer?.startsWith(adminSourcePath)) return;
+			if (!importer?.startsWith(adminSourceVitePath)) return;
 			const match = id.match(LOCALE_MESSAGES_RE);
 			if (match?.[1]) {
 				return resolve(adminDistPath, "locales", match[1], "messages.mjs");
 			}
 		},
 		async transform(code, id) {
-			if (!id.startsWith(adminSourcePath) || !code.includes("@lingui")) return;
-			const { transformAsync } = (await import(babelCorePath)) as typeof import("@babel/core");
+			if (!id.startsWith(adminSourceVitePath) || !code.includes("@lingui")) return;
+			const { transformAsync } = (await import(
+				pathToImportUrl(babelCorePath)
+			)) as typeof import("@babel/core");
 			const result = await transformAsync(code, {
 				filename: id,
-				plugins: ["@lingui/babel-plugin-lingui-macro"],
+				plugins: [linguiMacroPluginPath],
 				parserOpts: { plugins: ["jsx", "typescript"] },
 			});
 			if (!result?.code) return;

package/src/astro/middleware/redirect.ts

@@ -19,6 +19,7 @@ import { defineMiddleware } from "astro:middleware";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
+import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
 
 /** Paths that should never be intercepted by redirects */
@@ -33,6 +34,12 @@ function isRedirectCode(code: number): code is RedirectCode {
 	return code === 301 || code === 302 || code === 303 || code === 307 || code === 308;
 }
 
+function warnUnsafeDestination(id: string): void {
+	console.warn(
+		`[emdash:redirects] Skipping redirect ${id}: destination is not a site-relative path`,
+	);
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 
@@ -80,7 +87,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				return new Response(null, { status: exact.type });
 			}
 			const dest = exact.destination;
-			if (dest.startsWith("//") || dest.startsWith("/\\")) return next();
+			if (!isSiteRelativeDestination(dest)) {
+				warnUnsafeDestination(exact.id);
+				return next();
+			}
 			repo.recordHit(exact.id).catch(() => {});
 			const code = isRedirectCode(exact.type) ? exact.type : 301;
 			return context.redirect(dest, code);
@@ -95,7 +105,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				repo.recordHit(redirect.id).catch(() => {});
 				return new Response(null, { status: redirect.type });
 			}
-			if (destination.startsWith("//") || destination.startsWith("/\\")) return next();
+			if (!isSiteRelativeDestination(destination)) {
+				warnUnsafeDestination(redirect.id);
+				return next();
+			}
 			repo.recordHit(redirect.id).catch(() => {});
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
 			return context.redirect(destination, code);

package/src/astro/middleware/request-context.ts

@@ -2,7 +2,8 @@
  * EmDash Request Context Middleware
  *
  * Sets up AsyncLocalStorage-based request context for query functions.
- * Skips ALS entirely for logged-out users with no CMS signals (fast path).
+ * Skips ALS for logged-out users with no CMS signals unless a configured
+ * object cache must be fenced off during a route-cache render.
  *
  * Handles:
  * - Preview tokens: _preview query param with signed HMAC token
@@ -209,13 +210,19 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
-	// No CMS signals and not an editor → skip everything (zero overhead in
-	// server mode; client mode injects the identical-for-everyone bootstrap)
+	// No CMS signals and not an editor. Route-cache renders get a context so
+	// object-cache reads cannot seed a fresh response with stale data; other
+	// requests retain the anonymous fast path.
 	if (!hasEditCookie && !hasPreviewToken && !isEditor) {
-		if (toolbarMode === "client") {
-			return injectBootstrap(await next());
+		const render = async () => {
+			const response = await next();
+			return toolbarMode === "client" ? injectBootstrap(response) : response;
+		};
+		if (virtualConfig?.objectCacheEnabled && context.cache?.enabled) {
+			const parent = getRequestContext();
+			return runWithContext({ ...parent, editMode: false, routeCacheFill: true }, render);
 		}
-		return next();
+		return render();
 	}
 
 	// Determine edit mode: cookie AND authenticated editor

package/src/astro/routes/api/admin/bylines/[id]/index.ts

@@ -8,6 +8,8 @@ import { bylineUpdateBody } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { after } from "../../../../../../after.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ params, locals }) => {
@@ -58,7 +60,11 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 		customFields: body.customFields,
 	});
 
-	if (result.success) invalidateBylineCache();
+	if (result.success) {
+		invalidateBylineCache();
+		const byline = result.data;
+		after(() => emdash.hooks.runBylineAfterSave(byline, false));
+	}
 	return unwrapResult(result);
 };
 
@@ -73,9 +79,13 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 
 	try {
 		const repo = new BylineRepository(emdash.db);
+		const existing = emdash.hooks.hasHooks("byline:afterDelete")
+			? await repo.findById(params.id!)
+			: null;
 		const deleted = await repo.delete(params.id!);
 		if (!deleted) return apiError("NOT_FOUND", "Byline not found", 404);
 		invalidateBylineCache();
+		if (existing) after(() => emdash.hooks.runBylineAfterDelete(existing));
 		return apiSuccess({ deleted: true });
 	} catch (error) {
 		return handleError(error, "Failed to delete byline", "BYLINE_DELETE_ERROR");

package/src/astro/routes/api/admin/bylines/[id]/translations.ts

@@ -22,6 +22,8 @@ import { bylineTranslationCreateBody } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { after } from "../../../../../../after.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ params, locals }) => {
@@ -84,7 +86,11 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			translationOf: id,
 		});
 
-		if (result.success) invalidateBylineCache();
+		if (result.success) {
+			invalidateBylineCache();
+			const byline = result.data;
+			after(() => emdash.hooks.runBylineAfterSave(byline, true));
+		}
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(

package/src/astro/routes/api/admin/bylines/index.ts

@@ -8,6 +8,7 @@ import { bylineCreateBody, bylinesListQuery } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { after } from "../../../../../after.js";
 import { getI18nConfig, resolveConfiguredLocale } from "../../../../../i18n/config.js";
 
 export const prerender = false;
@@ -75,7 +76,11 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			customFields: body.customFields,
 		});
 
-		if (result.success) invalidateBylineCache();
+		if (result.success) {
+			invalidateBylineCache();
+			const byline = result.data;
+			after(() => emdash.hooks.runBylineAfterSave(byline, true));
+		}
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create byline", "BYLINE_CREATE_ERROR");

package/src/astro/routes/api/admin/core-update.ts

@@ -0,0 +1,34 @@
+/**
+ * Core update status endpoint
+ *
+ * GET /_emdash/api/admin/core-update - Cached "is a newer EmDash
+ * version available?" status for the admin dashboard banner. Serves
+ * the options-table cache and defers the (at most daily) npm registry
+ * refresh via `after()`, so it never blocks on the network.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+import { handleCoreUpdateStatus, minimumReleaseAgeSeconds } from "#api/handlers/update-check.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "updates:read");
+	if (denied) return denied;
+
+	const { updateCheck } = emdash.config;
+	const result = await handleCoreUpdateStatus(emdash.db, {
+		enabled: updateCheck !== false,
+		minimumReleaseAgeSeconds: minimumReleaseAgeSeconds(updateCheck),
+	});
+	return unwrapResult(result);
+};

package/src/astro/routes/api/admin/plugins/marketplace/[id]/icon.ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError } from "#api/error.js";
+import { fetchWithinOrigin, MarketplaceError } from "#plugins/marketplace.js";
 
 export const prerender = false;
 
@@ -35,7 +36,7 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	if (width) target.searchParams.set("w", width);
 
 	try {
-		const resp = await fetch(target.href);
+		const resp = await fetchWithinOrigin(target.href, "Icon fetch", "PROXY");
 		if (!resp.ok) {
 			// Allowlist: only forward Content-Type from upstream.
 			// Never copy all upstream headers (denylist approach leaks
@@ -55,7 +56,10 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 				"Cache-Control": "private, no-store",
 			},
 		});
-	} catch {
+	} catch (error) {
+		if (error instanceof MarketplaceError && error.code) {
+			return apiError(error.code, "Icon redirect was not followed", 502);
+		}
 		return apiError("PROXY_ERROR", "Failed to fetch icon", 502);
 	}
 };

package/src/astro/routes/api/admin/themes/marketplace/[id]/thumbnail.ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError } from "#api/error.js";
+import { fetchWithinOrigin, MarketplaceError } from "#plugins/marketplace.js";
 
 export const prerender = false;
 
@@ -35,7 +36,7 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	if (width) target.searchParams.set("w", width);
 
 	try {
-		const resp = await fetch(target.href);
+		const resp = await fetchWithinOrigin(target.href, "Thumbnail fetch", "PROXY");
 		if (!resp.ok) {
 			// Allowlist: only forward Content-Type from upstream.
 			// Never copy all upstream headers (denylist approach leaks
@@ -55,7 +56,10 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 				"Cache-Control": "private, no-store",
 			},
 		});
-	} catch {
+	} catch (error) {
+		if (error instanceof MarketplaceError && error.code) {
+			return apiError(error.code, "Thumbnail redirect was not followed", 502);
+		}
 		return apiError("PROXY_ERROR", "Failed to fetch thumbnail", 502);
 	}
 };

package/src/astro/routes/api/auth/invite/complete.ts

@@ -22,12 +22,15 @@ import { createChallengeStore } from "#auth/challenge-store.js";
 import { getPasskeyConfig } from "#auth/passkey-config.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
+import { sessionUnavailableError } from "../../../../session-user.js";
+
 export const POST: APIRoute = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	if (!session) return sessionUnavailableError();
 
 	try {
 		const body = await parseBody(request, inviteCompleteBody);
@@ -62,10 +65,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		// Register the passkey for the new user
 		await registerPasskey(adapter, user.id, verified, "Initial passkey");
 
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
+		session.set("user", { id: user.id });
 
 		return apiSuccess({
 			success: true,

package/src/astro/routes/api/auth/magic-link/verify.ts

@@ -21,6 +21,8 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { magicLinkVerifyBody } from "#api/schemas.js";
 
+import { sessionUnavailableError } from "../../../../session-user.js";
+
 export const GET: APIRoute = async ({ url, redirect }) => {
 	const token = url.searchParams.get("token");
 	if (!token) {
@@ -39,6 +41,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	if (!session) return sessionUnavailableError();
 
 	try {
 		const body = await parseBody(request, magicLinkVerifyBody);
@@ -50,7 +53,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		// Fire-and-forget cleanup of expired tokens -- prevents accumulation
 		void adapter.deleteExpiredTokens().catch(() => {});
 
-		session?.set("user", { id: user.id });
+		session.set("user", { id: user.id });
 
 		return apiSuccess({ success: true });
 	} catch (error) {

package/src/astro/routes/api/auth/oauth/[provider]/callback.ts

@@ -22,6 +22,8 @@ import { finalizeSetup } from "#api/setup-complete.js";
 import { createOAuthStateStore } from "#auth/oauth-state-store.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
+import { SESSION_UNAVAILABLE_MESSAGE } from "../../../../../session-user.js";
+
 type ProviderName = "github" | "google";
 
 const VALID_PROVIDERS = new Set<string>(["github", "google"]);
@@ -134,6 +136,12 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 			);
 		}
 
+		if (!session) {
+			return redirect(
+				`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(SESSION_UNAVAILABLE_MESSAGE)}`,
+			);
+		}
+
 		const adapter = createKyselyAdapter(emdash.db);
 		const stateStore = createOAuthStateStore(emdash.db);
 
@@ -199,10 +207,7 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 			console.log(`[oauth] Setup complete: created admin user via ${provider} (${user.email})`);
 		}
 
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
+		session.set("user", { id: user.id });
 
 		// Redirect to admin dashboard
 		return redirect("/_emdash/admin");

package/src/astro/routes/api/auth/passkey/verify.ts

@@ -20,12 +20,15 @@ import { createChallengeStore } from "#auth/challenge-store.js";
 import { getPasskeyConfig } from "#auth/passkey-config.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
+import { sessionUnavailableError } from "../../../../session-user.js";
+
 export const POST: APIRoute = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	if (!session) return sessionUnavailableError();
 
 	try {
 		const body = await parseBody(request, passkeyVerifyBody);
@@ -53,10 +56,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 			challengeStore,
 		);
 
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
+		session.set("user", { id: user.id });
 
 		return apiSuccess({
 			success: true,

package/src/astro/routes/api/auth/signup/complete.ts

@@ -22,12 +22,15 @@ import { createChallengeStore } from "#auth/challenge-store.js";
 import { getPasskeyConfig } from "#auth/passkey-config.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
+import { sessionUnavailableError } from "../../../../session-user.js";
+
 export const POST: APIRoute = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	if (!session) return sessionUnavailableError();
 
 	try {
 		const body = await parseBody(request, signupCompleteBody);
@@ -62,10 +65,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		// Register the passkey for the new user
 		await registerPasskey(adapter, user.id, verified, "Initial passkey");
 
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
+		session.set("user", { id: user.id });
 
 		return apiSuccess({
 			success: true,