emdash 0.41.0 → 0.42.0

package/dist/astro/routes/api/auth/me.mjs

@@ -1,20 +1,21 @@
 import "../../../../config-CvmjJcVw.mjs";
 import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../types-aOOxRSx6.mjs";
-import { t as UserRepository } from "../../../../user-ElwQjTQT.mjs";
-import "../../../../errors-Bt3goF8I.mjs";
-import "../../../../settings-DSfE7wOa.mjs";
-import "../../../../site-settings-NGzdrt7O.mjs";
-import "../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BfsNNrIE.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CORGGhHf.mjs";
-import "../../../../redirects-BjTwDTsV.mjs";
-import "../../../../entry-lock-BaRBHCsH.mjs";
-import "../../../../media-OEIQ3bVc.mjs";
-import "../../../../comments-M4EDYAHw.mjs";
-import { v as authMeActionBody } from "../../../../byline-fields-B8HH-35f.mjs";
-import "../../../../menus-p_M1V7J_.mjs";
-import "../../../../status-lzyj4Uu7.mjs";
+import "../../../../url-Dn3IStq8.mjs";
+import "../../../../types-j6MBDjlZ.mjs";
+import { t as UserRepository } from "../../../../user-BOvuF1sQ.mjs";
+import "../../../../errors-CjXd1LgH.mjs";
+import "../../../../errors-CNvATh_7.mjs";
+import "../../../../settings-B0zQj_Tj.mjs";
+import "../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-Gt2l4Sld.mjs";
+import "../../../../redirects-D4EWeXAo.mjs";
+import "../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../media-D1z_jisb.mjs";
+import "../../../../comments-BRtp992B.mjs";
+import { x as authMeActionBody } from "../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../menus-BQKqf0Up.mjs";
+import "../../../../status-D39Fpy8R.mjs";
 import "../../../../api/schemas/index.mjs";
 
 //#region src/astro/routes/api/auth/me.ts

package/dist/astro/routes/api/auth/me.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"me.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/me.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/me\n *\n * Returns the current authenticated user's info.\n * Used by the admin UI to display user info in the header.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { authMeActionBody } from \"#api/schemas.js\";\nimport { UserRepository } from \"#db/repositories/user.js\";\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tlet userData = user.data;\n\tif (locals.__playgroundDb) {\n\t\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\t\ttry {\n\t\t\tconst persistedUser = await new UserRepository(emdash.db).findById(user.id);\n\t\t\tif (persistedUser) userData = persistedUser.data;\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to fetch current user\", \"CURRENT_USER_ERROR\");\n\t\t}\n\t}\n\n\t// Check if this is the user's first login (for welcome modal).\n\t// The flag is persisted in the user's `data` JSON column so it survives\n\t// session expiry / rotation.\n\tconst isFirstLogin = !userData?.welcomeDismissed;\n\n\t// Return safe user info (no sensitive data)\n\treturn apiSuccess({\n\t\tid: user.id,\n\t\temail: user.email,\n\t\tname: user.name,\n\t\trole: user.role,\n\t\tavatarUrl: user.avatarUrl,\n\t\tisFirstLogin,\n\t});\n};\n\n/**\n * POST /_emdash/api/auth/me\n *\n * Mark that the user has seen the welcome modal.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst body = await parseBody(request, authMeActionBody);\n\tif (isParseError(body)) return body;\n\n\tif (body.action === \"dismissWelcome\") {\n\t\ttry {\n\t\t\t// Persist in the user's data column so it survives session expiry.\n\t\t\tconst userRepo = new UserRepository(emdash.db);\n\t\t\tawait userRepo.update(user.id, {\n\t\t\t\tdata: { ...user.data, welcomeDismissed: true },\n\t\t\t});\n\t\t\treturn apiSuccess({ success: true });\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to dismiss welcome\", \"WELCOME_DISMISS_ERROR\");\n\t\t}\n\t}\n\n\treturn apiError(\"UNKNOWN_ACTION\", \"Unknown action\", 400);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAOzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;CAG/D,IAAI,WAAW,KAAK;AACpB,KAAI,OAAO,gBAAgB;AAC1B,MAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEhF,MAAI;GACH,MAAM,gBAAgB,MAAM,IAAI,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,GAAG;AAC3E,OAAI,cAAe,YAAW,cAAc;WACpC,OAAO;AACf,UAAO,YAAY,OAAO,gCAAgC,qBAAqB;;;CAOjF,MAAM,eAAe,CAAC,UAAU;AAGhC,QAAO,WAAW;EACjB,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB;EACA,CAAC;;;;;;;AAQH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,KAAI,aAAa,KAAK,CAAE,QAAO;AAE/B,KAAI,KAAK,WAAW,iBACnB,KAAI;AAGH,QADiB,IAAI,eAAe,OAAO,GAAG,CAC/B,OAAO,KAAK,IAAI,EAC9B,MAAM;GAAE,GAAG,KAAK;GAAM,kBAAkB;GAAM,EAC9C,CAAC;AACF,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB;;AAIjF,QAAO,SAAS,kBAAkB,kBAAkB,IAAI"}
+{"version":3,"file":"me.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/me.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/me\n *\n * Returns the current authenticated user's info.\n * Used by the admin UI to display user info in the header.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { authMeActionBody } from \"#api/schemas.js\";\nimport { UserRepository } from \"#db/repositories/user.js\";\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tlet userData = user.data;\n\tif (locals.__playgroundDb) {\n\t\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\t\ttry {\n\t\t\tconst persistedUser = await new UserRepository(emdash.db).findById(user.id);\n\t\t\tif (persistedUser) userData = persistedUser.data;\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to fetch current user\", \"CURRENT_USER_ERROR\");\n\t\t}\n\t}\n\n\t// Check if this is the user's first login (for welcome modal).\n\t// The flag is persisted in the user's `data` JSON column so it survives\n\t// session expiry / rotation.\n\tconst isFirstLogin = !userData?.welcomeDismissed;\n\n\t// Return safe user info (no sensitive data)\n\treturn apiSuccess({\n\t\tid: user.id,\n\t\temail: user.email,\n\t\tname: user.name,\n\t\trole: user.role,\n\t\tavatarUrl: user.avatarUrl,\n\t\tisFirstLogin,\n\t});\n};\n\n/**\n * POST /_emdash/api/auth/me\n *\n * Mark that the user has seen the welcome modal.\n */\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { user, emdash } = locals;\n\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst body = await parseBody(request, authMeActionBody);\n\tif (isParseError(body)) return body;\n\n\tif (body.action === \"dismissWelcome\") {\n\t\ttry {\n\t\t\t// Persist in the user's data column so it survives session expiry.\n\t\t\tconst userRepo = new UserRepository(emdash.db);\n\t\t\tawait userRepo.update(user.id, {\n\t\t\t\tdata: { ...user.data, welcomeDismissed: true },\n\t\t\t});\n\t\t\treturn apiSuccess({ success: true });\n\t\t} catch (error) {\n\t\t\treturn handleError(error, \"Failed to dismiss welcome\", \"WELCOME_DISMISS_ERROR\");\n\t\t}\n\t}\n\n\treturn apiError(\"UNKNOWN_ACTION\", \"Unknown action\", 400);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AASA,MAAa,YAAY;AAOzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;CAG/D,IAAI,WAAW,KAAK;AACpB,KAAI,OAAO,gBAAgB;AAC1B,MAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEhF,MAAI;GACH,MAAM,gBAAgB,MAAM,IAAI,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,GAAG;AAC3E,OAAI,cAAe,YAAW,cAAc;WACpC,OAAO;AACf,UAAO,YAAY,OAAO,gCAAgC,qBAAqB;;;CAOjF,MAAM,eAAe,CAAC,UAAU;AAGhC,QAAO,WAAW;EACjB,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB;EACA,CAAC;;;;;;;AAQH,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,MAAM,WAAW;AAEzB,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,KAAI,aAAa,KAAK,CAAE,QAAO;AAE/B,KAAI,KAAK,WAAW,iBACnB,KAAI;AAGH,QADiB,IAAI,eAAe,OAAO,GAAG,CAC/B,OAAO,KAAK,IAAI,EAC9B,MAAM;GAAE,GAAG,KAAK;GAAM,kBAAkB;GAAM,EAC9C,CAAC;AACF,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,wBAAwB;;AAIjF,QAAO,SAAS,kBAAkB,kBAAkB,IAAI"}

package/dist/astro/routes/api/auth/mode.mjs

@@ -1,9 +1,9 @@
 import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../types-aOOxRSx6.mjs";
-import "../../../../errors-Bt3goF8I.mjs";
-import "../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess } from "../../../../error-BfsNNrIE.mjs";
-import { t as getAuthMode } from "../../../../mode-DpYW3w6U.mjs";
+import "../../../../types-j6MBDjlZ.mjs";
+import "../../../../errors-CjXd1LgH.mjs";
+import "../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess } from "../../../../error-CEdm_AWU.mjs";
+import { t as getAuthMode } from "../../../../mode-nh0ppSX5.mjs";
 
 //#region src/astro/routes/api/auth/mode.ts
 const prerender = false;

package/dist/astro/routes/api/auth/oauth/_provider_/callback.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAsEA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"callback.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAwEA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs

@@ -1,7 +1,15 @@
+import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-CIRe-2T6.mjs";
-import { t as finalizeSetup } from "../../../../../../setup-complete-B8W8sJ9v.mjs";
-import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-y8mEYVq9.mjs";
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../error-CEdm_AWU.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-B5a0QAh6.mjs";
+import { t as SESSION_UNAVAILABLE_MESSAGE } from "../../../../../../session-user-DVcHsFD5.mjs";
+import { n as finalizeSetup } from "../../../../../../setup-complete-CuLcTDTU.mjs";
+import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-CM5ZEYQS.mjs";
 import { OAuthError, Role, handleOAuthCallback } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
@@ -56,6 +64,7 @@ const GET = async ({ params, request, locals, session, redirect }) => {
 		const { env: cfEnv } = await import("virtual:emdash/env");
 		const providers = getOAuthConfig(cfEnv ?? import.meta.env);
 		if (!providers[provider]) return redirect(`/_emdash/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`);
+		if (!session) return redirect(`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(SESSION_UNAVAILABLE_MESSAGE)}`);
 		const adapter = createKyselyAdapter(emdash.db);
 		const stateStore = createOAuthStateStore(emdash.db);
 		const config = {
@@ -93,7 +102,7 @@ const GET = async ({ params, request, locals, session, redirect }) => {
 			await finalizeSetup(emdash.db);
 			console.log(`[oauth] Setup complete: created admin user via ${provider} (${user.email})`);
 		}
-		if (session) session.set("user", { id: user.id });
+		session.set("user", { id: user.id });
 		return redirect("/_emdash/admin");
 	} catch (callbackError) {
 		console.error("OAuth callback error:", callbackError);

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"callback.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/oauth/[provider]/callback\n *\n * Handle OAuth callback from provider\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport {\n\thandleOAuthCallback,\n\tOAuthError,\n\tRole,\n\ttype OAuthConsumerConfig,\n\ttype RoleLevel,\n} from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { finalizeSetup } from \"#api/setup-complete.js\";\nimport { createOAuthStateStore } from \"#auth/oauth-state-store.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\ntype ProviderName = \"github\" | \"google\";\n\nconst VALID_PROVIDERS = new Set<string>([\"github\", \"google\"]);\n\nfunction isValidProvider(provider: string): provider is ProviderName {\n\treturn VALID_PROVIDERS.has(provider);\n}\n\n/** Safely extract a string value from an env-like record */\nfunction envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst val = env[key];\n\t\tif (typeof val === \"string\" && val) return val;\n\t}\n\treturn undefined;\n}\n\n/**\n * Get OAuth config from environment variables\n */\nfunction getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig[\"providers\"] {\n\tconst providers: OAuthConsumerConfig[\"providers\"] = {};\n\n\t// GitHub\n\tconst githubClientId = envString(env, \"EMDASH_OAUTH_GITHUB_CLIENT_ID\", \"GITHUB_CLIENT_ID\");\n\tconst githubClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GITHUB_CLIENT_SECRET\",\n\t\t\"GITHUB_CLIENT_SECRET\",\n\t);\n\tif (githubClientId && githubClientSecret) {\n\t\tproviders.github = {\n\t\t\tclientId: githubClientId,\n\t\t\tclientSecret: githubClientSecret,\n\t\t};\n\t}\n\n\t// Google\n\tconst googleClientId = envString(env, \"EMDASH_OAUTH_GOOGLE_CLIENT_ID\", \"GOOGLE_CLIENT_ID\");\n\tconst googleClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GOOGLE_CLIENT_SECRET\",\n\t\t\"GOOGLE_CLIENT_SECRET\",\n\t);\n\tif (googleClientId && googleClientSecret) {\n\t\tproviders.google = {\n\t\t\tclientId: googleClientId,\n\t\t\tclientSecret: googleClientSecret,\n\t\t};\n\t}\n\n\treturn providers;\n}\n\nexport const GET: APIRoute = async ({ params, request, locals, session, redirect }) => {\n\tconst { emdash } = locals;\n\tconst provider = params.provider;\n\n\t// Validate provider\n\tif (!provider || !isValidProvider(provider)) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_provider&message=${encodeURIComponent(\"Invalid OAuth provider\")}`,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(\"Database not configured\")}`,\n\t\t);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst code = url.searchParams.get(\"code\");\n\tconst state = url.searchParams.get(\"state\");\n\tconst error = url.searchParams.get(\"error\");\n\tconst errorDescription = url.searchParams.get(\"error_description\");\n\n\t// Handle OAuth errors from provider\n\tif (error) {\n\t\tconst message = errorDescription || error;\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=oauth_denied&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n\n\t// Validate required params\n\tif (!code || !state) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_callback&message=${encodeURIComponent(\"Missing code or state parameter\")}`,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Get OAuth providers from environment. Astro 6 removed\n\t\t// `Astro.locals.runtime.env` (accessing it throws rather than\n\t\t// returning undefined, so optional-chaining doesn't help) -- read\n\t\t// Cloudflare bindings via the emdash virtual module instead, which\n\t\t// re-exports `cloudflare:workers`' `env` under that adapter and\n\t\t// falls back to `import.meta.env` on Node (#1736).\n\t\t// @ts-ignore - virtual module, generated by the Astro integration\n\t\tconst { env: cfEnv } = (await import(\"virtual:emdash/env\")) as {\n\t\t\tenv?: Record<string, unknown>;\n\t\t};\n\t\tconst env = cfEnv ?? import.meta.env;\n\t\tconst providers = getOAuthConfig(env);\n\n\t\tif (!providers[provider]) {\n\t\t\treturn redirect(\n\t\t\t\t`/_emdash/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`,\n\t\t\t);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst stateStore = createOAuthStateStore(emdash.db);\n\n\t\tconst config: OAuthConsumerConfig = {\n\t\t\tbaseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,\n\t\t\tproviders,\n\t\t\tcanSelfSignup: async (email: string) => {\n\t\t\t\t// During setup: first user becomes admin.\n\t\t\t\t// Check setup_complete flag instead of countUsers() to avoid\n\t\t\t\t// a TOCTOU race where concurrent callbacks both see 0 users.\n\t\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\t\t\t\tif (setupComplete !== true && setupComplete !== \"true\") {\n\t\t\t\t\treturn { allowed: true, role: Role.ADMIN };\n\t\t\t\t}\n\n\t\t\t\t// Extract domain from email\n\t\t\t\tconst domain = email.split(\"@\")[1]?.toLowerCase();\n\t\t\t\tif (!domain) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Check allowed_domains table for a matching, enabled entry\n\t\t\t\tconst entry = await emdash.db\n\t\t\t\t\t.selectFrom(\"allowed_domains\")\n\t\t\t\t\t.selectAll()\n\t\t\t\t\t.where(\"domain\", \"=\", domain)\n\t\t\t\t\t.where(\"enabled\", \"=\", 1)\n\t\t\t\t\t.executeTakeFirst();\n\n\t\t\t\tif (!entry) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Map the stored role level to the Role enum\n\t\t\t\tconst roleLevel = entry.default_role;\n\t\t\t\tconst roleMap: Record<number, RoleLevel> = {\n\t\t\t\t\t50: Role.ADMIN,\n\t\t\t\t\t40: Role.EDITOR,\n\t\t\t\t\t30: Role.AUTHOR,\n\t\t\t\t\t20: Role.CONTRIBUTOR,\n\t\t\t\t\t10: Role.SUBSCRIBER,\n\t\t\t\t};\n\t\t\t\tconst role = roleMap[roleLevel] ?? Role.CONTRIBUTOR;\n\t\t\t\tif (!roleMap[roleLevel]) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`[oauth] Unknown role level ${roleLevel} for domain ${domain}, defaulting to CONTRIBUTOR`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn { allowed: true, role };\n\t\t\t},\n\t\t};\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupCompleteBefore = await options.get(\"emdash:setup_complete\");\n\t\tconst user = await handleOAuthCallback(config, adapter, provider, code, state, stateStore);\n\t\tconst isFirstUser = setupCompleteBefore !== true && setupCompleteBefore !== \"true\";\n\n\t\t// Finalize setup outside the transaction (idempotent, safe if two callbacks race).\n\t\tif (isFirstUser) {\n\t\t\tawait finalizeSetup(emdash.db);\n\t\t\tconsole.log(`[oauth] Setup complete: created admin user via ${provider} (${user.email})`);\n\t\t}\n\n\t\t// Create session\n\t\tif (session) {\n\t\t\tsession.set(\"user\", { id: user.id });\n\t\t}\n\n\t\t// Redirect to admin dashboard\n\t\treturn redirect(\"/_emdash/admin\");\n\t} catch (callbackError) {\n\t\tconsole.error(\"OAuth callback error:\", callbackError);\n\n\t\tlet message = \"Authentication failed\";\n\t\tlet errorCode = \"oauth_error\";\n\n\t\tif (callbackError instanceof OAuthError) {\n\t\t\terrorCode = callbackError.code;\n\n\t\t\t// Map all error codes to user-friendly messages (never expose raw error.message)\n\t\t\tswitch (callbackError.code) {\n\t\t\t\tcase \"invalid_state\":\n\t\t\t\t\tmessage = \"OAuth session expired or invalid. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"signup_not_allowed\":\n\t\t\t\t\tmessage = \"Self-signup is not allowed for your email. Please contact an administrator.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_invalid\":\n\t\t\t\t\tmessage = \"This invite link is invalid or has expired. Please ask for a new one.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_mismatch\":\n\t\t\t\t\tmessage = \"This invite was sent to a different email address than your account.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_unverified\":\n\t\t\t\t\tmessage =\n\t\t\t\t\t\t\"Your account's email is not verified by the provider. Please verify it and try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"user_not_found\":\n\t\t\t\t\tmessage = \"Your account was not found. It may have been deleted.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"token_exchange_failed\":\n\t\t\t\t\tmessage = \"Failed to complete authentication. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"profile_fetch_failed\":\n\t\t\t\t\tmessage = \"Failed to retrieve your profile. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\tmessage = \"Authentication failed. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\t// For generic errors, keep the default \"Authentication failed\" message\n\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=${errorCode}&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;AAQA,MAAa,YAAY;AAkBzB,MAAM,kBAAkB,IAAI,IAAY,CAAC,UAAU,SAAS,CAAC;AAE7D,SAAS,gBAAgB,UAA4C;AACpE,QAAO,gBAAgB,IAAI,SAAS;;;AAIrC,SAAS,UAAU,KAA8B,GAAG,MAAoC;AACvF,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,IAAK,QAAO;;;;;;AAQ7C,SAAS,eAAe,KAAgE;CACvF,MAAM,YAA8C,EAAE;CAGtD,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;AAGF,QAAO;;AAGR,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,eAAe;CACtF,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,OAAO;AAGxB,KAAI,CAAC,YAAY,CAAC,gBAAgB,SAAS,CAC1C,QAAO,SACN,uDAAuD,mBAAmB,yBAAyB,GACnG;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SACN,mDAAmD,mBAAmB,0BAA0B,GAChG;CAGF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,mBAAmB,IAAI,aAAa,IAAI,oBAAoB;AAGlE,KAAI,OAAO;EACV,MAAM,UAAU,oBAAoB;AACpC,SAAO,SACN,mDAAmD,mBAAmB,QAAQ,GAC9E;;AAIF,KAAI,CAAC,QAAQ,CAAC,MACb,QAAO,SACN,uDAAuD,mBAAmB,kCAAkC,GAC5G;AAGF,KAAI;EAQH,MAAM,EAAE,KAAK,UAAW,MAAM,OAAO;EAIrC,MAAM,YAAY,eADN,SAAS,OAAO,KAAK,IACI;AAErC,MAAI,CAAC,UAAU,UACd,QAAO,SACN,8DAA8D,mBAAmB,kBAAkB,SAAS,oBAAoB,GAChI;EAGF,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,aAAa,sBAAsB,OAAO,GAAG;EAEnD,MAAM,SAA8B;GACnC,SAAS,GAAG,gBAAgB,KAAK,QAAQ,OAAO,CAAC;GACjD;GACA,eAAe,OAAO,UAAkB;IAKvC,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAChE,QAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO;KAAE,SAAS;KAAM,MAAM,KAAK;KAAO;IAI3C,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,IAAI,aAAa;AACjD,QAAI,CAAC,OACJ,QAAO;IAIR,MAAM,QAAQ,MAAM,OAAO,GACzB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,UAAU,KAAK,OAAO,CAC5B,MAAM,WAAW,KAAK,EAAE,CACxB,kBAAkB;AAEpB,QAAI,CAAC,MACJ,QAAO;IAIR,MAAM,YAAY,MAAM;IACxB,MAAM,UAAqC;KAC1C,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT;IACD,MAAM,OAAO,QAAQ,cAAc,KAAK;AACxC,QAAI,CAAC,QAAQ,WACZ,SAAQ,KACP,8BAA8B,UAAU,cAAc,OAAO,6BAC7D;AAGF,WAAO;KAAE,SAAS;KAAM;KAAM;;GAE/B;EAGD,MAAM,sBAAsB,MADZ,IAAI,kBAAkB,OAAO,GAAG,CACN,IAAI,wBAAwB;EACtE,MAAM,OAAO,MAAM,oBAAoB,QAAQ,SAAS,UAAU,MAAM,OAAO,WAAW;AAI1F,MAHoB,wBAAwB,QAAQ,wBAAwB,QAG3D;AAChB,SAAM,cAAc,OAAO,GAAG;AAC9B,WAAQ,IAAI,kDAAkD,SAAS,IAAI,KAAK,MAAM,GAAG;;AAI1F,MAAI,QACH,SAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAIrC,SAAO,SAAS,iBAAiB;UACzB,eAAe;AACvB,UAAQ,MAAM,yBAAyB,cAAc;EAErD,IAAI,UAAU;EACd,IAAI,YAAY;AAEhB,MAAI,yBAAyB,YAAY;AACxC,eAAY,cAAc;AAG1B,WAAQ,cAAc,MAAtB;IACC,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eACC;AACD;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD;AACC,eAAU;AACV;;;AAKH,SAAO,SACN,8BAA8B,UAAU,WAAW,mBAAmB,QAAQ,GAC9E"}
+{"version":3,"file":"callback.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/oauth/[provider]/callback\n *\n * Handle OAuth callback from provider\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport {\n\thandleOAuthCallback,\n\tOAuthError,\n\tRole,\n\ttype OAuthConsumerConfig,\n\ttype RoleLevel,\n} from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { finalizeSetup } from \"#api/setup-complete.js\";\nimport { createOAuthStateStore } from \"#auth/oauth-state-store.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nimport { SESSION_UNAVAILABLE_MESSAGE } from \"../../../../../session-user.js\";\n\ntype ProviderName = \"github\" | \"google\";\n\nconst VALID_PROVIDERS = new Set<string>([\"github\", \"google\"]);\n\nfunction isValidProvider(provider: string): provider is ProviderName {\n\treturn VALID_PROVIDERS.has(provider);\n}\n\n/** Safely extract a string value from an env-like record */\nfunction envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst val = env[key];\n\t\tif (typeof val === \"string\" && val) return val;\n\t}\n\treturn undefined;\n}\n\n/**\n * Get OAuth config from environment variables\n */\nfunction getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig[\"providers\"] {\n\tconst providers: OAuthConsumerConfig[\"providers\"] = {};\n\n\t// GitHub\n\tconst githubClientId = envString(env, \"EMDASH_OAUTH_GITHUB_CLIENT_ID\", \"GITHUB_CLIENT_ID\");\n\tconst githubClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GITHUB_CLIENT_SECRET\",\n\t\t\"GITHUB_CLIENT_SECRET\",\n\t);\n\tif (githubClientId && githubClientSecret) {\n\t\tproviders.github = {\n\t\t\tclientId: githubClientId,\n\t\t\tclientSecret: githubClientSecret,\n\t\t};\n\t}\n\n\t// Google\n\tconst googleClientId = envString(env, \"EMDASH_OAUTH_GOOGLE_CLIENT_ID\", \"GOOGLE_CLIENT_ID\");\n\tconst googleClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GOOGLE_CLIENT_SECRET\",\n\t\t\"GOOGLE_CLIENT_SECRET\",\n\t);\n\tif (googleClientId && googleClientSecret) {\n\t\tproviders.google = {\n\t\t\tclientId: googleClientId,\n\t\t\tclientSecret: googleClientSecret,\n\t\t};\n\t}\n\n\treturn providers;\n}\n\nexport const GET: APIRoute = async ({ params, request, locals, session, redirect }) => {\n\tconst { emdash } = locals;\n\tconst provider = params.provider;\n\n\t// Validate provider\n\tif (!provider || !isValidProvider(provider)) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_provider&message=${encodeURIComponent(\"Invalid OAuth provider\")}`,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(\"Database not configured\")}`,\n\t\t);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst code = url.searchParams.get(\"code\");\n\tconst state = url.searchParams.get(\"state\");\n\tconst error = url.searchParams.get(\"error\");\n\tconst errorDescription = url.searchParams.get(\"error_description\");\n\n\t// Handle OAuth errors from provider\n\tif (error) {\n\t\tconst message = errorDescription || error;\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=oauth_denied&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n\n\t// Validate required params\n\tif (!code || !state) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_callback&message=${encodeURIComponent(\"Missing code or state parameter\")}`,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Get OAuth providers from environment. Astro 6 removed\n\t\t// `Astro.locals.runtime.env` (accessing it throws rather than\n\t\t// returning undefined, so optional-chaining doesn't help) -- read\n\t\t// Cloudflare bindings via the emdash virtual module instead, which\n\t\t// re-exports `cloudflare:workers`' `env` under that adapter and\n\t\t// falls back to `import.meta.env` on Node (#1736).\n\t\t// @ts-ignore - virtual module, generated by the Astro integration\n\t\tconst { env: cfEnv } = (await import(\"virtual:emdash/env\")) as {\n\t\t\tenv?: Record<string, unknown>;\n\t\t};\n\t\tconst env = cfEnv ?? import.meta.env;\n\t\tconst providers = getOAuthConfig(env);\n\n\t\tif (!providers[provider]) {\n\t\t\treturn redirect(\n\t\t\t\t`/_emdash/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`,\n\t\t\t);\n\t\t}\n\n\t\tif (!session) {\n\t\t\treturn redirect(\n\t\t\t\t`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(SESSION_UNAVAILABLE_MESSAGE)}`,\n\t\t\t);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst stateStore = createOAuthStateStore(emdash.db);\n\n\t\tconst config: OAuthConsumerConfig = {\n\t\t\tbaseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,\n\t\t\tproviders,\n\t\t\tcanSelfSignup: async (email: string) => {\n\t\t\t\t// During setup: first user becomes admin.\n\t\t\t\t// Check setup_complete flag instead of countUsers() to avoid\n\t\t\t\t// a TOCTOU race where concurrent callbacks both see 0 users.\n\t\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\t\t\t\tif (setupComplete !== true && setupComplete !== \"true\") {\n\t\t\t\t\treturn { allowed: true, role: Role.ADMIN };\n\t\t\t\t}\n\n\t\t\t\t// Extract domain from email\n\t\t\t\tconst domain = email.split(\"@\")[1]?.toLowerCase();\n\t\t\t\tif (!domain) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Check allowed_domains table for a matching, enabled entry\n\t\t\t\tconst entry = await emdash.db\n\t\t\t\t\t.selectFrom(\"allowed_domains\")\n\t\t\t\t\t.selectAll()\n\t\t\t\t\t.where(\"domain\", \"=\", domain)\n\t\t\t\t\t.where(\"enabled\", \"=\", 1)\n\t\t\t\t\t.executeTakeFirst();\n\n\t\t\t\tif (!entry) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Map the stored role level to the Role enum\n\t\t\t\tconst roleLevel = entry.default_role;\n\t\t\t\tconst roleMap: Record<number, RoleLevel> = {\n\t\t\t\t\t50: Role.ADMIN,\n\t\t\t\t\t40: Role.EDITOR,\n\t\t\t\t\t30: Role.AUTHOR,\n\t\t\t\t\t20: Role.CONTRIBUTOR,\n\t\t\t\t\t10: Role.SUBSCRIBER,\n\t\t\t\t};\n\t\t\t\tconst role = roleMap[roleLevel] ?? Role.CONTRIBUTOR;\n\t\t\t\tif (!roleMap[roleLevel]) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`[oauth] Unknown role level ${roleLevel} for domain ${domain}, defaulting to CONTRIBUTOR`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn { allowed: true, role };\n\t\t\t},\n\t\t};\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupCompleteBefore = await options.get(\"emdash:setup_complete\");\n\t\tconst user = await handleOAuthCallback(config, adapter, provider, code, state, stateStore);\n\t\tconst isFirstUser = setupCompleteBefore !== true && setupCompleteBefore !== \"true\";\n\n\t\t// Finalize setup outside the transaction (idempotent, safe if two callbacks race).\n\t\tif (isFirstUser) {\n\t\t\tawait finalizeSetup(emdash.db);\n\t\t\tconsole.log(`[oauth] Setup complete: created admin user via ${provider} (${user.email})`);\n\t\t}\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\t// Redirect to admin dashboard\n\t\treturn redirect(\"/_emdash/admin\");\n\t} catch (callbackError) {\n\t\tconsole.error(\"OAuth callback error:\", callbackError);\n\n\t\tlet message = \"Authentication failed\";\n\t\tlet errorCode = \"oauth_error\";\n\n\t\tif (callbackError instanceof OAuthError) {\n\t\t\terrorCode = callbackError.code;\n\n\t\t\t// Map all error codes to user-friendly messages (never expose raw error.message)\n\t\t\tswitch (callbackError.code) {\n\t\t\t\tcase \"invalid_state\":\n\t\t\t\t\tmessage = \"OAuth session expired or invalid. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"signup_not_allowed\":\n\t\t\t\t\tmessage = \"Self-signup is not allowed for your email. Please contact an administrator.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_invalid\":\n\t\t\t\t\tmessage = \"This invite link is invalid or has expired. Please ask for a new one.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_mismatch\":\n\t\t\t\t\tmessage = \"This invite was sent to a different email address than your account.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_unverified\":\n\t\t\t\t\tmessage =\n\t\t\t\t\t\t\"Your account's email is not verified by the provider. Please verify it and try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"user_not_found\":\n\t\t\t\t\tmessage = \"Your account was not found. It may have been deleted.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"token_exchange_failed\":\n\t\t\t\t\tmessage = \"Failed to complete authentication. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"profile_fetch_failed\":\n\t\t\t\t\tmessage = \"Failed to retrieve your profile. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\tmessage = \"Authentication failed. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\t// For generic errors, keep the default \"Authentication failed\" message\n\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=${errorCode}&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAoBzB,MAAM,kBAAkB,IAAI,IAAY,CAAC,UAAU,SAAS,CAAC;AAE7D,SAAS,gBAAgB,UAA4C;AACpE,QAAO,gBAAgB,IAAI,SAAS;;;AAIrC,SAAS,UAAU,KAA8B,GAAG,MAAoC;AACvF,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,IAAK,QAAO;;;;;;AAQ7C,SAAS,eAAe,KAAgE;CACvF,MAAM,YAA8C,EAAE;CAGtD,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;AAGF,QAAO;;AAGR,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,eAAe;CACtF,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,OAAO;AAGxB,KAAI,CAAC,YAAY,CAAC,gBAAgB,SAAS,CAC1C,QAAO,SACN,uDAAuD,mBAAmB,yBAAyB,GACnG;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SACN,mDAAmD,mBAAmB,0BAA0B,GAChG;CAGF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,mBAAmB,IAAI,aAAa,IAAI,oBAAoB;AAGlE,KAAI,OAAO;EACV,MAAM,UAAU,oBAAoB;AACpC,SAAO,SACN,mDAAmD,mBAAmB,QAAQ,GAC9E;;AAIF,KAAI,CAAC,QAAQ,CAAC,MACb,QAAO,SACN,uDAAuD,mBAAmB,kCAAkC,GAC5G;AAGF,KAAI;EAQH,MAAM,EAAE,KAAK,UAAW,MAAM,OAAO;EAIrC,MAAM,YAAY,eADN,SAAS,OAAO,KAAK,IACI;AAErC,MAAI,CAAC,UAAU,UACd,QAAO,SACN,8DAA8D,mBAAmB,kBAAkB,SAAS,oBAAoB,GAChI;AAGF,MAAI,CAAC,QACJ,QAAO,SACN,mDAAmD,mBAAmB,4BAA4B,GAClG;EAGF,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,aAAa,sBAAsB,OAAO,GAAG;EAEnD,MAAM,SAA8B;GACnC,SAAS,GAAG,gBAAgB,KAAK,QAAQ,OAAO,CAAC;GACjD;GACA,eAAe,OAAO,UAAkB;IAKvC,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAChE,QAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO;KAAE,SAAS;KAAM,MAAM,KAAK;KAAO;IAI3C,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,IAAI,aAAa;AACjD,QAAI,CAAC,OACJ,QAAO;IAIR,MAAM,QAAQ,MAAM,OAAO,GACzB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,UAAU,KAAK,OAAO,CAC5B,MAAM,WAAW,KAAK,EAAE,CACxB,kBAAkB;AAEpB,QAAI,CAAC,MACJ,QAAO;IAIR,MAAM,YAAY,MAAM;IACxB,MAAM,UAAqC;KAC1C,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT;IACD,MAAM,OAAO,QAAQ,cAAc,KAAK;AACxC,QAAI,CAAC,QAAQ,WACZ,SAAQ,KACP,8BAA8B,UAAU,cAAc,OAAO,6BAC7D;AAGF,WAAO;KAAE,SAAS;KAAM;KAAM;;GAE/B;EAGD,MAAM,sBAAsB,MADZ,IAAI,kBAAkB,OAAO,GAAG,CACN,IAAI,wBAAwB;EACtE,MAAM,OAAO,MAAM,oBAAoB,QAAQ,SAAS,UAAU,MAAM,OAAO,WAAW;AAI1F,MAHoB,wBAAwB,QAAQ,wBAAwB,QAG3D;AAChB,SAAM,cAAc,OAAO,GAAG;AAC9B,WAAQ,IAAI,kDAAkD,SAAS,IAAI,KAAK,MAAM,GAAG;;AAG1F,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAGpC,SAAO,SAAS,iBAAiB;UACzB,eAAe;AACvB,UAAQ,MAAM,yBAAyB,cAAc;EAErD,IAAI,UAAU;EACd,IAAI,YAAY;AAEhB,MAAI,yBAAyB,YAAY;AACxC,eAAY,cAAc;AAG1B,WAAQ,cAAc,MAAtB;IACC,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eACC;AACD;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD;AACC,eAAU;AACV;;;AAKH,SAAO,SACN,8BAA8B,UAAU,WAAW,mBAAmB,QAAQ,GAC9E"}

package/dist/astro/routes/api/auth/oauth/_provider_.mjs

@@ -1,5 +1,5 @@
-import { r as getPublicOrigin } from "../../../../../public-url-CIRe-2T6.mjs";
-import { t as createOAuthStateStore } from "../../../../../oauth-state-store-y8mEYVq9.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
+import { t as createOAuthStateStore } from "../../../../../oauth-state-store-CM5ZEYQS.mjs";
 import { createAuthorizationUrl } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/auth/oauth/[provider].ts

package/dist/astro/routes/api/auth/passkey/_id_.mjs

@@ -1,19 +1,20 @@
 import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-aOOxRSx6.mjs";
-import "../../../../../errors-Bt3goF8I.mjs";
-import "../../../../../settings-DSfE7wOa.mjs";
-import "../../../../../site-settings-NGzdrt7O.mjs";
-import "../../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BfsNNrIE.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CORGGhHf.mjs";
-import "../../../../../redirects-BjTwDTsV.mjs";
-import "../../../../../entry-lock-BaRBHCsH.mjs";
-import "../../../../../media-OEIQ3bVc.mjs";
-import "../../../../../comments-M4EDYAHw.mjs";
-import { D as passkeyRenameBody } from "../../../../../byline-fields-B8HH-35f.mjs";
-import "../../../../../menus-p_M1V7J_.mjs";
-import "../../../../../status-lzyj4Uu7.mjs";
+import "../../../../../url-Dn3IStq8.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import "../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../media-D1z_jisb.mjs";
+import "../../../../../comments-BRtp992B.mjs";
+import { A as passkeyRenameBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../status-D39Fpy8R.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/passkey/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/[id].ts"],"sourcesContent":["/**\n * PATCH/DELETE /_emdash/api/auth/passkey/[id]\n *\n * Rename or delete a passkey\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { passkeyRenameBody } from \"#api/schemas.js\";\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\n/**\n * PATCH - Rename a passkey\n */\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRenameBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Update the name\n\t\tconst trimmedName = body.name.trim() || null;\n\t\tawait adapter.updateCredentialName(id, trimmedName);\n\n\t\t// Return updated passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: trimmedName,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to rename passkey\", \"PASSKEY_RENAME_ERROR\");\n\t}\n};\n\n/**\n * DELETE - Remove a passkey\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Check that this isn't the last passkey\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\n\t\tif (count <= 1) {\n\t\t\treturn apiError(\"LAST_PASSKEY\", \"Cannot remove your last passkey\", 400);\n\t\t}\n\n\t\t// Delete the passkey\n\t\tawait adapter.deleteCredential(id);\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete passkey\", \"PASSKEY_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;;;;AAoBzB,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;EAIvD,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,cAAc,KAAK,KAAK,MAAM,IAAI;AACxC,QAAM,QAAQ,qBAAqB,IAAI,YAAY;AAYnD,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM;GACN,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;;;;AAO/E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;AAMvD,MAFc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAEhD,EACZ,QAAO,SAAS,gBAAgB,mCAAmC,IAAI;AAIxE,QAAM,QAAQ,iBAAiB,GAAG;AAElC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/[id].ts"],"sourcesContent":["/**\n * PATCH/DELETE /_emdash/api/auth/passkey/[id]\n *\n * Rename or delete a passkey\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { passkeyRenameBody } from \"#api/schemas.js\";\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\n/**\n * PATCH - Rename a passkey\n */\nexport const PATCH: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRenameBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Update the name\n\t\tconst trimmedName = body.name.trim() || null;\n\t\tawait adapter.updateCredentialName(id, trimmedName);\n\n\t\t// Return updated passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: trimmedName,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to rename passkey\", \"PASSKEY_RENAME_ERROR\");\n\t}\n};\n\n/**\n * DELETE - Remove a passkey\n */\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { id } = params;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"Passkey ID is required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Get the credential and verify ownership\n\t\tconst credential = await adapter.getCredentialById(id);\n\n\t\tif (!credential || credential.userId !== user.id) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Passkey not found\", 404);\n\t\t}\n\n\t\t// Check that this isn't the last passkey\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\n\t\tif (count <= 1) {\n\t\t\treturn apiError(\"LAST_PASSKEY\", \"Cannot remove your last passkey\", 400);\n\t\t}\n\n\t\t// Delete the passkey\n\t\tawait adapter.deleteCredential(id);\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to delete passkey\", \"PASSKEY_DELETE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;;;;AAoBzB,MAAa,QAAkB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACrE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;EAIvD,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,cAAc,KAAK,KAAK,MAAM,IAAI;AACxC,QAAM,QAAQ,qBAAqB,IAAI,YAAY;AAYnD,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM;GACN,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;;;;AAO/E,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,0BAA0B,IAAI;AAGhE,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,kBAAkB,GAAG;AAEtD,MAAI,CAAC,cAAc,WAAW,WAAW,KAAK,GAC7C,QAAO,SAAS,aAAa,qBAAqB,IAAI;AAMvD,MAFc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAEhD,EACZ,QAAO,SAAS,gBAAgB,mCAAmC,IAAI;AAIxE,QAAM,QAAQ,iBAAiB,GAAG;AAElC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}

package/dist/astro/routes/api/auth/passkey/index.mjs

@@ -1,8 +1,8 @@
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-aOOxRSx6.mjs";
-import "../../../../../errors-Bt3goF8I.mjs";
-import "../../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BfsNNrIE.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/passkey/index.ts

package/dist/astro/routes/api/auth/passkey/options.mjs

@@ -1,26 +1,27 @@
 import "../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-aOOxRSx6.mjs";
-import "../../../../../errors-Bt3goF8I.mjs";
-import "../../../../../settings-DSfE7wOa.mjs";
-import "../../../../../site-settings-NGzdrt7O.mjs";
-import "../../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BfsNNrIE.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-CORGGhHf.mjs";
-import "../../../../../redirects-BjTwDTsV.mjs";
-import "../../../../../entry-lock-BaRBHCsH.mjs";
-import "../../../../../media-OEIQ3bVc.mjs";
-import "../../../../../comments-M4EDYAHw.mjs";
-import { w as passkeyOptionsBody } from "../../../../../byline-fields-B8HH-35f.mjs";
-import "../../../../../menus-p_M1V7J_.mjs";
-import "../../../../../status-lzyj4Uu7.mjs";
+import "../../../../../url-Dn3IStq8.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import "../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../media-D1z_jisb.mjs";
+import "../../../../../comments-BRtp992B.mjs";
+import { D as passkeyOptionsBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../status-D39Fpy8R.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-B6ECOZJc.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-CIRe-2T6.mjs";
-import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-CvBl81AQ.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-Csp60Vik.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-Dih5YeIS.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-BqfQFs6a.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
+import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-CxZxPqaw.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-BXx3Ecp9.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-CkQsrcU-.mjs";
 import { generateAuthenticationOptions } from "@emdash-cms/auth/passkey";
 
 //#region src/astro/routes/api/auth/passkey/options.ts

package/dist/astro/routes/api/auth/passkey/options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/options\n *\n * Get authentication options for passkey login.\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateAuthenticationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore, cleanupExpiredChallenges } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fire-and-forget cleanup of expired challenges -- prevents accumulation\n\t\tvoid cleanupExpiredChallenges(emdash.db).catch(() => {});\n\n\t\t// Parse body before rate limiting so malformed requests don't consume slots\n\t\tconst body = await parseOptionalBody(request, passkeyOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"passkey/options\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate authentication options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\t// Never scope to the submitted email: allowCredentials would reveal whether the account exists.\n\t\tconst authOptions = await generateAuthenticationOptions(passkeyConfig, [], challengeStore);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: authOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate passkey options\", \"PASSKEY_OPTIONS_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAczB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,EAAK,yBAAyB,OAAO,GAAG,CAAC,YAAY,GAAG;EAGxD,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,IAAI,GAAG,EACjE,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAWhC,SAAO,WAAW;GACjB,SAAS;GACT,SAJmB,MAAM,8BALJ,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU,EAKS,EAAE,EAFlD,qBAAqB,OAAO,GAAG,CAEoC;GAKzF,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,wBAAwB"}
+{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/options\n *\n * Get authentication options for passkey login.\n *\n * Rate limited: 10 requests per minute per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { generateAuthenticationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore, cleanupExpiredChallenges } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { checkRateLimit, getClientIp, rateLimitResponse } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Fire-and-forget cleanup of expired challenges -- prevents accumulation\n\t\tvoid cleanupExpiredChallenges(emdash.db).catch(() => {});\n\n\t\t// Parse body before rate limiting so malformed requests don't consume slots\n\t\tconst body = await parseOptionalBody(request, passkeyOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 10 requests per 60 seconds per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"passkey/options\", 10, 60);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn rateLimitResponse(60);\n\t\t}\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate authentication options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\t// Never scope to the submitted email: allowCredentials would reveal whether the account exists.\n\t\tconst authOptions = await generateAuthenticationOptions(passkeyConfig, [], challengeStore);\n\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\toptions: authOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate passkey options\", \"PASSKEY_OPTIONS_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAa,YAAY;AAczB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;AAEH,EAAK,yBAAyB,OAAO,GAAG,CAAC,YAAY,GAAG;EAGxD,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,IAAI,GAAG,EACjE,QACd,QAAO,kBAAkB,GAAG;EAI7B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAWhC,SAAO,WAAW;GACjB,SAAS;GACT,SAJmB,MAAM,8BALJ,iBAAiB,KAFrB,MADF,IAAI,kBAAkB,OAAO,GAAG,CAChB,IAAY,oBAAoB,IAAK,QACrD,gBAAgB,KAAK,QAAQ,OAAO,CACU,EAKS,EAAE,EAFlD,qBAAqB,OAAO,GAAG,CAEoC;GAKzF,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,sCAAsC,wBAAwB"}

package/dist/astro/routes/api/auth/passkey/register/options.mjs

@@ -1,24 +1,25 @@
 import "../../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../../types-aOOxRSx6.mjs";
-import "../../../../../../errors-Bt3goF8I.mjs";
-import "../../../../../../settings-DSfE7wOa.mjs";
-import "../../../../../../site-settings-NGzdrt7O.mjs";
-import "../../../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BfsNNrIE.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-CORGGhHf.mjs";
-import "../../../../../../redirects-BjTwDTsV.mjs";
-import "../../../../../../entry-lock-BaRBHCsH.mjs";
-import "../../../../../../media-OEIQ3bVc.mjs";
-import "../../../../../../comments-M4EDYAHw.mjs";
-import { T as passkeyRegisterOptionsBody } from "../../../../../../byline-fields-B8HH-35f.mjs";
-import "../../../../../../menus-p_M1V7J_.mjs";
-import "../../../../../../status-lzyj4Uu7.mjs";
+import "../../../../../../url-Dn3IStq8.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../../media-D1z_jisb.mjs";
+import "../../../../../../comments-BRtp992B.mjs";
+import { O as passkeyRegisterOptionsBody } from "../../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../../status-D39Fpy8R.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-CIRe-2T6.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-CvBl81AQ.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-Dih5YeIS.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-B5a0QAh6.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-CxZxPqaw.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-CkQsrcU-.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/options\n *\n * Get WebAuthn registration options for adding a new passkey (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse optional name from request\n\t\tconst body = await parseOptionalBody(request, passkeyRegisterOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get existing credentials for excludeCredentials\n\t\tconst existingCredentials = await adapter.getCredentialsByUserId(user.id);\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\t{ id: user.id, email: user.email, name: user.name },\n\t\t\texistingCredentials,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Store the passkey name in the challenge metadata if provided\n\t\t// We'll retrieve it during verification\n\t\tif (body.name) {\n\t\t\t// Store name with challenge for later retrieval\n\t\t\t// The challenge store will need this when verifying\n\t\t\tawait optionsRepo.set(`emdash:passkey_pending:${user.id}`, {\n\t\t\t\tname: body.name,\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\toptions: registrationOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to generate registration options\",\n\t\t\t\"PASSKEY_REGISTER_OPTIONS_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAazB,MAAM,eAAe;AAErB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,kBAAkB,SAAS,4BAA4B,EAAE,CAAC;AAC7E,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,sBAAsB,MAAM,QAAQ,uBAAuB,KAAK,GAAG;EAGzE,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EAGpD,MAAM,gBAAgB,iBAAiB,KAFrB,MAAM,YAAY,IAAY,oBAAoB,IAAK,QACzD,gBAAgB,KAAK,QAAQ,OAAO,CACU;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,sBAAsB,MAAM,4BACjC,eACA;GAAE,IAAI,KAAK;GAAI,OAAO,KAAK;GAAO,MAAM,KAAK;GAAM,EACnD,qBACA,eACA;AAID,MAAI,KAAK,KAGR,OAAM,YAAY,IAAI,0BAA0B,KAAK,MAAM,EAC1D,MAAM,KAAK,MACX,CAAC;AAGH,SAAO,WAAW,EACjB,SAAS,qBACT,CAAC;UACM,OAAO;AACf,SAAO,YACN,OACA,2CACA,iCACA"}
+{"version":3,"file":"options.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/options.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/options\n *\n * Get WebAuthn registration options for adding a new passkey (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { generateRegistrationOptions } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterOptionsBody } from \"#api/schemas.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse optional name from request\n\t\tconst body = await parseOptionalBody(request, passkeyRegisterOptionsBody, {});\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get existing credentials for excludeCredentials\n\t\tconst existingCredentials = await adapter.getCredentialsByUserId(user.id);\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);\n\n\t\t// Generate registration options\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst registrationOptions = await generateRegistrationOptions(\n\t\t\tpasskeyConfig,\n\t\t\t{ id: user.id, email: user.email, name: user.name },\n\t\t\texistingCredentials,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Store the passkey name in the challenge metadata if provided\n\t\t// We'll retrieve it during verification\n\t\tif (body.name) {\n\t\t\t// Store name with challenge for later retrieval\n\t\t\t// The challenge store will need this when verifying\n\t\t\tawait optionsRepo.set(`emdash:passkey_pending:${user.id}`, {\n\t\t\t\tname: body.name,\n\t\t\t});\n\t\t}\n\n\t\treturn apiSuccess({\n\t\t\toptions: registrationOptions,\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(\n\t\t\terror,\n\t\t\t\"Failed to generate registration options\",\n\t\t\t\"PASSKEY_REGISTER_OPTIONS_ERROR\",\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAazB,MAAM,eAAe;AAErB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,kBAAkB,SAAS,4BAA4B,EAAE,CAAC;AAC7E,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,sBAAsB,MAAM,QAAQ,uBAAuB,KAAK,GAAG;EAGzE,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EAGpD,MAAM,gBAAgB,iBAAiB,KAFrB,MAAM,YAAY,IAAY,oBAAoB,IAAK,QACzD,gBAAgB,KAAK,QAAQ,OAAO,CACU;EAG9D,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,sBAAsB,MAAM,4BACjC,eACA;GAAE,IAAI,KAAK;GAAI,OAAO,KAAK;GAAO,MAAM,KAAK;GAAM,EACnD,qBACA,eACA;AAID,MAAI,KAAK,KAGR,OAAM,YAAY,IAAI,0BAA0B,KAAK,MAAM,EAC1D,MAAM,KAAK,MACX,CAAC;AAGH,SAAO,WAAW,EACjB,SAAS,qBACT,CAAC;UACM,OAAO;AACf,SAAO,YACN,OACA,2CACA,iCACA"}

package/dist/astro/routes/api/auth/passkey/register/verify.mjs

@@ -1,25 +1,26 @@
 import "../../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../../types-aOOxRSx6.mjs";
-import "../../../../../../errors-Bt3goF8I.mjs";
-import "../../../../../../settings-DSfE7wOa.mjs";
-import "../../../../../../site-settings-NGzdrt7O.mjs";
-import "../../../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../../error-BfsNNrIE.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-CORGGhHf.mjs";
-import "../../../../../../redirects-BjTwDTsV.mjs";
-import "../../../../../../entry-lock-BaRBHCsH.mjs";
-import "../../../../../../media-OEIQ3bVc.mjs";
-import "../../../../../../comments-M4EDYAHw.mjs";
-import { E as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-B8HH-35f.mjs";
-import "../../../../../../menus-p_M1V7J_.mjs";
-import "../../../../../../status-lzyj4Uu7.mjs";
+import "../../../../../../url-Dn3IStq8.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../../media-D1z_jisb.mjs";
+import "../../../../../../comments-BRtp992B.mjs";
+import { k as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../../status-D39Fpy8R.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-CIRe-2T6.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-U1z4TdEZ.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-CvBl81AQ.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-Dih5YeIS.mjs";
+import { r as getPublicOrigin } from "../../../../../../public-url-B5a0QAh6.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-CFtudhyw.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-CxZxPqaw.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-CkQsrcU-.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/verify\n *\n * Verify and store a new passkey credential (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit again (in case of concurrent requests)\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRegisterVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Get passkey name - prefer body.name, then check stored pending name\n\t\tlet passKeyName: string | undefined = body.name ?? undefined;\n\t\tif (!passKeyName) {\n\t\t\tconst pending = await optionsRepo.get<{ name?: string }>(`emdash:passkey_pending:${user.id}`);\n\t\t\tif (pending?.name) {\n\t\t\t\tpassKeyName = pending.name;\n\t\t\t}\n\t\t}\n\n\t\t// Clean up pending state\n\t\tawait optionsRepo.delete(`emdash:passkey_pending:${user.id}`);\n\n\t\t// Register the passkey\n\t\tconst credential = await registerPasskey(adapter, user.id, verified, passKeyName);\n\n\t\t// Return the new passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: credential.name,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\tconsole.error(\"Passkey registration verify error:\", error);\n\n\t\t// Handle specific errors\n\t\tconst message = error instanceof Error ? error.message : \"\";\n\n\t\t// Check for duplicate credential error\n\t\tif (message.includes(\"credential_exists\") || message.includes(\"already\")) {\n\t\t\treturn apiError(\"CREDENTIAL_EXISTS\", \"This passkey is already registered\", 400);\n\t\t}\n\n\t\t// Check for challenge errors\n\t\tif (message.includes(\"challenge\") || message.includes(\"expired\")) {\n\t\t\treturn apiError(\"CHALLENGE_EXPIRED\", \"Registration expired. Please try again.\", 400);\n\t\t}\n\n\t\treturn apiError(\"PASSKEY_REGISTER_ERROR\", \"Registration failed\", 500);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAczB,MAAM,eAAe;AAWrB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,UAAU,SAAS,0BAA0B;AAChE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EACpD,MAAM,WAAY,MAAM,YAAY,IAAY,oBAAoB,IAAK;EACzE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,IAAI,cAAkC,KAAK,QAAQ;AACnD,MAAI,CAAC,aAAa;GACjB,MAAM,UAAU,MAAM,YAAY,IAAuB,0BAA0B,KAAK,KAAK;AAC7F,OAAI,SAAS,KACZ,eAAc,QAAQ;;AAKxB,QAAM,YAAY,OAAO,0BAA0B,KAAK,KAAK;EAG7D,MAAM,aAAa,MAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,YAAY;AAYjF,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM,WAAW;GACjB,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,UAAQ,MAAM,sCAAsC,MAAM;EAG1D,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AAGzD,MAAI,QAAQ,SAAS,oBAAoB,IAAI,QAAQ,SAAS,UAAU,CACvE,QAAO,SAAS,qBAAqB,sCAAsC,IAAI;AAIhF,MAAI,QAAQ,SAAS,YAAY,IAAI,QAAQ,SAAS,UAAU,CAC/D,QAAO,SAAS,qBAAqB,2CAA2C,IAAI;AAGrF,SAAO,SAAS,0BAA0B,uBAAuB,IAAI"}
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/passkey/register/verify.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/passkey/register/verify\n *\n * Verify and store a new passkey credential (authenticated user)\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { verifyRegistrationResponse, registerPasskey } from \"@emdash-cms/auth/passkey\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { passkeyRegisterVerifyBody } from \"#api/schemas.js\";\nimport { getConfiguredAllowedOrigins, validateAllowedOrigins } from \"#auth/allowed-origins.js\";\nimport { createChallengeStore } from \"#auth/challenge-store.js\";\nimport { getPasskeyConfig } from \"#auth/passkey-config.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nconst MAX_PASSKEYS = 10;\n\ninterface PasskeyResponse {\n\tid: string;\n\tname: string | null;\n\tdeviceType: \"singleDevice\" | \"multiDevice\";\n\tbackedUp: boolean;\n\tcreatedAt: string;\n\tlastUsedAt: string;\n}\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Require authentication\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Check passkey limit again (in case of concurrent requests)\n\t\tconst count = await adapter.countCredentialsByUserId(user.id);\n\t\tif (count >= MAX_PASSKEYS) {\n\t\t\treturn apiError(\"PASSKEY_LIMIT\", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);\n\t\t}\n\n\t\t// Parse request body\n\t\tconst body = await parseBody(request, passkeyRegisterVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Get passkey config\n\t\tconst url = new URL(request.url);\n\t\tconst optionsRepo = new OptionsRepository(emdash.db);\n\t\tconst siteName = (await optionsRepo.get<string>(\"emdash:site_title\")) ?? undefined;\n\t\tconst siteUrl = getPublicOrigin(url, emdash?.config);\n\t\tconst allowedOrigins = validateAllowedOrigins(\n\t\t\tsiteUrl,\n\t\t\tgetConfiguredAllowedOrigins(emdash?.config),\n\t\t);\n\t\tconst passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, allowedOrigins);\n\n\t\t// Verify the registration response\n\t\tconst challengeStore = createChallengeStore(emdash.db);\n\t\tconst verified = await verifyRegistrationResponse(\n\t\t\tpasskeyConfig,\n\t\t\tbody.credential,\n\t\t\tchallengeStore,\n\t\t);\n\n\t\t// Get passkey name - prefer body.name, then check stored pending name\n\t\tlet passKeyName: string | undefined = body.name ?? undefined;\n\t\tif (!passKeyName) {\n\t\t\tconst pending = await optionsRepo.get<{ name?: string }>(`emdash:passkey_pending:${user.id}`);\n\t\t\tif (pending?.name) {\n\t\t\t\tpassKeyName = pending.name;\n\t\t\t}\n\t\t}\n\n\t\t// Clean up pending state\n\t\tawait optionsRepo.delete(`emdash:passkey_pending:${user.id}`);\n\n\t\t// Register the passkey\n\t\tconst credential = await registerPasskey(adapter, user.id, verified, passKeyName);\n\n\t\t// Return the new passkey info\n\t\tconst passkey: PasskeyResponse = {\n\t\t\tid: credential.id,\n\t\t\tname: credential.name,\n\t\t\tdeviceType: credential.deviceType,\n\t\t\tbackedUp: credential.backedUp,\n\t\t\tcreatedAt: credential.createdAt.toISOString(),\n\t\t\tlastUsedAt: credential.lastUsedAt.toISOString(),\n\t\t};\n\n\t\treturn apiSuccess({ passkey });\n\t} catch (error) {\n\t\tconsole.error(\"Passkey registration verify error:\", error);\n\n\t\t// Handle specific errors\n\t\tconst message = error instanceof Error ? error.message : \"\";\n\n\t\t// Check for duplicate credential error\n\t\tif (message.includes(\"credential_exists\") || message.includes(\"already\")) {\n\t\t\treturn apiError(\"CREDENTIAL_EXISTS\", \"This passkey is already registered\", 400);\n\t\t}\n\n\t\t// Check for challenge errors\n\t\tif (message.includes(\"challenge\") || message.includes(\"expired\")) {\n\t\t\treturn apiError(\"CHALLENGE_EXPIRED\", \"Registration expired. Please try again.\", 400);\n\t\t}\n\n\t\treturn apiError(\"PASSKEY_REGISTER_ERROR\", \"Registration failed\", 500);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAczB,MAAM,eAAe;AAWrB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAIpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAG/D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;AAI9C,MADc,MAAM,QAAQ,yBAAyB,KAAK,GAAG,IAChD,aACZ,QAAO,SAAS,iBAAiB,cAAc,aAAa,oBAAoB,IAAI;EAIrF,MAAM,OAAO,MAAM,UAAU,SAAS,0BAA0B;AAChE,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,cAAc,IAAI,kBAAkB,OAAO,GAAG;EACpD,MAAM,WAAY,MAAM,YAAY,IAAY,oBAAoB,IAAK;EACzE,MAAM,UAAU,gBAAgB,KAAK,QAAQ,OAAO;EAKpD,MAAM,gBAAgB,iBAAiB,KAAK,UAAU,SAJ/B,uBACtB,SACA,4BAA4B,QAAQ,OAAO,CAC3C,CAC6E;EAG9E,MAAM,iBAAiB,qBAAqB,OAAO,GAAG;EACtD,MAAM,WAAW,MAAM,2BACtB,eACA,KAAK,YACL,eACA;EAGD,IAAI,cAAkC,KAAK,QAAQ;AACnD,MAAI,CAAC,aAAa;GACjB,MAAM,UAAU,MAAM,YAAY,IAAuB,0BAA0B,KAAK,KAAK;AAC7F,OAAI,SAAS,KACZ,eAAc,QAAQ;;AAKxB,QAAM,YAAY,OAAO,0BAA0B,KAAK,KAAK;EAG7D,MAAM,aAAa,MAAM,gBAAgB,SAAS,KAAK,IAAI,UAAU,YAAY;AAYjF,SAAO,WAAW,EAAE,SATa;GAChC,IAAI,WAAW;GACf,MAAM,WAAW;GACjB,YAAY,WAAW;GACvB,UAAU,WAAW;GACrB,WAAW,WAAW,UAAU,aAAa;GAC7C,YAAY,WAAW,WAAW,aAAa;GAC/C,EAE4B,CAAC;UACtB,OAAO;AACf,UAAQ,MAAM,sCAAsC,MAAM;EAG1D,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AAGzD,MAAI,QAAQ,SAAS,oBAAoB,IAAI,QAAQ,SAAS,UAAU,CACvE,QAAO,SAAS,qBAAqB,sCAAsC,IAAI;AAIhF,MAAI,QAAQ,SAAS,YAAY,IAAI,QAAQ,SAAS,UAAU,CAC/D,QAAO,SAAS,qBAAqB,2CAA2C,IAAI;AAGrF,SAAO,SAAS,0BAA0B,uBAAuB,IAAI"}

package/dist/astro/routes/api/auth/passkey/verify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/verify.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAcA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/verify.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAgBA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/passkey/verify.mjs

@@ -1,25 +1,28 @@
 import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-aOOxRSx6.mjs";
-import "../../../../../errors-Bt3goF8I.mjs";
-import "../../../../../settings-DSfE7wOa.mjs";
-import "../../../../../site-settings-NGzdrt7O.mjs";
-import "../../../../../errors-BN1QAnEY.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BfsNNrIE.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CORGGhHf.mjs";
-import "../../../../../redirects-BjTwDTsV.mjs";
-import "../../../../../entry-lock-BaRBHCsH.mjs";
-import "../../../../../media-OEIQ3bVc.mjs";
-import "../../../../../comments-M4EDYAHw.mjs";
-import { O as passkeyVerifyBody } from "../../../../../byline-fields-B8HH-35f.mjs";
-import "../../../../../menus-p_M1V7J_.mjs";
-import "../../../../../status-lzyj4Uu7.mjs";
+import "../../../../../url-Dn3IStq8.mjs";
+import "../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../errors-CNvATh_7.mjs";
+import "../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../media-D1z_jisb.mjs";
+import "../../../../../comments-BRtp992B.mjs";
+import { j as passkeyVerifyBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../status-D39Fpy8R.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-CIRe-2T6.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-U1z4TdEZ.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-CvBl81AQ.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-Dih5YeIS.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CFtudhyw.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-CxZxPqaw.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-DVcHsFD5.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-CkQsrcU-.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { PasskeyAuthenticationError, authenticateWithPasskey } from "@emdash-cms/auth/passkey";
 
@@ -28,6 +31,7 @@ const prerender = false;
 const POST = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!session) return sessionUnavailableError();
 	try {
 		const body = await parseBody(request, passkeyVerifyBody);
 		if (isParseError(body)) return body;
@@ -38,7 +42,7 @@ const POST = async ({ request, locals, session }) => {
 		const adapter = createKyselyAdapter(emdash.db);
 		const challengeStore = createChallengeStore(emdash.db);
 		const user = await authenticateWithPasskey(passkeyConfig, adapter, body.credential, challengeStore);
-		if (session) session.set("user", { id: user.id });
+		session.set("user", { id: user.id });
 		return apiSuccess({
 			success: true,
 			user: {