emdash 0.7.0 → 0.9.0

package/dist/astro/index.mjs

@@ -1,8 +1,8 @@
-import { t as defaultSeed } from "../default-CME5YdZ3.mjs";
-import { n as VERSION, t as COMMIT } from "../version-BnTKdfam.mjs";
+import { t as defaultSeed } from "../default-D8ksjWhO.mjs";
+import { n as VERSION, t as COMMIT } from "../version-DoxrVdYf.mjs";
 import { createRequire } from "node:module";
 import { fontProviders } from "astro/config";
-import { dirname, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { existsSync, readFileSync } from "node:fs";
 
@@ -64,6 +64,84 @@ function local(config) {
 	};
 }
 
+//#endregion
+//#region src/auth/allowed-origins.ts
+/**
+* Validate per-entry shape rules (no `siteUrl` needed):
+*   - parses as `URL`
+*   - protocol is `http:` or `https:`
+*   - hostname has no trailing dot (`example.com.` rejected)
+*   - hostname has no empty labels (`foo..example.com` rejected)
+*
+* Returns the deduplicated, normalized origin form (`URL.origin`) of every
+* input, in input order. Throws on the first violation with a source-tagged
+* error message.
+*/
+function validateOriginShape(tagged) {
+	const normalized = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const { origin, source } of tagged) {
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch (e) {
+			throw configError(source, `invalid URL: "${origin}"`, e);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw configError(source, `origin must be http or https: "${origin}" (got ${parsed.protocol})`);
+		if (parsed.hostname.endsWith(".")) throw configError(source, `hostname has a trailing dot: "${origin}". Remove the trailing dot — assertion origins from the browser do not include it.`);
+		if (parsed.hostname.split(".").includes("")) throw configError(source, `hostname has empty labels: "${origin}"`);
+		if (!seen.has(parsed.origin)) {
+			seen.add(parsed.origin);
+			normalized.push(parsed.origin);
+		}
+	}
+	return normalized;
+}
+/**
+* Validate the effective merged allowedOrigins set against `siteUrl`.
+*
+* Performs `validateOriginShape()` plus the siteUrl-dependent rules:
+*   - Rule A: non-empty origins ⇒ `siteUrl` is set
+*   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)
+*   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)
+*   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain
+*
+* Throws on first violation. Returns the deduplicated normalized origins.
+*
+* Use this at the runtime chokepoint (where config + env are merged into the
+* effective set). At Astro integration init, prefer `validateOriginShape()`
+* for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be
+* supplied at runtime via `EMDASH_SITE_URL`.
+*/
+function validateAllowedOrigins(siteUrl, tagged) {
+	const normalized = validateOriginShape(tagged);
+	if (normalized.length === 0) return normalized;
+	if (!siteUrl) throw new Error(`EmDash config error: allowedOrigins is set (${normalized.length} ${normalized.length === 1 ? "entry" : "entries"}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`);
+	let siteHost;
+	try {
+		siteHost = new URL(siteUrl).hostname;
+	} catch (e) {
+		throw new Error(`EmDash config error: siteUrl is not a valid URL: "${siteUrl}"`, { cause: e });
+	}
+	if (siteHost.endsWith(".")) throw new Error(`EmDash config error: siteUrl "${siteUrl}" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`);
+	if (isIPLiteralHostname(siteHost)) throw new Error(`EmDash config error: siteUrl "${siteUrl}" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`);
+	for (const { origin, source } of tagged) {
+		const h = new URL(origin).hostname;
+		if (h !== siteHost && !h.endsWith("." + siteHost)) throw configError(source, `"${origin}" is not a subdomain of siteUrl "${siteUrl}". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`);
+	}
+	return normalized;
+}
+function configError(source, detail, cause) {
+	const err = /* @__PURE__ */ new Error(`EmDash config error in ${source}: ${detail}`);
+	if (cause !== void 0) err.cause = cause;
+	return err;
+}
+const IPV4_DOTTED_DECIMAL_RE = /^\d+(\.\d+){3}$/;
+function isIPLiteralHostname(h) {
+	if (h.startsWith("[")) return true;
+	return IPV4_DOTTED_DECIMAL_RE.test(h);
+}
+
 //#endregion
 //#region src/astro/integration/font-provider.ts
 /**
@@ -220,6 +298,10 @@ function injectCoreRoutes(injectRoute) {
 		pattern: "/_emdash/api/manifest",
 		entrypoint: resolveRoute("api/manifest.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/auth/mode",
+		entrypoint: resolveRoute("api/auth/mode.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/dashboard",
 		entrypoint: resolveRoute("api/dashboard.ts")
@@ -748,6 +830,18 @@ function injectMcpRoute(injectRoute) {
 	});
 }
 /**
+* Injects routes from pluggable auth providers.
+*
+* Each provider declares the routes it needs in its `AuthProviderDescriptor.routes` array.
+* Routes are injected at build time so Vite can bundle them.
+*/
+function injectAuthProviderRoutes(injectRoute, providers) {
+	for (const provider of providers) if (provider.routes) for (const route of provider.routes) injectRoute({
+		pattern: route.pattern,
+		entrypoint: route.entrypoint
+	});
+}
+/**
 * Injects passkey/oauth/magic-link auth routes.
 * Only used when NOT using external auth.
 */
@@ -864,6 +958,8 @@ const VIRTUAL_SANDBOXED_PLUGINS_ID = "virtual:emdash/sandboxed-plugins";
 const RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID = "\0" + VIRTUAL_SANDBOXED_PLUGINS_ID;
 const VIRTUAL_AUTH_ID = "virtual:emdash/auth";
 const RESOLVED_VIRTUAL_AUTH_ID = "\0" + VIRTUAL_AUTH_ID;
+const VIRTUAL_AUTH_PROVIDERS_ID = "virtual:emdash/auth-providers";
+const RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID = "\0" + VIRTUAL_AUTH_PROVIDERS_ID;
 const VIRTUAL_MEDIA_PROVIDERS_ID = "virtual:emdash/media-providers";
 const RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID = "\0" + VIRTUAL_MEDIA_PROVIDERS_ID;
 const VIRTUAL_BLOCK_COMPONENTS_ID = "virtual:emdash/block-components";
@@ -931,6 +1027,34 @@ export const authenticate = _authenticate;
 `;
 }
 /**
+* Generates the auth providers module.
+*
+* Statically imports each auth provider's `adminEntry` module and exports
+* a registry keyed by provider ID. The admin UI uses this to render
+* provider-specific login buttons/forms and setup steps.
+*
+* Follows the same pattern as `generateAdminRegistryModule()` for plugins.
+*/
+function generateAuthProvidersModule(descriptors) {
+	const withAdmin = descriptors.filter((d) => d.adminEntry);
+	if (withAdmin.length === 0) return `export const authProviders = {};`;
+	const imports = [];
+	const entries = [];
+	withAdmin.forEach((descriptor, index) => {
+		const varName = `authProvider${index}`;
+		imports.push(`import * as ${varName} from ${JSON.stringify(descriptor.adminEntry)};`);
+		entries.push(`  ${JSON.stringify(descriptor.id)}: { ...${varName}, id: ${JSON.stringify(descriptor.id)}, label: ${JSON.stringify(descriptor.label)} },`);
+	});
+	return `
+// Auto-generated auth provider registry
+${imports.join("\n")}
+
+export const authProviders = {
+${entries.join("\n")}
+};
+`;
+}
+/**
 * Generates the plugins module.
 * Imports and instantiates all plugins at runtime.
 *
@@ -1101,9 +1225,20 @@ function generateWaitUntilModule(adapterName) {
 * Reads the user's seed file at build time (in Node context) and embeds it,
 * so the runtime doesn't need filesystem access (required for workerd).
 *
+* Search order:
+*   1. `.emdash/seed.json`
+*   2. `package.json` → `emdash.seed` reference
+*   3. `seed/seed.json` (conventional template path)
+*
 * Exports `userSeed` (user's seed or null) and `seed` (user's seed or default).
+*
+* When no user seed is found, falls back to the built-in default seed and
+* (if `warnOnFallback` is true) logs a warning so misconfiguration is visible
+* during `astro dev`. Build/preview/sync stay silent so sites that
+* intentionally use the default seed (e.g. the blank template) don't
+* generate noisy logs.
 */
-function generateSeedModule(projectRoot) {
+function generateSeedModule(projectRoot, warnOnFallback = false) {
 	let userSeedJson = null;
 	try {
 		const content = readFileSync(resolve(projectRoot, ".emdash", "seed.json"), "utf-8");
@@ -1119,7 +1254,13 @@ function generateSeedModule(projectRoot) {
 			userSeedJson = content;
 		}
 	} catch {}
+	if (!userSeedJson) try {
+		const content = readFileSync(resolve(projectRoot, "seed", "seed.json"), "utf-8");
+		JSON.parse(content);
+		userSeedJson = content;
+	} catch {}
 	if (userSeedJson) return [`export const userSeed = ${userSeedJson};`, `export const seed = userSeed;`].join("\n");
+	if (warnOnFallback) console.warn("[emdash] No user seed found at .emdash/seed.json, package.json#emdash.seed, or seed/seed.json. Falling back to the built-in default seed; the setup wizard will not offer demo content for this site.");
 	return [`export const userSeed = null;`, `export const seed = ${JSON.stringify(defaultSeed)};`].join("\n");
 }
 /**
@@ -1224,15 +1365,24 @@ function resolveAdminDist() {
 	return dirname(createRequire(import.meta.url).resolve("@emdash-cms/admin"));
 }
 /**
+* Check whether child is inside parent without relying on simple prefix checks.
+*/
+function isInside(parent, child) {
+	const relativePath = relative(parent, child);
+	return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute(relativePath);
+}
+/**
 * Resolve path to the admin package source directory.
-* In dev mode, we alias @emdash-cms/admin to the source so Vite processes it
-* directly — giving instant HMR instead of requiring a rebuild + restart.
+* In dev mode inside this repo, we alias @emdash-cms/admin to the source so
+* Vite processes it directly — giving instant HMR instead of requiring a
+* rebuild + restart. External apps should use the built package surface.
 */
-function resolveAdminSource() {
+function resolveAdminSource(projectRoot) {
 	const packageRoot = resolve(dirname(createRequire(import.meta.url).resolve("@emdash-cms/admin")), "..");
+	const repoRoot = resolve(packageRoot, "..", "..");
 	const srcEntry = resolve(packageRoot, "src", "index.ts");
 	try {
-		if (existsSync(srcEntry)) return resolve(packageRoot, "src");
+		if (existsSync(srcEntry) && isInside(repoRoot, projectRoot)) return resolve(packageRoot, "src");
 	} catch {}
 }
 /**
@@ -1240,8 +1390,12 @@ function resolveAdminSource() {
 */
 function createVirtualModulesPlugin(options) {
 	const { serializableConfig, resolvedConfig, pluginDescriptors, astroConfig } = options;
+	let viteCommand;
 	return {
 		name: "emdash-virtual-modules",
+		configResolved(config) {
+			viteCommand = config.command;
+		},
 		resolveId(id) {
 			if (id === VIRTUAL_CONFIG_ID) return RESOLVED_VIRTUAL_CONFIG_ID;
 			if (id === VIRTUAL_DIALECT_ID) return RESOLVED_VIRTUAL_DIALECT_ID;
@@ -1251,6 +1405,7 @@ function createVirtualModulesPlugin(options) {
 			if (id === VIRTUAL_SANDBOX_RUNNER_ID) return RESOLVED_VIRTUAL_SANDBOX_RUNNER_ID;
 			if (id === VIRTUAL_SANDBOXED_PLUGINS_ID) return RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID;
 			if (id === VIRTUAL_AUTH_ID) return RESOLVED_VIRTUAL_AUTH_ID;
+			if (id === VIRTUAL_AUTH_PROVIDERS_ID) return RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID;
 			if (id === VIRTUAL_MEDIA_PROVIDERS_ID) return RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID;
 			if (id === VIRTUAL_BLOCK_COMPONENTS_ID) return RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID;
 			if (id === VIRTUAL_SEED_ID) return RESOLVED_VIRTUAL_SEED_ID;
@@ -1276,9 +1431,10 @@ function createVirtualModulesPlugin(options) {
 				if (!authDescriptor || !("entrypoint" in authDescriptor)) return generateAuthModule(void 0);
 				return generateAuthModule(authDescriptor.entrypoint);
 			}
+			if (id === RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID) return generateAuthProvidersModule(resolvedConfig.authProviders ?? []);
 			if (id === RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID) return generateMediaProvidersModule(resolvedConfig.mediaProviders ?? []);
 			if (id === RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID) return generateBlockComponentsModule(pluginDescriptors);
-			if (id === RESOLVED_VIRTUAL_SEED_ID) return generateSeedModule(fileURLToPath(astroConfig.root));
+			if (id === RESOLVED_VIRTUAL_SEED_ID) return generateSeedModule(fileURLToPath(astroConfig.root), viteCommand === "serve");
 			if (id === RESOLVED_VIRTUAL_WAIT_UNTIL_ID) return generateWaitUntilModule(astroConfig.adapter?.name);
 		}
 	};
@@ -1309,7 +1465,8 @@ function createViteConfig(options, command) {
 	const adminDistPath = resolveAdminDist();
 	const cloudflare = isCloudflareAdapter(options.astroConfig);
 	const isDev = command === "dev";
-	const adminSourcePath = isDev ? resolveAdminSource() : void 0;
+	const projectRoot = fileURLToPath(options.astroConfig.root);
+	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : void 0;
 	const useSource = adminSourcePath !== void 0;
 	return {
 		define: {
@@ -1323,13 +1480,24 @@ function createViteConfig(options, command) {
 				"react",
 				"react-dom"
 			],
-			alias: [{
-				find: "@emdash-cms/admin/styles.css",
-				replacement: resolve(adminDistPath, "styles.css")
-			}, {
-				find: "@emdash-cms/admin",
-				replacement: useSource ? adminSourcePath : adminDistPath
-			}]
+			alias: [
+				{
+					find: "@emdash-cms/admin/styles.css",
+					replacement: resolve(adminDistPath, "styles.css")
+				},
+				{
+					find: "@emdash-cms/admin",
+					replacement: useSource ? adminSourcePath : adminDistPath
+				},
+				{
+					find: "use-sync-external-store/shim/index.js",
+					replacement: "use-sync-external-store"
+				},
+				{
+					find: "use-sync-external-store/shim",
+					replacement: "use-sync-external-store"
+				}
+			]
 		},
 		plugins: [createVirtualModulesPlugin(options), ...useSource ? [linguiMacroPlugin(adminSourcePath, adminDistPath)] : []],
 		ssr: cloudflare ? {
@@ -1451,6 +1619,13 @@ function emdash(config = {}) {
 			throw e;
 		}
 	}
+	if (resolvedConfig.allowedOrigins?.length) {
+		const tagged = resolvedConfig.allowedOrigins.map((origin) => ({
+			origin,
+			source: "config.allowedOrigins"
+		}));
+		resolvedConfig.allowedOrigins = resolvedConfig.siteUrl ? validateAllowedOrigins(resolvedConfig.siteUrl, tagged) : validateOriginShape(tagged);
+	}
 	const pluginDescriptors = resolvedConfig.plugins ?? [];
 	const sandboxedDescriptors = resolvedConfig.sandboxed ?? [];
 	for (const descriptor of [...pluginDescriptors, ...sandboxedDescriptors]) if (descriptor.format === "standard") {
@@ -1462,6 +1637,7 @@ function emdash(config = {}) {
 		database: resolvedConfig.database,
 		storage: resolvedConfig.storage,
 		auth: resolvedConfig.auth,
+		authProviders: resolvedConfig.authProviders,
 		marketplace: resolvedConfig.marketplace,
 		siteUrl: resolvedConfig.siteUrl,
 		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders,
@@ -1520,6 +1696,7 @@ function emdash(config = {}) {
 					}, command)
 				});
 				injectCoreRoutes(injectRoute);
+				if (resolvedConfig.authProviders?.length) injectAuthProviderRoutes(injectRoute, resolvedConfig.authProviders);
 				if (!useExternalAuth) injectBuiltinAuthRoutes(injectRoute);
 				if (resolvedConfig.mcp !== false) injectMcpRoute(injectRoute);
 				if (resolvedConfig.playground) addMiddleware({