emdash 0.8.0 → 0.9.0

package/dist/astro/index.mjs

@@ -1,5 +1,5 @@
-import { t as defaultSeed } from "../default-DCVqE5ib.mjs";
-import { n as VERSION, t as COMMIT } from "../version-Bbq8TCrz.mjs";
+import { t as defaultSeed } from "../default-D8ksjWhO.mjs";
+import { n as VERSION, t as COMMIT } from "../version-DoxrVdYf.mjs";
 import { createRequire } from "node:module";
 import { fontProviders } from "astro/config";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
@@ -64,6 +64,84 @@ function local(config) {
 	};
 }
 
+//#endregion
+//#region src/auth/allowed-origins.ts
+/**
+* Validate per-entry shape rules (no `siteUrl` needed):
+*   - parses as `URL`
+*   - protocol is `http:` or `https:`
+*   - hostname has no trailing dot (`example.com.` rejected)
+*   - hostname has no empty labels (`foo..example.com` rejected)
+*
+* Returns the deduplicated, normalized origin form (`URL.origin`) of every
+* input, in input order. Throws on the first violation with a source-tagged
+* error message.
+*/
+function validateOriginShape(tagged) {
+	const normalized = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const { origin, source } of tagged) {
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch (e) {
+			throw configError(source, `invalid URL: "${origin}"`, e);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw configError(source, `origin must be http or https: "${origin}" (got ${parsed.protocol})`);
+		if (parsed.hostname.endsWith(".")) throw configError(source, `hostname has a trailing dot: "${origin}". Remove the trailing dot — assertion origins from the browser do not include it.`);
+		if (parsed.hostname.split(".").includes("")) throw configError(source, `hostname has empty labels: "${origin}"`);
+		if (!seen.has(parsed.origin)) {
+			seen.add(parsed.origin);
+			normalized.push(parsed.origin);
+		}
+	}
+	return normalized;
+}
+/**
+* Validate the effective merged allowedOrigins set against `siteUrl`.
+*
+* Performs `validateOriginShape()` plus the siteUrl-dependent rules:
+*   - Rule A: non-empty origins ⇒ `siteUrl` is set
+*   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)
+*   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)
+*   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain
+*
+* Throws on first violation. Returns the deduplicated normalized origins.
+*
+* Use this at the runtime chokepoint (where config + env are merged into the
+* effective set). At Astro integration init, prefer `validateOriginShape()`
+* for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be
+* supplied at runtime via `EMDASH_SITE_URL`.
+*/
+function validateAllowedOrigins(siteUrl, tagged) {
+	const normalized = validateOriginShape(tagged);
+	if (normalized.length === 0) return normalized;
+	if (!siteUrl) throw new Error(`EmDash config error: allowedOrigins is set (${normalized.length} ${normalized.length === 1 ? "entry" : "entries"}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`);
+	let siteHost;
+	try {
+		siteHost = new URL(siteUrl).hostname;
+	} catch (e) {
+		throw new Error(`EmDash config error: siteUrl is not a valid URL: "${siteUrl}"`, { cause: e });
+	}
+	if (siteHost.endsWith(".")) throw new Error(`EmDash config error: siteUrl "${siteUrl}" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`);
+	if (isIPLiteralHostname(siteHost)) throw new Error(`EmDash config error: siteUrl "${siteUrl}" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`);
+	for (const { origin, source } of tagged) {
+		const h = new URL(origin).hostname;
+		if (h !== siteHost && !h.endsWith("." + siteHost)) throw configError(source, `"${origin}" is not a subdomain of siteUrl "${siteUrl}". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`);
+	}
+	return normalized;
+}
+function configError(source, detail, cause) {
+	const err = /* @__PURE__ */ new Error(`EmDash config error in ${source}: ${detail}`);
+	if (cause !== void 0) err.cause = cause;
+	return err;
+}
+const IPV4_DOTTED_DECIMAL_RE = /^\d+(\.\d+){3}$/;
+function isIPLiteralHostname(h) {
+	if (h.startsWith("[")) return true;
+	return IPV4_DOTTED_DECIMAL_RE.test(h);
+}
+
 //#endregion
 //#region src/astro/integration/font-provider.ts
 /**
@@ -1147,9 +1225,20 @@ function generateWaitUntilModule(adapterName) {
 * Reads the user's seed file at build time (in Node context) and embeds it,
 * so the runtime doesn't need filesystem access (required for workerd).
 *
+* Search order:
+*   1. `.emdash/seed.json`
+*   2. `package.json` → `emdash.seed` reference
+*   3. `seed/seed.json` (conventional template path)
+*
 * Exports `userSeed` (user's seed or null) and `seed` (user's seed or default).
+*
+* When no user seed is found, falls back to the built-in default seed and
+* (if `warnOnFallback` is true) logs a warning so misconfiguration is visible
+* during `astro dev`. Build/preview/sync stay silent so sites that
+* intentionally use the default seed (e.g. the blank template) don't
+* generate noisy logs.
 */
-function generateSeedModule(projectRoot) {
+function generateSeedModule(projectRoot, warnOnFallback = false) {
 	let userSeedJson = null;
 	try {
 		const content = readFileSync(resolve(projectRoot, ".emdash", "seed.json"), "utf-8");
@@ -1165,7 +1254,13 @@ function generateSeedModule(projectRoot) {
 			userSeedJson = content;
 		}
 	} catch {}
+	if (!userSeedJson) try {
+		const content = readFileSync(resolve(projectRoot, "seed", "seed.json"), "utf-8");
+		JSON.parse(content);
+		userSeedJson = content;
+	} catch {}
 	if (userSeedJson) return [`export const userSeed = ${userSeedJson};`, `export const seed = userSeed;`].join("\n");
+	if (warnOnFallback) console.warn("[emdash] No user seed found at .emdash/seed.json, package.json#emdash.seed, or seed/seed.json. Falling back to the built-in default seed; the setup wizard will not offer demo content for this site.");
 	return [`export const userSeed = null;`, `export const seed = ${JSON.stringify(defaultSeed)};`].join("\n");
 }
 /**
@@ -1295,8 +1390,12 @@ function resolveAdminSource(projectRoot) {
 */
 function createVirtualModulesPlugin(options) {
 	const { serializableConfig, resolvedConfig, pluginDescriptors, astroConfig } = options;
+	let viteCommand;
 	return {
 		name: "emdash-virtual-modules",
+		configResolved(config) {
+			viteCommand = config.command;
+		},
 		resolveId(id) {
 			if (id === VIRTUAL_CONFIG_ID) return RESOLVED_VIRTUAL_CONFIG_ID;
 			if (id === VIRTUAL_DIALECT_ID) return RESOLVED_VIRTUAL_DIALECT_ID;
@@ -1335,7 +1434,7 @@ function createVirtualModulesPlugin(options) {
 			if (id === RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID) return generateAuthProvidersModule(resolvedConfig.authProviders ?? []);
 			if (id === RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID) return generateMediaProvidersModule(resolvedConfig.mediaProviders ?? []);
 			if (id === RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID) return generateBlockComponentsModule(pluginDescriptors);
-			if (id === RESOLVED_VIRTUAL_SEED_ID) return generateSeedModule(fileURLToPath(astroConfig.root));
+			if (id === RESOLVED_VIRTUAL_SEED_ID) return generateSeedModule(fileURLToPath(astroConfig.root), viteCommand === "serve");
 			if (id === RESOLVED_VIRTUAL_WAIT_UNTIL_ID) return generateWaitUntilModule(astroConfig.adapter?.name);
 		}
 	};
@@ -1520,6 +1619,13 @@ function emdash(config = {}) {
 			throw e;
 		}
 	}
+	if (resolvedConfig.allowedOrigins?.length) {
+		const tagged = resolvedConfig.allowedOrigins.map((origin) => ({
+			origin,
+			source: "config.allowedOrigins"
+		}));
+		resolvedConfig.allowedOrigins = resolvedConfig.siteUrl ? validateAllowedOrigins(resolvedConfig.siteUrl, tagged) : validateOriginShape(tagged);
+	}
 	const pluginDescriptors = resolvedConfig.plugins ?? [];
 	const sandboxedDescriptors = resolvedConfig.sandboxed ?? [];
 	for (const descriptor of [...pluginDescriptors, ...sandboxedDescriptors]) if (descriptor.format === "standard") {