emdash 1.0.0 → 1.0.1-rc.0

package/dist/astro/routes/api/admin/transfer/imports/_id_/receipt.mjs

@@ -0,0 +1,67 @@
+import "../../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../../../../config-CvmjJcVw.mjs";
+import "../../../../../../../after-PcEvMY_6.mjs";
+import "../../../../../../../options-DhrI7eMv.mjs";
+import "../../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../../secrets-CIi0nFiR.mjs";
+import "../../../../../../../object-cache-Bo6DGaC9.mjs";
+import "../../../../../../../request-cache-C4CIo5ad.mjs";
+import "../../../../../../../url-Dn3IStq8.mjs";
+import "../../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../../media-CputjGE1.mjs";
+import "../../../../../../../audit-BszbE_BP.mjs";
+import "../../../../../../../byline-registry-dvt4N3xV.mjs";
+import "../../../../../../../field-defs-cache-DEkFYCDE.mjs";
+import "../../../../../../../byline-02tu_Uc-.mjs";
+import "../../../../../../../fts-manager-DU03MxWu.mjs";
+import "../../../../../../../loader-CWb-ja1p.mjs";
+import "../../../../../../../collection-slugs-cache-BNRAPNiu.mjs";
+import "../../../../../../../capture-triggers-CdZfvHtF.mjs";
+import "../../../../../../../activation-DDuqAat2.mjs";
+import "../../../../../../../collection-deletion-JecE26cS.mjs";
+import "../../../../../../../registry-CtHRqVe-.mjs";
+import "../../../../../../../hash-CY4QdeMJ.mjs";
+import "../../../../../../../zod-generator-DnfG5sGQ.mjs";
+import "../../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../../canonical-CAecl1UQ.mjs";
+import "../../../../../../../digest-DiYAoZpf.mjs";
+import "../../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../../collection-deletion-processor-DgCfF3a1.mjs";
+import "../../../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../../../settings-CnWoEDb0.mjs";
+import { a as unwrapResult, i as requireDb } from "../../../../../../../error-CEdm_AWU.mjs";
+import "../../../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../../../status-D39Fpy8R.mjs";
+import "../../../../../../../fence-BrnQffdY.mjs";
+import "../../../../../../../api-tokens-BLz2MtQs.mjs";
+import "../../../../../../../tar-n2OXqKpZ.mjs";
+import "../../../../../../../kinds-BKu9nb7q.mjs";
+import "../../../../../../../paths-CqFwkjY8.mjs";
+import "../../../../../../../transformations-BLzqMnpY.mjs";
+import "../../../../../../../version-BwEGkqkx.mjs";
+import "../../../../../../../receipt-RG5_pwsj.mjs";
+import { i as requirePerm } from "../../../../../../../authorize-CJtizVbp.mjs";
+import { t as requireAnyScope } from "../../../../../../../scopes-CxvclshI.mjs";
+import "../../../../../../../approvals-quy61IC4.mjs";
+import "../../../../../../../plan-D8s1n84S.mjs";
+import "../../../../../../../stage-BcuakqfP.mjs";
+import { x as handleImportReceipt } from "../../../../../../../transfer-5Ce0QuNS.mjs";
+import "../../../../../../../keys-B8g41vwJ.mjs";
+
+//#region src/astro/routes/api/admin/transfer/imports/[id]/receipt.ts
+const prerender = false;
+const GET = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireAnyScope(locals, ["transfer:analyze", "transfer:execute"]);
+	if (scopeDenied) return scopeDenied;
+	return unwrapResult(await handleImportReceipt(emdash.db, params.id ?? ""));
+};
+
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=receipt.mjs.map

package/dist/astro/routes/api/admin/transfer/imports/_id_/receipt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.mjs","names":[],"sources":["../../../../../../../../src/astro/routes/api/admin/transfer/imports/[id]/receipt.ts"],"sourcesContent":["/**\n * GET /_emdash/api/admin/transfer/imports/:id/receipt — the verified receipt of a complete import.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleImportReceipt } from \"#api/handlers/transfer.js\";\nimport { requireAnyScope } from \"#auth/scopes.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"transfer:import\");\n\tif (denied) return denied;\n\tconst scopeDenied = requireAnyScope(locals, [\"transfer:analyze\", \"transfer:execute\"]);\n\tif (scopeDenied) return scopeDenied;\n\n\treturn unwrapResult(await handleImportReceipt(emdash.db, params.id ?? \"\"));\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;CACnB,MAAM,cAAc,gBAAgB,QAAQ,CAAC,oBAAoB,mBAAmB,CAAC;AACrF,KAAI,YAAa,QAAO;AAExB,QAAO,aAAa,MAAM,oBAAoB,OAAO,IAAI,OAAO,MAAM,GAAG,CAAC"}

package/dist/astro/routes/api/admin/transfer/imports/index.d.mts

@@ -0,0 +1,9 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/transfer/imports/index.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/admin/transfer/imports/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/transfer/imports/index.ts"],"mappings":";;;cAsBa,SAAA;AAAA,cAIA,GAAA,EAAK,QAAA;AAAA,cAgBL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/transfer/imports/index.mjs

@@ -0,0 +1,100 @@
+import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../../../config-CvmjJcVw.mjs";
+import "../../../../../../after-PcEvMY_6.mjs";
+import "../../../../../../options-DhrI7eMv.mjs";
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../secrets-CIi0nFiR.mjs";
+import "../../../../../../object-cache-Bo6DGaC9.mjs";
+import "../../../../../../request-cache-C4CIo5ad.mjs";
+import "../../../../../../url-Dn3IStq8.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../media-CputjGE1.mjs";
+import "../../../../../../audit-BszbE_BP.mjs";
+import "../../../../../../byline-registry-dvt4N3xV.mjs";
+import "../../../../../../field-defs-cache-DEkFYCDE.mjs";
+import "../../../../../../byline-02tu_Uc-.mjs";
+import "../../../../../../fts-manager-DU03MxWu.mjs";
+import "../../../../../../loader-CWb-ja1p.mjs";
+import "../../../../../../collection-slugs-cache-BNRAPNiu.mjs";
+import "../../../../../../capture-triggers-CdZfvHtF.mjs";
+import "../../../../../../activation-DDuqAat2.mjs";
+import "../../../../../../collection-deletion-JecE26cS.mjs";
+import "../../../../../../registry-CtHRqVe-.mjs";
+import "../../../../../../hash-CY4QdeMJ.mjs";
+import "../../../../../../zod-generator-DnfG5sGQ.mjs";
+import { r as isTransferError } from "../../../../../../errors-CjXd1LgH.mjs";
+import { o as TRANSFER_LIMITS } from "../../../../../../canonical-CAecl1UQ.mjs";
+import "../../../../../../digest-DiYAoZpf.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../collection-deletion-processor-DgCfF3a1.mjs";
+import "../../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../../settings-CnWoEDb0.mjs";
+import { a as unwrapResult, i as requireDb, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../../redirects-D4EWeXAo.mjs";
+import "../../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../../status-D39Fpy8R.mjs";
+import "../../../../../../fence-BrnQffdY.mjs";
+import "../../../../../../api-tokens-BLz2MtQs.mjs";
+import "../../../../../../tar-n2OXqKpZ.mjs";
+import "../../../../../../kinds-BKu9nb7q.mjs";
+import "../../../../../../paths-CqFwkjY8.mjs";
+import "../../../../../../transformations-BLzqMnpY.mjs";
+import "../../../../../../version-BwEGkqkx.mjs";
+import "../../../../../../receipt-RG5_pwsj.mjs";
+import { i as requirePerm } from "../../../../../../authorize-CJtizVbp.mjs";
+import { n as requireScope, t as requireAnyScope } from "../../../../../../scopes-CxvclshI.mjs";
+import "../../../../../../approvals-quy61IC4.mjs";
+import "../../../../../../plan-D8s1n84S.mjs";
+import { r as readStreamBytes } from "../../../../../../stage-BcuakqfP.mjs";
+import { m as handleImportCreate, v as handleImportList } from "../../../../../../transfer-5Ce0QuNS.mjs";
+import "../../../../../../keys-B8g41vwJ.mjs";
+import { y as transferPaginationQuery } from "../../../../../../transfer-CzdXsFRx.mjs";
+
+//#region src/astro/routes/api/admin/transfer/imports/index.ts
+const prerender = false;
+const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7e]{1,255}$/;
+const GET = async ({ url, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireAnyScope(locals, ["transfer:analyze", "transfer:execute"]);
+	if (scopeDenied) return scopeDenied;
+	const query = parseQuery(url, transferPaginationQuery);
+	if (isParseError(query)) return query;
+	return unwrapResult(await handleImportList(emdash.db, query));
+};
+const POST = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+	const denied = requirePerm(user, "transfer:import");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "transfer:analyze");
+	if (scopeDenied) return scopeDenied;
+	if (!emdash.storage) return apiError("STORAGE_NOT_CONFIGURED", "No storage backend is configured", 503);
+	const idempotencyKey = request.headers.get("Idempotency-Key") ?? void 0;
+	if (idempotencyKey !== void 0 && !IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) return apiError("VALIDATION_ERROR", "Invalid Idempotency-Key header", 400);
+	if (Number(request.headers.get("Content-Length") ?? "0") > TRANSFER_LIMITS.manifestBytes) return apiError("TRANSFER_LIMIT_EXCEEDED", "Manifest is too large", 413);
+	if (!request.body) return apiError("TRANSFER_MANIFEST_INVALID", "Request body must be the package manifest", 422);
+	let manifest;
+	try {
+		manifest = await readStreamBytes(request.body, TRANSFER_LIMITS.manifestBytes);
+	} catch (error) {
+		if (isTransferError(error)) return apiError(error.code, error.message, error.status);
+		return apiError("TRANSFER_MANIFEST_INVALID", "Failed to read the manifest", 400);
+	}
+	const result = await handleImportCreate(emdash.db, emdash.storage, {
+		userId: user.id,
+		manifest,
+		idempotencyKey
+	});
+	return unwrapResult(result, result.success && result.data.created ? 201 : 200);
+};
+
+//#endregion
+export { GET, POST, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/admin/transfer/imports/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/transfer/imports/index.ts"],"sourcesContent":["/**\n * Site imports\n *\n * GET  /_emdash/api/admin/transfer/imports — list imports, newest first.\n * POST /_emdash/api/admin/transfer/imports — create an import. The body is the\n *      package's `manifest.json` bytes, unchanged. An optional\n *      `Idempotency-Key` header makes retries return the same operation.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleImportCreate, handleImportList } from \"#api/handlers/transfer.js\";\nimport { isParseError, parseQuery } from \"#api/parse.js\";\nimport { transferPaginationQuery } from \"#api/schemas/transfer.js\";\nimport { requireAnyScope, requireScope } from \"#auth/scopes.js\";\n\nimport { isTransferError } from \"../../../../../../transfer/errors.js\";\nimport { TRANSFER_LIMITS } from \"../../../../../../transfer/format/limits.js\";\nimport { readStreamBytes } from \"../../../../../../transfer/staging/stage.js\";\n\nexport const prerender = false;\n\nconst IDEMPOTENCY_KEY_PATTERN = /^[\\x21-\\x7e]{1,255}$/;\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst denied = requirePerm(user, \"transfer:import\");\n\tif (denied) return denied;\n\tconst scopeDenied = requireAnyScope(locals, [\"transfer:analyze\", \"transfer:execute\"]);\n\tif (scopeDenied) return scopeDenied;\n\n\tconst query = parseQuery(url, transferPaginationQuery);\n\tif (isParseError(query)) return query;\n\n\treturn unwrapResult(await handleImportList(emdash.db, query));\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tif (!user) return apiError(\"UNAUTHORIZED\", \"Authentication required\", 401);\n\tconst denied = requirePerm(user, \"transfer:import\");\n\tif (denied) return denied;\n\tconst scopeDenied = requireScope(locals, \"transfer:analyze\");\n\tif (scopeDenied) return scopeDenied;\n\n\tif (!emdash.storage) {\n\t\treturn apiError(\"STORAGE_NOT_CONFIGURED\", \"No storage backend is configured\", 503);\n\t}\n\n\tconst idempotencyKey = request.headers.get(\"Idempotency-Key\") ?? undefined;\n\tif (idempotencyKey !== undefined && !IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Invalid Idempotency-Key header\", 400);\n\t}\n\n\tconst declaredLength = Number(request.headers.get(\"Content-Length\") ?? \"0\");\n\tif (declaredLength > TRANSFER_LIMITS.manifestBytes) {\n\t\treturn apiError(\"TRANSFER_LIMIT_EXCEEDED\", \"Manifest is too large\", 413);\n\t}\n\tif (!request.body) {\n\t\treturn apiError(\"TRANSFER_MANIFEST_INVALID\", \"Request body must be the package manifest\", 422);\n\t}\n\n\tlet manifest: Uint8Array;\n\ttry {\n\t\tmanifest = await readStreamBytes(request.body, TRANSFER_LIMITS.manifestBytes);\n\t} catch (error) {\n\t\tif (isTransferError(error)) return apiError(error.code, error.message, error.status);\n\t\treturn apiError(\"TRANSFER_MANIFEST_INVALID\", \"Failed to read the manifest\", 400);\n\t}\n\n\tconst result = await handleImportCreate(emdash.db, emdash.storage, {\n\t\tuserId: user.id,\n\t\tmanifest,\n\t\tidempotencyKey,\n\t});\n\treturn unwrapResult(result, result.success && result.data.created ? 201 : 200);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,YAAY;AAEzB,MAAM,0BAA0B;AAEhC,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;CACnB,MAAM,cAAc,gBAAgB,QAAQ,CAAC,oBAAoB,mBAAmB,CAAC;AACrF,KAAI,YAAa,QAAO;CAExB,MAAM,QAAQ,WAAW,KAAK,wBAAwB;AACtD,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,QAAO,aAAa,MAAM,iBAAiB,OAAO,IAAI,MAAM,CAAC;;AAG9D,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;AAElB,KAAI,CAAC,KAAM,QAAO,SAAS,gBAAgB,2BAA2B,IAAI;CAC1E,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;CACnB,MAAM,cAAc,aAAa,QAAQ,mBAAmB;AAC5D,KAAI,YAAa,QAAO;AAExB,KAAI,CAAC,OAAO,QACX,QAAO,SAAS,0BAA0B,oCAAoC,IAAI;CAGnF,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,kBAAkB,IAAI;AACjE,KAAI,mBAAmB,UAAa,CAAC,wBAAwB,KAAK,eAAe,CAChF,QAAO,SAAS,oBAAoB,kCAAkC,IAAI;AAI3E,KADuB,OAAO,QAAQ,QAAQ,IAAI,iBAAiB,IAAI,IAAI,GACtD,gBAAgB,cACpC,QAAO,SAAS,2BAA2B,yBAAyB,IAAI;AAEzE,KAAI,CAAC,QAAQ,KACZ,QAAO,SAAS,6BAA6B,6CAA6C,IAAI;CAG/F,IAAI;AACJ,KAAI;AACH,aAAW,MAAM,gBAAgB,QAAQ,MAAM,gBAAgB,cAAc;UACrE,OAAO;AACf,MAAI,gBAAgB,MAAM,CAAE,QAAO,SAAS,MAAM,MAAM,MAAM,SAAS,MAAM,OAAO;AACpF,SAAO,SAAS,6BAA6B,+BAA+B,IAAI;;CAGjF,MAAM,SAAS,MAAM,mBAAmB,OAAO,IAAI,OAAO,SAAS;EAClE,QAAQ,KAAK;EACb;EACA;EACA,CAAC;AACF,QAAO,aAAa,QAAQ,OAAO,WAAW,OAAO,KAAK,UAAU,MAAM,IAAI"}

package/dist/astro/routes/api/admin/users/_id_/disable.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/disable.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=disable.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/disable.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disable.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/disable.ts"],"mappings":";;;cAaa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/disable.mjs

@@ -0,0 +1,45 @@
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import { t as withTransaction } from "../../../../../../transaction-BVYIo_yu.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { Role } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+
+//#region src/astro/routes/api/admin/users/[id]/disable.ts
+/**
+* User disable endpoint
+*
+* POST /_emdash/api/admin/users/:id/disable - Soft-disable a user
+*/
+const prerender = false;
+const POST = async ({ params, locals }) => {
+	const { emdash, user: currentUser } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!currentUser || currentUser.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("VALIDATION_ERROR", "User ID required", 400);
+	if (id === currentUser.id) return apiError("VALIDATION_ERROR", "Cannot disable your own account", 400);
+	try {
+		const targetUser = await adapter.getUserById(id);
+		if (!targetUser) return apiError("NOT_FOUND", "User not found", 404);
+		if (await withTransaction(emdash.db, async (trx) => {
+			const trxAdapter = createKyselyAdapter(trx);
+			if (targetUser.role === Role.ADMIN) {
+				if (await trxAdapter.countAdmins() <= 1) return true;
+			}
+			await trxAdapter.updateUser(id, { disabled: true });
+			return false;
+		})) return apiError("VALIDATION_ERROR", "Cannot disable the last admin. Promote another user first.", 400);
+		await emdash.db.deleteFrom("_emdash_oauth_tokens").where("user_id", "=", id).execute();
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Failed to disable user", "USER_DISABLE_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=disable.mjs.map

package/dist/astro/routes/api/admin/users/_id_/disable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"disable.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/disable.ts"],"sourcesContent":["/**\n * User disable endpoint\n *\n * POST /_emdash/api/admin/users/:id/disable - Soft-disable a user\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { withTransaction } from \"#db/transaction.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!currentUser || currentUser.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"User ID required\", 400);\n\t}\n\n\t// Prevent disabling self\n\tif (id === currentUser.id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Cannot disable your own account\", 400);\n\t}\n\n\ttry {\n\t\t// Get target user\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Wrap admin check + disable in a transaction to prevent two\n\t\t// concurrent requests from both passing the count check.\n\t\tconst lastAdminBlocked = await withTransaction(emdash.db, async (trx) => {\n\t\t\tconst trxAdapter = createKyselyAdapter(trx);\n\t\t\tif (targetUser.role === Role.ADMIN) {\n\t\t\t\tconst adminCount = await trxAdapter.countAdmins();\n\t\t\t\tif (adminCount <= 1) return true;\n\t\t\t}\n\t\t\tawait trxAdapter.updateUser(id, { disabled: true });\n\t\t\treturn false;\n\t\t});\n\n\t\tif (lastAdminBlocked) {\n\t\t\treturn apiError(\n\t\t\t\t\"VALIDATION_ERROR\",\n\t\t\t\t\"Cannot disable the last admin. Promote another user first.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\t// SEC-43: Revoke all OAuth tokens for the disabled user.\n\t\t// Without this, existing refresh tokens remain valid for up to 90 days.\n\t\tawait emdash.db.deleteFrom(\"_emdash_oauth_tokens\").where(\"user_id\", \"=\", id).execute();\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to disable user\", \"USER_DISABLE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAaA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,aAAa;CAC3D,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,eAAe,YAAY,OAAO,KAAK,MAC3C,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAI7D,KAAI,OAAO,YAAY,GACtB,QAAO,SAAS,oBAAoB,mCAAmC,IAAI;AAG5E,KAAI;EAEH,MAAM,aAAa,MAAM,QAAQ,YAAY,GAAG;AAChD,MAAI,CAAC,WACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAepD,MAVyB,MAAM,gBAAgB,OAAO,IAAI,OAAO,QAAQ;GACxE,MAAM,aAAa,oBAAoB,IAAI;AAC3C,OAAI,WAAW,SAAS,KAAK,OAE5B;QADmB,MAAM,WAAW,aAAa,IAC/B,EAAG,QAAO;;AAE7B,SAAM,WAAW,WAAW,IAAI,EAAE,UAAU,MAAM,CAAC;AACnD,UAAO;IACN,CAGD,QAAO,SACN,oBACA,8DACA,IACA;AAKF,QAAM,OAAO,GAAG,WAAW,uBAAuB,CAAC,MAAM,WAAW,KAAK,GAAG,CAAC,SAAS;AAEtF,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,0BAA0B,qBAAqB"}

package/dist/astro/routes/api/admin/users/_id_/enable.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/enable.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=enable.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/enable.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/enable.ts"],"mappings":";;;cAYa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/enable.mjs

@@ -0,0 +1,34 @@
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { Role } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+
+//#region src/astro/routes/api/admin/users/[id]/enable.ts
+/**
+* User enable endpoint
+*
+* POST /_emdash/api/admin/users/:id/enable - Re-enable a disabled user
+*/
+const prerender = false;
+const POST = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("VALIDATION_ERROR", "User ID required", 400);
+	try {
+		if (!await adapter.getUserById(id)) return apiError("NOT_FOUND", "User not found", 404);
+		await adapter.updateUser(id, { disabled: false });
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Failed to enable user", "USER_ENABLE_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=enable.mjs.map

package/dist/astro/routes/api/admin/users/_id_/enable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/enable.ts"],"sourcesContent":["/**\n * User enable endpoint\n *\n * POST /_emdash/api/admin/users/:id/enable - Re-enable a disabled user\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\t// Get target user\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Enable user\n\t\tawait adapter.updateUser(id, { disabled: false });\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to enable user\", \"USER_ENABLE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;AAYA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,aAAa;CAC3D,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;AAGH,MAAI,CADe,MAAM,QAAQ,YAAY,GAAG,CAE/C,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAIpD,QAAM,QAAQ,WAAW,IAAI,EAAE,UAAU,OAAO,CAAC;AAEjD,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/admin/users/_id_/index.d.mts

@@ -0,0 +1,9 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/index.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const PUT: APIRoute;
+//#endregion
+export { GET, PUT, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/index.ts"],"mappings":";;;cAgBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA;AAAA,cAyDL,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/index.mjs

@@ -0,0 +1,117 @@
+import "../../../../../../config-CvmjJcVw.mjs";
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../url-Dn3IStq8.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import { t as withTransaction } from "../../../../../../transaction-BVYIo_yu.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import "../../../../../../settings-B0zQj_Tj.mjs";
+import "../../../../../../site-settings-AYFvhwQn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-Gt2l4Sld.mjs";
+import "../../../../../../redirects-D4EWeXAo.mjs";
+import { b as userUpdateBody } from "../../../../../../entry-lock-PP1JCXBB.mjs";
+import "../../../../../../media-D1z_jisb.mjs";
+import "../../../../../../comments-BRtp992B.mjs";
+import "../../../../../../byline-fields-DHJs0Mja.mjs";
+import "../../../../../../menus-BQKqf0Up.mjs";
+import "../../../../../../status-D39Fpy8R.mjs";
+import "../../../../../../api/schemas/index.mjs";
+import { Role } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+
+//#region src/astro/routes/api/admin/users/[id]/index.ts
+/**
+* User management detail endpoint
+*
+* GET /_emdash/api/admin/users/:id - Get user details
+* PUT /_emdash/api/admin/users/:id - Update user
+*/
+const prerender = false;
+const GET = async ({ params, locals }) => {
+	const { emdash, user: currentUser } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!currentUser || currentUser.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("MISSING_PARAM", "User ID required", 400);
+	try {
+		const result = await adapter.getUserWithDetails(id);
+		if (!result) return apiError("NOT_FOUND", "User not found", 404);
+		return apiSuccess({ item: {
+			id: result.user.id,
+			email: result.user.email,
+			name: result.user.name,
+			avatarUrl: result.user.avatarUrl,
+			role: result.user.role,
+			emailVerified: result.user.emailVerified,
+			disabled: result.user.disabled,
+			createdAt: result.user.createdAt.toISOString(),
+			updatedAt: result.user.updatedAt.toISOString(),
+			lastLogin: result.lastLogin?.toISOString() ?? null,
+			credentials: result.credentials.map((c) => ({
+				id: c.id,
+				name: c.name,
+				deviceType: c.deviceType,
+				createdAt: c.createdAt.toISOString(),
+				lastUsedAt: c.lastUsedAt.toISOString()
+			})),
+			oauthAccounts: result.oauthAccounts.map((a) => ({
+				provider: a.provider,
+				createdAt: a.createdAt.toISOString()
+			}))
+		} });
+	} catch (error) {
+		return handleError(error, "Failed to get user details", "USER_DETAIL_ERROR");
+	}
+};
+const PUT = async ({ params, request, locals }) => {
+	const { emdash, user: currentUser } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!currentUser || currentUser.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(emdash.db);
+	const { id } = params;
+	if (!id) return apiError("MISSING_PARAM", "User ID required", 400);
+	try {
+		const targetUser = await adapter.getUserById(id);
+		if (!targetUser) return apiError("NOT_FOUND", "User not found", 404);
+		const body = await parseBody(request, userUpdateBody);
+		if (isParseError(body)) return body;
+		const role = body.role;
+		if (role !== void 0 && id === currentUser.id) return apiError("SELF_ROLE_CHANGE", "Cannot change your own role", 400);
+		if (body.email && body.email !== targetUser.email) {
+			if (await adapter.getUserByEmail(body.email)) return apiError("EMAIL_IN_USE", "Email already in use", 409);
+		}
+		const isDemotingAdmin = role !== void 0 && role < Role.ADMIN && targetUser.role === Role.ADMIN;
+		if (await withTransaction(emdash.db, async (trx) => {
+			const trxAdapter = createKyselyAdapter(trx);
+			if (isDemotingAdmin) {
+				if (await trxAdapter.countAdmins() <= 1) return true;
+			}
+			await trxAdapter.updateUser(id, {
+				name: body.name,
+				email: body.email,
+				role
+			});
+			return false;
+		})) return apiError("LAST_ADMIN", "Cannot demote the last admin. Promote another user first.", 400);
+		const updated = await adapter.getUserById(id);
+		return apiSuccess({ item: {
+			id: updated.id,
+			email: updated.email,
+			name: updated.name,
+			avatarUrl: updated.avatarUrl,
+			role: updated.role,
+			emailVerified: updated.emailVerified,
+			disabled: updated.disabled,
+			createdAt: updated.createdAt.toISOString(),
+			updatedAt: updated.updatedAt.toISOString()
+		} });
+	} catch (error) {
+		return handleError(error, "Failed to update user", "USER_UPDATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, PUT, prerender };
+//# sourceMappingURL=index.mjs.map

package/dist/astro/routes/api/admin/users/_id_/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/index.ts"],"sourcesContent":["/**\n * User management detail endpoint\n *\n * GET /_emdash/api/admin/users/:id - Get user details\n * PUT /_emdash/api/admin/users/:id - Update user\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { userUpdateBody } from \"#api/schemas.js\";\nimport { withTransaction } from \"#db/transaction.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!currentUser || currentUser.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\tconst result = await adapter.getUserWithDetails(id);\n\n\t\tif (!result) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Transform for JSON serialization\n\t\tconst item = {\n\t\t\tid: result.user.id,\n\t\t\temail: result.user.email,\n\t\t\tname: result.user.name,\n\t\t\tavatarUrl: result.user.avatarUrl,\n\t\t\trole: result.user.role,\n\t\t\temailVerified: result.user.emailVerified,\n\t\t\tdisabled: result.user.disabled,\n\t\t\tcreatedAt: result.user.createdAt.toISOString(),\n\t\t\tupdatedAt: result.user.updatedAt.toISOString(),\n\t\t\tlastLogin: result.lastLogin?.toISOString() ?? null,\n\t\t\tcredentials: result.credentials.map((c) => ({\n\t\t\t\tid: c.id,\n\t\t\t\tname: c.name,\n\t\t\t\tdeviceType: c.deviceType,\n\t\t\t\tcreatedAt: c.createdAt.toISOString(),\n\t\t\t\tlastUsedAt: c.lastUsedAt.toISOString(),\n\t\t\t})),\n\t\t\toauthAccounts: result.oauthAccounts.map((a) => ({\n\t\t\t\tprovider: a.provider,\n\t\t\t\tcreatedAt: a.createdAt.toISOString(),\n\t\t\t})),\n\t\t};\n\n\t\treturn apiSuccess({ item });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get user details\", \"USER_DETAIL_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tif (!currentUser || currentUser.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\t// Get target user\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\tconst body = await parseBody(request, userUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Role is already validated as RoleLevel by Zod schema\n\t\tconst role = body.role;\n\n\t\t// Prevent editing own role (security: prevents self-demotion/lockout)\n\t\tif (role !== undefined && id === currentUser.id) {\n\t\t\treturn apiError(\"SELF_ROLE_CHANGE\", \"Cannot change your own role\", 400);\n\t\t}\n\n\t\t// Check email uniqueness if changing email\n\t\tif (body.email && body.email !== targetUser.email) {\n\t\t\tconst existing = await adapter.getUserByEmail(body.email);\n\t\t\tif (existing) {\n\t\t\t\treturn apiError(\"EMAIL_IN_USE\", \"Email already in use\", 409);\n\t\t\t}\n\t\t}\n\n\t\t// Wrap admin demotion guard + update in a transaction to prevent\n\t\t// two concurrent demotions from both passing the count check.\n\t\tconst isDemotingAdmin =\n\t\t\trole !== undefined && role < Role.ADMIN && targetUser.role === Role.ADMIN;\n\n\t\tconst lastAdminBlocked = await withTransaction(emdash.db, async (trx) => {\n\t\t\tconst trxAdapter = createKyselyAdapter(trx);\n\t\t\tif (isDemotingAdmin) {\n\t\t\t\tconst adminCount = await trxAdapter.countAdmins();\n\t\t\t\tif (adminCount <= 1) return true;\n\t\t\t}\n\t\t\tawait trxAdapter.updateUser(id, {\n\t\t\t\tname: body.name,\n\t\t\t\temail: body.email,\n\t\t\t\trole,\n\t\t\t});\n\t\t\treturn false;\n\t\t});\n\n\t\tif (lastAdminBlocked) {\n\t\t\treturn apiError(\n\t\t\t\t\"LAST_ADMIN\",\n\t\t\t\t\"Cannot demote the last admin. Promote another user first.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\t// Fetch updated user\n\t\tconst updated = await adapter.getUserById(id);\n\n\t\treturn apiSuccess({\n\t\t\titem: {\n\t\t\t\tid: updated!.id,\n\t\t\t\temail: updated!.email,\n\t\t\t\tname: updated!.name,\n\t\t\t\tavatarUrl: updated!.avatarUrl,\n\t\t\t\trole: updated!.role,\n\t\t\t\temailVerified: updated!.emailVerified,\n\t\t\t\tdisabled: updated!.disabled,\n\t\t\t\tcreatedAt: updated!.createdAt.toISOString(),\n\t\t\t\tupdatedAt: updated!.updatedAt.toISOString(),\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update user\", \"USER_UPDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,eAAe,YAAY,OAAO,KAAK,MAC3C,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,oBAAoB,IAAI;AAG1D,KAAI;EACH,MAAM,SAAS,MAAM,QAAQ,mBAAmB,GAAG;AAEnD,MAAI,CAAC,OACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AA4BpD,SAAO,WAAW,EAAE,MAxBP;GACZ,IAAI,OAAO,KAAK;GAChB,OAAO,OAAO,KAAK;GACnB,MAAM,OAAO,KAAK;GAClB,WAAW,OAAO,KAAK;GACvB,MAAM,OAAO,KAAK;GAClB,eAAe,OAAO,KAAK;GAC3B,UAAU,OAAO,KAAK;GACtB,WAAW,OAAO,KAAK,UAAU,aAAa;GAC9C,WAAW,OAAO,KAAK,UAAU,aAAa;GAC9C,WAAW,OAAO,WAAW,aAAa,IAAI;GAC9C,aAAa,OAAO,YAAY,KAAK,OAAO;IAC3C,IAAI,EAAE;IACN,MAAM,EAAE;IACR,YAAY,EAAE;IACd,WAAW,EAAE,UAAU,aAAa;IACpC,YAAY,EAAE,WAAW,aAAa;IACtC,EAAE;GACH,eAAe,OAAO,cAAc,KAAK,OAAO;IAC/C,UAAU,EAAE;IACZ,WAAW,EAAE,UAAU,aAAa;IACpC,EAAE;GACH,EAEyB,CAAC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,oBAAoB;;;AAI9E,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI,CAAC,eAAe,YAAY,OAAO,KAAK,MAC3C,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,oBAAoB,IAAI;AAG1D,KAAI;EAEH,MAAM,aAAa,MAAM,QAAQ,YAAY,GAAG;AAChD,MAAI,CAAC,WACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;EAGpD,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,OAAO,KAAK;AAGlB,MAAI,SAAS,UAAa,OAAO,YAAY,GAC5C,QAAO,SAAS,oBAAoB,+BAA+B,IAAI;AAIxE,MAAI,KAAK,SAAS,KAAK,UAAU,WAAW,OAE3C;OADiB,MAAM,QAAQ,eAAe,KAAK,MAAM,CAExD,QAAO,SAAS,gBAAgB,wBAAwB,IAAI;;EAM9D,MAAM,kBACL,SAAS,UAAa,OAAO,KAAK,SAAS,WAAW,SAAS,KAAK;AAgBrE,MAdyB,MAAM,gBAAgB,OAAO,IAAI,OAAO,QAAQ;GACxE,MAAM,aAAa,oBAAoB,IAAI;AAC3C,OAAI,iBAEH;QADmB,MAAM,WAAW,aAAa,IAC/B,EAAG,QAAO;;AAE7B,SAAM,WAAW,WAAW,IAAI;IAC/B,MAAM,KAAK;IACX,OAAO,KAAK;IACZ;IACA,CAAC;AACF,UAAO;IACN,CAGD,QAAO,SACN,cACA,6DACA,IACA;EAIF,MAAM,UAAU,MAAM,QAAQ,YAAY,GAAG;AAE7C,SAAO,WAAW,EACjB,MAAM;GACL,IAAI,QAAS;GACb,OAAO,QAAS;GAChB,MAAM,QAAS;GACf,WAAW,QAAS;GACpB,MAAM,QAAS;GACf,eAAe,QAAS;GACxB,UAAU,QAAS;GACnB,WAAW,QAAS,UAAU,aAAa;GAC3C,WAAW,QAAS,UAAU,aAAa;GAC3C,EACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}

package/dist/astro/routes/api/admin/users/_id_/send-recovery.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/[id]/send-recovery.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=send-recovery.d.mts.map

package/dist/astro/routes/api/admin/users/_id_/send-recovery.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-recovery.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/send-recovery.ts"],"mappings":";;;cAkBa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/users/_id_/send-recovery.mjs

@@ -0,0 +1,56 @@
+import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../types-j6MBDjlZ.mjs";
+import "../../../../../../errors-CjXd1LgH.mjs";
+import "../../../../../../errors-CNvATh_7.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CEdm_AWU.mjs";
+import { t as getSiteBaseUrl } from "../../../../../../site-url-Ceq_AUK0.mjs";
+import { t as resolveEmailLocale } from "../../../../../../email-locale-Cc5YSXfJ.mjs";
+import { Role, sendMagicLink } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { getMagicLinkEmailStrings } from "@emdash-cms/admin/locales/emails";
+
+//#region src/astro/routes/api/admin/users/[id]/send-recovery.ts
+/**
+* Send recovery link endpoint
+*
+* POST /_emdash/api/admin/users/:id/send-recovery
+*
+* Admin-initiated account recovery — sends a recovery magic link to the user's email.
+*/
+const prerender = false;
+const POST = async ({ request, params, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const { id } = params;
+	if (!id) return apiError("VALIDATION_ERROR", "User ID required", 400);
+	try {
+		const adapter = createKyselyAdapter(emdash.db);
+		const targetUser = await adapter.getUserById(id);
+		if (!targetUser) return apiError("NOT_FOUND", "User not found", 404);
+		if (!emdash.email?.isAvailable()) return apiError("EMAIL_NOT_CONFIGURED", "Email is not configured. Recovery links require an email provider.", 503);
+		const options = new OptionsRepository(emdash.db);
+		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
+		const siteOptions = await options.getMany(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") ?? "EmDash";
+		const emailLocale = resolveEmailLocale(siteOptions.get("emdash:locale"), request);
+		await sendMagicLink({
+			baseUrl,
+			siteName,
+			email: (message) => emdash.email.send(message, "system"),
+			emailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),
+			emailLocale
+		}, adapter, targetUser.email, "recovery");
+		return apiSuccess({
+			success: true,
+			message: "Recovery link sent"
+		});
+	} catch (error) {
+		return handleError(error, "Failed to send recovery link", "RECOVERY_SEND_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=send-recovery.mjs.map

package/dist/astro/routes/api/admin/users/_id_/send-recovery.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-recovery.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/send-recovery.ts"],"sourcesContent":["/**\n * Send recovery link endpoint\n *\n * POST /_emdash/api/admin/users/:id/send-recovery\n *\n * Admin-initiated account recovery — sends a recovery magic link to the user's email.\n */\n\nimport { getMagicLinkEmailStrings } from \"@emdash-cms/admin/locales/emails\";\nimport { Role, sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { resolveEmailLocale } from \"#api/email-locale.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ request, params, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"Database not configured\", 500);\n\t}\n\n\tif (!user || user.role < Role.ADMIN) {\n\t\treturn apiError(\"FORBIDDEN\", \"Admin privileges required\", 403);\n\t}\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\n\t\t// Verify target user exists\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Recovery links require an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteOptions = await options.getMany<string>([\"emdash:site_title\", \"emdash:locale\"]);\n\t\tconst siteName = siteOptions.get(\"emdash:site_title\") ?? \"EmDash\";\n\n\t\t// Localized copy following the site locale; the locale also\n\t\t// drives lang/dir on the email HTML so RTL copy renders correctly.\n\t\tconst emailLocale = resolveEmailLocale(siteOptions.get(\"emdash:locale\"), request);\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\temailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),\n\t\t\temailLocale,\n\t\t};\n\n\t\t// Send recovery link\n\t\tawait sendMagicLink(config, adapter, targetUser.email, \"recovery\");\n\n\t\treturn apiSuccess({ success: true, message: \"Recovery link sent\" });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to send recovery link\", \"RECOVERY_SEND_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,2BAA2B,IAAI;AAGlE,KAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,MAC7B,QAAO,SAAS,aAAa,6BAA6B,IAAI;CAG/D,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;AAG7D,KAAI;EACH,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAG9C,MAAM,aAAa,MAAM,QAAQ,YAAY,GAAG;AAChD,MAAI,CAAC,WACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AAIpD,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,sEACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EACvE,MAAM,cAAc,MAAM,QAAQ,QAAgB,CAAC,qBAAqB,gBAAgB,CAAC;EACzF,MAAM,WAAW,YAAY,IAAI,oBAAoB,IAAI;EAIzD,MAAM,cAAc,mBAAmB,YAAY,IAAI,gBAAgB,EAAE,QAAQ;AAUjF,QAAM,cAT0B;GAC/B;GACA;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,cAAc,MAAM,yBAAyB,aAAa,SAAS;GACnE;GACA,EAG2B,SAAS,WAAW,OAAO,WAAW;AAElE,SAAO,WAAW;GAAE,SAAS;GAAM,SAAS;GAAsB,CAAC;UAC3D,OAAO;AACf,SAAO,YAAY,OAAO,gCAAgC,sBAAsB"}

package/dist/astro/routes/api/admin/users/index.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/users/index.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };
+//# sourceMappingURL=index.d.mts.map

package/dist/astro/routes/api/admin/users/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/admin/users/index.ts"],"mappings":";;;cAca,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}