emdash 1.0.1 → 1.1.0

package/src/api/schemas/content.ts

@@ -189,6 +189,22 @@ export const contentListQuery = cursorPaginationQuery
 	}))
 	.meta({ id: "ContentListQuery" });
 
+const MAX_CALENDAR_RANGE_MS = 62 * 24 * 60 * 60 * 1000;
+
+/** Canonical UTC form, so bounds compare as text against stored timestamps. */
+const calendarBound = z.iso
+	.datetime({ offset: true, message: "must be an ISO 8601 datetime" })
+	.transform((value) => new Date(value).toISOString());
+
+/** Calendar range: `from` inclusive, `to` exclusive, at most 62 days apart. */
+export const calendarQuery = cursorPaginationQuery
+	.extend({ from: calendarBound, to: calendarBound })
+	.refine((query) => query.from < query.to, { message: "to must be after from", path: ["to"] })
+	.refine((query) => Date.parse(query.to) - Date.parse(query.from) <= MAX_CALENDAR_RANGE_MS, {
+		message: "the range can span at most 62 days",
+		path: ["to"],
+	});
+
 /** ISO 8601 datetime for `publishedAt` / `createdAt`. Routes gate writes behind `content:publish_any`. */
 const contentDateOverride = contentDateTime.nullish();
 

package/src/astro/integration/index.ts

@@ -238,6 +238,18 @@ export function resolveImageEndpoint(opts: {
 	};
 }
 
+const EDGE_SLASHES = /^\/+|\/+$/g;
+
+/**
+ * The `routePattern` Astro reports for requests to the image endpoint. It drops
+ * the trailing slash `image.endpoint.route` carries under `trailingSlash: "always"`.
+ *
+ * @internal
+ */
+export function imageEndpointRoutePattern(route: string | undefined): string {
+	return `/${(route ?? "/_image").replace(EDGE_SLASHES, "")}`;
+}
+
 /**
  * Warn when `@astrojs/react` is not registered in the host's `integrations`.
  *
@@ -645,7 +657,12 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 				const imageConfig: Record<string, unknown> = {};
 				if (imageRemotePatterns.length) imageConfig.remotePatterns = imageRemotePatterns;
-				if (imageEndpoint) imageConfig.endpoint = { entrypoint: imageEndpoint };
+				if (imageEndpoint) {
+					imageConfig.endpoint = { entrypoint: imageEndpoint };
+					serializableConfig.imageEndpointRoute = imageEndpointRoutePattern(
+						astroConfig.image?.endpoint?.route,
+					);
+				}
 
 				updateConfig({
 					security: securityConfig,

package/src/astro/integration/routes.ts

@@ -126,6 +126,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/dashboard.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/calendar",
+		entrypoint: resolveRoute("api/calendar.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/admin/scheduled-policy-rejections/[collection]/[id]",
 		entrypoint: resolveRoute("api/admin/scheduled-policy-rejections/[collection]/[id].ts"),

package/src/astro/integration/vite-config.ts

@@ -646,6 +646,17 @@ export function createViteConfig(
 						"emdash > lowlight",
 						"emdash > highlight.js",
 						"emdash > highlight.js/lib/core",
+						// The HTML block's code editor loads these lazily. Discovering
+						// them on first use would re-optimize and reload the admin.
+						"emdash > @emdash-cms/admin > @codemirror/autocomplete",
+						"emdash > @emdash-cms/admin > @codemirror/commands",
+						"emdash > @emdash-cms/admin > @codemirror/lang-css",
+						"emdash > @emdash-cms/admin > @codemirror/lang-html",
+						"emdash > @emdash-cms/admin > @codemirror/lang-javascript",
+						"emdash > @emdash-cms/admin > @codemirror/language",
+						"emdash > @emdash-cms/admin > @codemirror/state",
+						"emdash > @emdash-cms/admin > @codemirror/view",
+						"emdash > @emdash-cms/admin > @lezer/highlight",
 					]
 				: [
 						"@emdash-cms/admin",

package/src/astro/middleware/csp.ts

@@ -93,6 +93,7 @@ export function buildEmDashCsp(registry?: RegistryConfigInput, storageEndpoint?:
 		"style-src 'self' 'unsafe-inline'",
 		connectSrc.join(" "),
 		"form-action 'self'",
+		"frame-src 'self' https:",
 		"frame-ancestors 'none'",
 		"img-src 'self' https: data: blob:",
 		"object-src 'none'",

package/src/astro/middleware/redirect.ts

@@ -14,10 +14,12 @@
  * wasn't already matched by a redirect, log it.
  */
 
+import type { APIContext } from "astro";
 import { defineMiddleware } from "astro:middleware";
 
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
+import { createRedirectSource } from "../../redirects/artifacts.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
 import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
@@ -68,10 +70,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	try {
 		const repo = new RedirectRepository(db);
 
-		// One query loads both exact and pattern rules into the cache; warm
-		// requests issue zero queries. Empty-redirect sites cache an empty
-		// Map + array, so the next request returns immediately without probing.
-		const cached = await loadCachedRedirects(() => repo.findAllEnabled());
+		// One query loads the published rules into the cache; warm requests
+		// issue zero queries, and an expired cache checks the published version
+		// in the background. Empty-redirect sites cache an empty Map + array.
+		const cached = await loadCachedRedirects(createRedirectSource(db));
 
 		// 1. Exact match (O(1) Map lookup)
 		let exact = cached.exact.get(pathname);
@@ -117,12 +119,21 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// No redirect matched -- proceed and check for 404
 		const response = await next();
 
+		// Keep a 404 out of the route cache: publishing the missing entry later
+		// purges content tags, not the missed path, so a cached 404 would outlive
+		// the fix. Astro has no cache handle for URLs that match no route, but a
+		// page answering a content miss with Astro.rewrite("/404") has one.
+		if (response.status === 404) {
+			const routeCache: APIContext["cache"] | undefined = context.cache;
+			routeCache?.set(false);
+		}
+
 		// Log misses (fire-and-forget) under the path the visitor requested.
-		// Two shapes count as a miss: an unmatched route rendering the error
-		// page with status 404, and a matched route answering a content miss
-		// with a redirect to /404 (the documented template pattern) — there the
-		// missed path exists only on this first pass, before the browser
-		// follows the redirect. The error page itself is never logged: /404
+		// Two shapes count as a miss: a 404 response (an unmatched route, or a
+		// page answering a content miss with Astro.rewrite("/404")), and a
+		// matched route answering a content miss with a redirect to /404 —
+		// there the missed path exists only on this first pass, before the
+		// browser follows the redirect. The error page itself is never logged: /404
 		// answers 404 by design and carries no path information.
 		const location = response.headers.get("location");
 		const missedByRedirect =

package/src/astro/middleware/request-context.ts

@@ -64,19 +64,31 @@ function optOutOfRouteCache(cache: RouteCache): void {
 	cache?.set(false);
 }
 
+function isHtmlResponse(response: Response): boolean {
+	return response.headers.get("content-type")?.includes("text/html") ?? false;
+}
+
 /**
  * Inject HTML before `</body>` if the response is an HTML page with a body
  * end tag. Does not touch cache headers — callers decide whether the result
- * is still shareable. `injected` tells the caller whether anything changed.
+ * is still shareable. `injected` tells the caller whether the result carries
+ * the injected HTML.
+ *
+ * `Astro.rewrite()` runs this middleware again for the rewritten route inside
+ * the original request, so the response can already contain the HTML; `marker`
+ * identifies it so it is injected only once.
  */
 async function injectBeforeBodyEnd(
 	response: Response,
 	htmlToInject: string,
+	marker: string,
 ): Promise<{ response: Response; injected: boolean }> {
-	const contentType = response.headers.get("content-type");
-	if (!contentType?.includes("text/html")) return { response, injected: false };
+	if (!isHtmlResponse(response)) return { response, injected: false };
 
 	const html = await response.text();
+	if (html.includes(marker)) {
+		return { response: new Response(html, response), injected: true };
+	}
 	if (!html.includes("</body>")) {
 		// Body already consumed — rebuild the response unchanged.
 		return { response: new Response(html, response), injected: false };
@@ -94,14 +106,21 @@ async function injectBeforeBodyEnd(
 
 /**
  * Inject toolbar HTML into a response if it's an HTML page.
- * Returns the original response if not HTML.
+ * Returns the original response if not HTML, without calling
+ * `renderToolbarHtml`, which loads labels and, for an editor, resolves the
+ * preview secret.
  */
 async function injectToolbar(
 	response: Response,
-	toolbarHtml: string,
+	renderToolbarHtml: () => Promise<string>,
 	routeCache: RouteCache,
 ): Promise<Response> {
-	const result = await injectBeforeBodyEnd(response, toolbarHtml);
+	if (!isHtmlResponse(response)) return response;
+	const result = await injectBeforeBodyEnd(
+		response,
+		await renderToolbarHtml(),
+		'id="emdash-toolbar"',
+	);
 	if (result.injected) {
 		// Toolbar-injected HTML is session-specific (its presence reveals an
 		// active editor session); it must never be stored in a shared CDN cache
@@ -121,7 +140,11 @@ async function injectToolbar(
  * stays fully shareable.
  */
 async function injectBootstrap(response: Response): Promise<Response> {
-	const result = await injectBeforeBodyEnd(response, renderToolbarBootstrap());
+	const result = await injectBeforeBodyEnd(
+		response,
+		renderToolbarBootstrap(),
+		"<!-- EmDash Toolbar Bootstrap -->",
+	);
 	return result.response;
 }
 
@@ -177,14 +200,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				if (!hasEditCookie || toolbarMode === false) return response;
 				// The Playground shows its own bar, so the editor toolbar is hidden and
 				// only provides inline editing.
-				const labels = await loadVisualEditingToolbarLabels(context.request);
-				const toolbarHtml = renderToolbar({
-					editMode: true,
-					isPreview: false,
-					labels,
-					hidden: true,
-				});
-				return injectToolbar(response, toolbarHtml, context.cache);
+				return injectToolbar(
+					response,
+					async () =>
+						renderToolbar({
+							editMode: true,
+							isPreview: false,
+							labels: await loadVisualEditingToolbarLabels(context.request),
+							hidden: true,
+						}),
+					context.cache,
+				);
 			},
 		);
 	}
@@ -237,8 +263,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	// Verify preview token if present.
 	// The preview secret is resolved via `resolveSecretsCached`: env wins,
 	// otherwise a DB-stored value is read (or generated on first need).
-	// `emdash.db` is set by the runtime middleware which runs first; the
-	// only path where it's missing is a runtime-init failure.
+	// `emdash.db` is set by the runtime middleware which runs first; it is
+	// missing after a runtime-init failure and on signed-out requests to the
+	// image endpoint EmDash installs, which skip runtime init.
 	let preview: { collection: string; id: string } | undefined;
 	if (hasPreviewToken) {
 		const db = context.locals.emdash?.db;
@@ -289,11 +316,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			// opt-out) in every toolbar mode, so the server toolbar is safe to
 			// inject here even in client mode.
 			if (isEditor && toolbarMode !== false) {
-				const toolbarHtml = await renderEditorToolbar(context, {
-					editMode,
-					isPreview: !!preview,
-				});
-				return injectToolbar(response, toolbarHtml, routeCache);
+				return injectToolbar(
+					response,
+					() => renderEditorToolbar(context, { editMode, isPreview: !!preview }),
+					routeCache,
+				);
 			}
 
 			// Stale edit cookie without a session (client mode): still serve the
@@ -324,11 +351,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// toolbar (response becomes `private, no-store` and route-cache
 		// opted out).
 		const response = await next();
-		const toolbarHtml = await renderEditorToolbar(context, {
-			editMode: false,
-			isPreview: false,
-		});
-		return injectToolbar(response, toolbarHtml, routeCache);
+		return injectToolbar(
+			response,
+			() => renderEditorToolbar(context, { editMode: false, isPreview: false }),
+			routeCache,
+		);
 	}
 
 	return next();

package/src/astro/middleware.ts

@@ -46,6 +46,7 @@ import {
 	resolveRuntimeMigrationMode,
 	type RuntimeMigrationMode,
 } from "../database/migrations/policy.js";
+import { markRequestScopedDb } from "../database/request-scoped.js";
 import { createDeferredTaskTracker } from "../deferred-tasks.js";
 import {
 	DB_INIT_DEADLINE_MS,
@@ -591,11 +592,78 @@ function pushMetricsTimings(
 const PUBLIC_RUNTIME_ROUTES = new Set(["/sitemap.xml", "/robots.txt"]);
 const SITEMAP_COLLECTION_RE = /^\/sitemap-[a-z][a-z0-9_]*\.xml$/;
 
+function isImageEndpointRequest(context: APIContext): boolean {
+	const route = virtualConfig?.imageEndpointRoute;
+	return typeof route === "string" && context.routePattern === route;
+}
+
+/** The runtime's storage adapter, or null when none is configured or it cannot be created. */
+function tryGetStorage(config: EmDashConfig, migrationMode: RuntimeMigrationMode): Storage | null {
+	try {
+		return EmDashRuntime.getStorage(buildDependencies(config, migrationMode));
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Run an image endpoint request on the adapter's request-scoped db. Anything
+ * on its path that queries (host middleware, the redirect middleware under a
+ * custom endpoint route) must not fall back to the per-isolate singleton: a
+ * request-bound connection (pg over Hyperdrive) reused by another request fails
+ * or hangs on workerd's cross-request I/O guard. A signed-in request also gets
+ * the db as `locals.emdash.db`, which the auth middleware resolves `locals.user`
+ * with.
+ *
+ * The adapter's `commit()` is skipped: on D1 it sets the bookmark cookie, and a
+ * response that sets a cookie is never stored by Workers Cache. This assumes
+ * nothing on the image path writes data the client must read back; the
+ * bookmark it sent still covers its earlier writes.
+ */
+async function runImageRequest(
+	config: EmDashConfig,
+	context: APIContext,
+	imageLocals: EmDashHandlers,
+	signedIn: boolean,
+	metrics: RequestMetrics,
+	next: () => Promise<Response>,
+): Promise<Response> {
+	const scoped = createRequestScopedDb({
+		config: config.database?.config,
+		isAuthenticated: signedIn,
+		isWrite: false,
+		canUseCachedBinding: false,
+		cookies: context.cookies,
+		url: context.url,
+	});
+	if (!scoped) {
+		if (signedIn) {
+			try {
+				const { getDb } = await import("../loader.js");
+				imageLocals.db = await getDb();
+			} catch (error) {
+				console.error("[emdash] image request could not open the database:", error);
+			}
+		}
+		return finalizeResponse(await next());
+	}
+	if (signedIn) imageLocals.db = scoped.db;
+	const { deferredTasks, lifecycle } = coordinateScopedDbLifecycle({ ...scoped, commit: () => {} });
+	const parent = getRequestContext();
+	const ctx = parent
+		? { ...parent, db: scoped.db, deferredTasks }
+		: { editMode: false, db: scoped.db, metrics, deferredTasks };
+	return runWithContext(ctx, () =>
+		finishScoped(lifecycle, async () => finalizeResponse(await next())),
+	);
+}
+
 /**
  * Ask the configured database adapter for a per-request scoped Kysely. The
  * adapter encapsulates any per-request semantics (D1 sessions, read-replica
  * routing, bookmark cookies, etc.); core just forwards the cookie jar and
- * request flags and wraps next() in ALS if a scope was returned.
+ * request flags, registers the returned handle as a view of the configured
+ * database, and wraps next() in ALS if a scope was returned.
  */
 function createRequestScopedDb(
 	opts: RequestScopedDbOpts,
@@ -605,7 +673,9 @@ function createRequestScopedDb(
 	const fn = virtualCreateRequestScopedDb as (
 		o: RequestScopedDbOpts,
 	) => { db: Kysely<Database>; commit: () => void; close?: () => void } | null;
-	return fn(opts);
+	const scoped = fn(opts);
+	if (scoped) markRequestScopedDb(scoped.db);
+	return scoped;
 }
 
 const buildDate = virtualBuildTime ? new Date(virtualBuildTime) : null;
@@ -619,6 +689,10 @@ const buildDate = virtualBuildTime ? new Date(virtualBuildTime) : null;
  * returning visitor's conditional request with 304, leaving them on HTML whose
  * assets 404.
  *
+ * Only a route that set a content validator gets the build dimension. The build
+ * alone does not move when content is published, so as a page's only validator
+ * it would answer every returning visitor with 304 until the next deploy.
+ *
  * Prerendered pages are served by the host's static layer, which manages its
  * own validators — only on-demand responses need the build dimension.
  *
@@ -626,13 +700,14 @@ const buildDate = virtualBuildTime ? new Date(virtualBuildTime) : null;
  * different, so after a rollback the earlier build still answers a conditional
  * request with 304 and the browser stays on the newer build's HTML.
  *
- * Must run before next(): Astro keeps the later of two dates, so a route's own
- * hint still wins when content is newer, and a route that opts out with
- * `Astro.cache.set(false)` stays opted out — calling set() afterwards would
- * clear that opt-out.
+ * Must run after next(), once the route has set its hint. Astro keeps the later
+ * of two dates, so a route's own hint still wins when content is newer.
+ * `Astro.cache.set(false)` also clears `lastModified`, so for an opted-out
+ * route the guard skips the build `set()` below, which would re-enable caching.
  */
 function applyBuildValidator(context: APIContext): void {
 	if (context.isPrerendered || !buildDate || !context.cache?.enabled) return;
+	if (!context.cache.options.lastModified) return;
 	context.cache.set({ lastModified: buildDate });
 }
 
@@ -654,8 +729,6 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
-	applyBuildValidator(context);
-
 	const queryRecorder = isInstrumentationEnabled()
 		? createRecorder(url.pathname, request.method, request.headers.get("x-perf-phase") ?? "default")
 		: undefined;
@@ -694,6 +767,19 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		const sessionUser =
 			context.isPrerendered || !hasSessionCookie ? null : await resolveSessionUser(context.session);
 
+		// The image endpoint EmDash installed reads media bytes from storage and
+		// nothing else, so it needs neither the setup probe nor runtime init.
+		const imageStorage =
+			config && !playgroundDb && isImageEndpointRequest(context)
+				? tryGetStorage(config, migrationMode)
+				: null;
+		if (imageStorage) {
+			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; the image endpoint reads only storage, the auth middleware db
+			const imageLocals = { storage: imageStorage } as EmDashHandlers;
+			locals.emdash = imageLocals;
+			return runImageRequest(config, context, imageLocals, !!sessionUser, metrics, next);
+		}
+
 		// Credentialed API requests (API tokens `ec_pat_*`, OAuth tokens
 		// `ec_oat_*`, and other Bearer credentials) carry no `astro-session`
 		// cookie, so `sessionUser` is null for them -- yet they still expect
@@ -778,9 +864,6 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
-							// Exposed so the wrapped image endpoint (`/_image`) can read media
-							// bytes from storage on the anonymous fast path -- public `<img>`
-							// requests carry no session.
 							storage: runtime.storage,
 						} as EmDashHandlers;
 					} catch (error) {
@@ -1117,7 +1200,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	};
 
 	try {
-		return await runWithContext({ editMode: false, queryRecorder, metrics }, run);
+		const response = await runWithContext({ editMode: false, queryRecorder, metrics }, run);
+		applyBuildValidator(context);
+		return response;
 	} finally {
 		// Streamed responses defer the flush to stream end (see
 		// wrapBodyForStreamMetrics) so the log captures queries issued while

package/src/astro/prefetch.ts

@@ -25,6 +25,7 @@
 
 import { getDb } from "../loader.js";
 import { getMenu } from "../menus/index.js";
+import { cachedQuery, CacheNamespace } from "../object-cache/index.js";
 import { requestCached, setRequestCacheEntry } from "../request-cache.js";
 import { getSiteSettings } from "../settings/index.js";
 import { getTaxonomyDefs, getTaxonomyTerms } from "../taxonomies/index.js";
@@ -53,11 +54,17 @@ async function prefetchTaxonomyTerms(): Promise<void> {
 
 /** Warm every menu via the real helper (primes `menu:${name}:${locale}`). */
 async function prefetchMenus(): Promise<void> {
-	const db = await getDb();
 	// The layout calls getMenu(name) with hardcoded names; we can't know them, so
 	// discover every menu name and warm them all (small, bounded chrome table).
-	const rows = await db.selectFrom("_emdash_menus").select("name").distinct().execute();
-	const names = [...new Set(rows.map((r) => r.name))];
+	const names = await cachedQuery({
+		namespace: CacheNamespace.MENUS,
+		key: "names",
+		load: async () => {
+			const db = await getDb();
+			const rows = await db.selectFrom("_emdash_menus").select("name").distinct().execute();
+			return [...new Set(rows.map((r) => r.name))];
+		},
+	});
 	await Promise.allSettled(names.map((name) => getMenu(name)));
 }
 

package/src/astro/routes/api/admin/bylines/[id]/translations.ts

@@ -76,11 +76,6 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			bio: body.bio ?? null,
 			avatarMediaId: body.avatarMediaId ?? source.avatarMediaId,
 			websiteUrl: body.websiteUrl ?? source.websiteUrl,
-			// Translations don't inherit the source's user_id or guest flag —
-			// the partial unique on (user_id, locale) means a single user can
-			// own one byline per locale, but the editor must opt into linking
-			// the new row by editing it after creation.
-			userId: null,
 			isGuest: source.isGuest,
 			locale: body.locale,
 			translationOf: id,

package/src/astro/routes/api/admin/bylines/index.ts

@@ -69,7 +69,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			bio: body.bio ?? null,
 			avatarMediaId: body.avatarMediaId ?? null,
 			websiteUrl: body.websiteUrl ?? null,
-			userId: body.userId ?? null,
+			userId: body.userId,
 			isGuest: body.isGuest,
 			locale: body.locale,
 			translationOf: body.translationOf,

package/src/astro/routes/api/admin/plugins/[id]/index.ts

@@ -33,6 +33,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 		emdash.sandboxedPluginEntries,
 		id,
 		emdash.config.marketplace,
+		(pluginId) => emdash.getRuntimePluginSettingsSchema(pluginId),
 	);
 	if (result.success) {
 		const tools = await emdash.getPluginMcpTools(id);

package/src/astro/routes/api/auth/oauth/[provider]/callback.ts

@@ -12,6 +12,7 @@ import {
 	handleOAuthCallback,
 	OAuthError,
 	Role,
+	isValidMicrosoftTenant,
 	type OAuthConsumerConfig,
 	type RoleLevel,
 } from "@emdash-cms/auth";
@@ -20,13 +21,14 @@ import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { getPublicOrigin } from "#api/public-url.js";
 import { finalizeSetup } from "#api/setup-complete.js";
 import { createOAuthStateStore } from "#auth/oauth-state-store.js";
+import type { AuthProviderDescriptor } from "#auth/types.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
 import { SESSION_UNAVAILABLE_MESSAGE } from "../../../../../session-user.js";
 
-type ProviderName = "github" | "google";
+type ProviderName = "github" | "google" | "microsoft";
 
-const VALID_PROVIDERS = new Set<string>(["github", "google"]);
+const VALID_PROVIDERS = new Set<string>(["github", "google", "microsoft"]);
 
 function isValidProvider(provider: string): provider is ProviderName {
 	return VALID_PROVIDERS.has(provider);
@@ -41,10 +43,31 @@ function envString(env: Record<string, unknown>, ...keys: string[]): string | un
 	return undefined;
 }
 
+/**
+ * The `emailVerified` option passed to `microsoft()` in the site config
+ */
+function getMicrosoftEmailVerified(
+	authProviders: AuthProviderDescriptor[] | undefined,
+): boolean | undefined {
+	const options = authProviders?.find((p) => p.id === "microsoft")?.config;
+	if (
+		options &&
+		typeof options === "object" &&
+		"emailVerified" in options &&
+		typeof options.emailVerified === "boolean"
+	) {
+		return options.emailVerified;
+	}
+	return undefined;
+}
+
 /**
  * Get OAuth config from environment variables
  */
-function getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig["providers"] {
+function getOAuthConfig(
+	env: Record<string, unknown>,
+	microsoftEmailVerified: boolean | undefined,
+): OAuthConsumerConfig["providers"] {
 	const providers: OAuthConsumerConfig["providers"] = {};
 
 	// GitHub
@@ -75,6 +98,32 @@ function getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig["prov
 		};
 	}
 
+	// Microsoft
+	const microsoftClientId = envString(
+		env,
+		"EMDASH_OAUTH_MICROSOFT_CLIENT_ID",
+		"MICROSOFT_CLIENT_ID",
+	);
+	const microsoftClientSecret = envString(
+		env,
+		"EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET",
+		"MICROSOFT_CLIENT_SECRET",
+	);
+	const microsoftTenant = envString(env, "EMDASH_OAUTH_MICROSOFT_TENANT_ID", "MICROSOFT_TENANT_ID");
+	if (
+		microsoftClientId &&
+		microsoftClientSecret &&
+		microsoftTenant &&
+		isValidMicrosoftTenant(microsoftTenant)
+	) {
+		providers.microsoft = {
+			clientId: microsoftClientId,
+			clientSecret: microsoftClientSecret,
+			tenant: microsoftTenant,
+			emailVerified: microsoftEmailVerified,
+		};
+	}
+
 	return providers;
 }
 
@@ -128,7 +177,7 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 			env?: Record<string, unknown>;
 		};
 		const env = cfEnv ?? import.meta.env;
-		const providers = getOAuthConfig(env);
+		const providers = getOAuthConfig(env, getMicrosoftEmailVerified(emdash.config.authProviders));
 
 		if (!providers[provider]) {
 			return redirect(
@@ -247,6 +296,9 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 				case "profile_fetch_failed":
 					message = "Failed to retrieve your profile. Please try again.";
 					break;
+				case "id_token_invalid":
+					message = "Could not verify your sign-in with the provider. Please try again.";
+					break;
 				default:
 					message = "Authentication failed. Please try again.";
 					break;