emdash 1.0.1 → 1.1.0

package/dist/allowed-origins-D78QvbTO.mjs

@@ -1,116 +0,0 @@
-import { n as getEnvAllowedOrigins } from "./public-url-7j0cpCFc.mjs";
-
-//#region src/auth/allowed-origins.ts
-/**
-* Resolution and validation of multi-origin passkey verification.
-*
-* `allowedOrigins` lets one EmDash deployment accept passkey assertions from
-* several hostnames sharing the same `rpId` (e.g. apex + preview/staging
-* subdomains under one registrable parent). Origins come from two sources:
-*
-*   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)
-*   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)
-*
-* Sources are merged (union of permissions, deduplicated). Each entry is
-* validated against `siteUrl` to fail loud on dead config the browser would
-* never honor.
-*/
-/**
-* Collect raw allowedOrigins from config and env, source-tagged.
-*
-* Returns raw values — the caller is expected to pass the result through
-* `validateAllowedOrigins()` before use in passkey verification.
-*/
-function getConfiguredAllowedOrigins(config) {
-	const tagged = [];
-	if (config?.allowedOrigins) {
-		for (const origin of config.allowedOrigins) if (origin) tagged.push({
-			origin,
-			source: "config.allowedOrigins"
-		});
-	}
-	for (const origin of getEnvAllowedOrigins()) tagged.push({
-		origin,
-		source: "EMDASH_ALLOWED_ORIGINS"
-	});
-	return tagged;
-}
-/**
-* Validate per-entry shape rules (no `siteUrl` needed):
-*   - parses as `URL`
-*   - protocol is `http:` or `https:`
-*   - hostname has no trailing dot (`example.com.` rejected)
-*   - hostname has no empty labels (`foo..example.com` rejected)
-*
-* Returns the deduplicated, normalized origin form (`URL.origin`) of every
-* input, in input order. Throws on the first violation with a source-tagged
-* error message.
-*/
-function validateOriginShape(tagged) {
-	const normalized = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const { origin, source } of tagged) {
-		let parsed;
-		try {
-			parsed = new URL(origin);
-		} catch (e) {
-			throw configError(source, `invalid URL: "${origin}"`, e);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw configError(source, `origin must be http or https: "${origin}" (got ${parsed.protocol})`);
-		if (parsed.hostname.endsWith(".")) throw configError(source, `hostname has a trailing dot: "${origin}". Remove the trailing dot — assertion origins from the browser do not include it.`);
-		if (parsed.hostname.split(".").includes("")) throw configError(source, `hostname has empty labels: "${origin}"`);
-		if (!seen.has(parsed.origin)) {
-			seen.add(parsed.origin);
-			normalized.push(parsed.origin);
-		}
-	}
-	return normalized;
-}
-/**
-* Validate the effective merged allowedOrigins set against `siteUrl`.
-*
-* Performs `validateOriginShape()` plus the siteUrl-dependent rules:
-*   - Rule A: non-empty origins ⇒ `siteUrl` is set
-*   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)
-*   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)
-*   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain
-*
-* Throws on first violation. Returns the deduplicated normalized origins.
-*
-* Use this at the runtime chokepoint (where config + env are merged into the
-* effective set). At Astro integration init, prefer `validateOriginShape()`
-* for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be
-* supplied at runtime via `EMDASH_SITE_URL`.
-*/
-function validateAllowedOrigins(siteUrl, tagged) {
-	const normalized = validateOriginShape(tagged);
-	if (normalized.length === 0) return normalized;
-	if (!siteUrl) throw new Error(`EmDash config error: allowedOrigins is set (${normalized.length} ${normalized.length === 1 ? "entry" : "entries"}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`);
-	let siteHost;
-	try {
-		siteHost = new URL(siteUrl).hostname;
-	} catch (e) {
-		throw new Error(`EmDash config error: siteUrl is not a valid URL: "${siteUrl}"`, { cause: e });
-	}
-	if (siteHost.endsWith(".")) throw new Error(`EmDash config error: siteUrl "${siteUrl}" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`);
-	if (isIPLiteralHostname(siteHost)) throw new Error(`EmDash config error: siteUrl "${siteUrl}" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`);
-	for (const { origin, source } of tagged) {
-		const h = new URL(origin).hostname;
-		if (h !== siteHost && !h.endsWith("." + siteHost)) throw configError(source, `"${origin}" is not a subdomain of siteUrl "${siteUrl}". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`);
-	}
-	return normalized;
-}
-function configError(source, detail, cause) {
-	const err = /* @__PURE__ */ new Error(`EmDash config error in ${source}: ${detail}`);
-	if (cause !== void 0) err.cause = cause;
-	return err;
-}
-const IPV4_DOTTED_DECIMAL_RE = /^\d+(\.\d+){3}$/;
-function isIPLiteralHostname(h) {
-	if (h.startsWith("[")) return true;
-	return IPV4_DOTTED_DECIMAL_RE.test(h);
-}
-
-//#endregion
-export { validateAllowedOrigins as n, validateOriginShape as r, getConfiguredAllowedOrigins as t };
-//# sourceMappingURL=allowed-origins-D78QvbTO.mjs.map

package/dist/allowed-origins-D78QvbTO.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowed-origins-D78QvbTO.mjs","names":[],"sources":["../src/auth/allowed-origins.ts"],"sourcesContent":["/**\n * Resolution and validation of multi-origin passkey verification.\n *\n * `allowedOrigins` lets one EmDash deployment accept passkey assertions from\n * several hostnames sharing the same `rpId` (e.g. apex + preview/staging\n * subdomains under one registrable parent). Origins come from two sources:\n *\n *   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)\n *   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)\n *\n * Sources are merged (union of permissions, deduplicated). Each entry is\n * validated against `siteUrl` to fail loud on dead config the browser would\n * never honor.\n */\n\nimport { getEnvAllowedOrigins } from \"../api/public-url.js\";\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\nexport type AllowedOriginSource = \"config.allowedOrigins\" | \"EMDASH_ALLOWED_ORIGINS\";\n\nexport interface TaggedOrigin {\n\t/** Raw entry as declared by the operator. */\n\torigin: string;\n\t/** Where the entry came from (used for source-attributed errors). */\n\tsource: AllowedOriginSource;\n}\n\n/**\n * Collect raw allowedOrigins from config and env, source-tagged.\n *\n * Returns raw values — the caller is expected to pass the result through\n * `validateAllowedOrigins()` before use in passkey verification.\n */\nexport function getConfiguredAllowedOrigins(config?: EmDashConfig): TaggedOrigin[] {\n\tconst tagged: TaggedOrigin[] = [];\n\tif (config?.allowedOrigins) {\n\t\tfor (const origin of config.allowedOrigins) {\n\t\t\tif (origin) tagged.push({ origin, source: \"config.allowedOrigins\" });\n\t\t}\n\t}\n\tfor (const origin of getEnvAllowedOrigins()) {\n\t\ttagged.push({ origin, source: \"EMDASH_ALLOWED_ORIGINS\" });\n\t}\n\treturn tagged;\n}\n\n/**\n * Validate per-entry shape rules (no `siteUrl` needed):\n *   - parses as `URL`\n *   - protocol is `http:` or `https:`\n *   - hostname has no trailing dot (`example.com.` rejected)\n *   - hostname has no empty labels (`foo..example.com` rejected)\n *\n * Returns the deduplicated, normalized origin form (`URL.origin`) of every\n * input, in input order. Throws on the first violation with a source-tagged\n * error message.\n */\nexport function validateOriginShape(tagged: TaggedOrigin[]): string[] {\n\tconst normalized: string[] = [];\n\tconst seen = new Set<string>();\n\tfor (const { origin, source } of tagged) {\n\t\tlet parsed: URL;\n\t\ttry {\n\t\t\tparsed = new URL(origin);\n\t\t} catch (e) {\n\t\t\tthrow configError(source, `invalid URL: \"${origin}\"`, e);\n\t\t}\n\t\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`origin must be http or https: \"${origin}\" (got ${parsed.protocol})`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.endsWith(\".\")) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`hostname has a trailing dot: \"${origin}\". Remove the trailing dot — assertion origins from the browser do not include it.`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.split(\".\").includes(\"\")) {\n\t\t\tthrow configError(source, `hostname has empty labels: \"${origin}\"`);\n\t\t}\n\t\tif (!seen.has(parsed.origin)) {\n\t\t\tseen.add(parsed.origin);\n\t\t\tnormalized.push(parsed.origin);\n\t\t}\n\t}\n\treturn normalized;\n}\n\n/**\n * Validate the effective merged allowedOrigins set against `siteUrl`.\n *\n * Performs `validateOriginShape()` plus the siteUrl-dependent rules:\n *   - Rule A: non-empty origins ⇒ `siteUrl` is set\n *   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)\n *   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)\n *   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain\n *\n * Throws on first violation. Returns the deduplicated normalized origins.\n *\n * Use this at the runtime chokepoint (where config + env are merged into the\n * effective set). At Astro integration init, prefer `validateOriginShape()`\n * for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be\n * supplied at runtime via `EMDASH_SITE_URL`.\n */\nexport function validateAllowedOrigins(\n\tsiteUrl: string | undefined,\n\ttagged: TaggedOrigin[],\n): string[] {\n\tconst normalized = validateOriginShape(tagged);\n\tif (normalized.length === 0) return normalized;\n\n\tif (!siteUrl) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: allowedOrigins is set (${normalized.length} ${\n\t\t\t\tnormalized.length === 1 ? \"entry\" : \"entries\"\n\t\t\t}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`,\n\t\t);\n\t}\n\n\tlet siteHost: string;\n\ttry {\n\t\tsiteHost = new URL(siteUrl).hostname;\n\t} catch (e) {\n\t\tthrow new Error(`EmDash config error: siteUrl is not a valid URL: \"${siteUrl}\"`, {\n\t\t\tcause: e,\n\t\t});\n\t}\n\n\tif (siteHost.endsWith(\".\")) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`,\n\t\t);\n\t}\n\tif (isIPLiteralHostname(siteHost)) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`,\n\t\t);\n\t}\n\n\tfor (const { origin, source } of tagged) {\n\t\tconst h = new URL(origin).hostname;\n\t\tif (h !== siteHost && !h.endsWith(\".\" + siteHost)) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`\"${origin}\" is not a subdomain of siteUrl \"${siteUrl}\". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`,\n\t\t\t);\n\t\t}\n\t}\n\n\treturn normalized;\n}\n\nfunction configError(source: AllowedOriginSource, detail: string, cause?: unknown): Error {\n\tconst err = new Error(`EmDash config error in ${source}: ${detail}`);\n\tif (cause !== undefined) (err as Error & { cause?: unknown }).cause = cause;\n\treturn err;\n}\n\nconst IPV4_DOTTED_DECIMAL_RE = /^\\d+(\\.\\d+){3}$/;\n\nfunction isIPLiteralHostname(h: string): boolean {\n\t// IPv6 hostnames are bracketed by URL.hostname, e.g. \"[::1]\"\n\tif (h.startsWith(\"[\")) return true;\n\t// IPv4 dotted-decimal\n\treturn IPV4_DOTTED_DECIMAL_RE.test(h);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,4BAA4B,QAAuC;CAClF,MAAM,SAAyB,EAAE;AACjC,KAAI,QAAQ,gBACX;OAAK,MAAM,UAAU,OAAO,eAC3B,KAAI,OAAQ,QAAO,KAAK;GAAE;GAAQ,QAAQ;GAAyB,CAAC;;AAGtE,MAAK,MAAM,UAAU,sBAAsB,CAC1C,QAAO,KAAK;EAAE;EAAQ,QAAQ;EAA0B,CAAC;AAE1D,QAAO;;;;;;;;;;;;;AAcR,SAAgB,oBAAoB,QAAkC;CACrE,MAAM,aAAuB,EAAE;CAC/B,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,IAAI;AACJ,MAAI;AACH,YAAS,IAAI,IAAI,OAAO;WAChB,GAAG;AACX,SAAM,YAAY,QAAQ,iBAAiB,OAAO,IAAI,EAAE;;AAEzD,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,YACL,QACA,kCAAkC,OAAO,SAAS,OAAO,SAAS,GAClE;AAEF,MAAI,OAAO,SAAS,SAAS,IAAI,CAChC,OAAM,YACL,QACA,iCAAiC,OAAO,oFACxC;AAEF,MAAI,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,CAC1C,OAAM,YAAY,QAAQ,+BAA+B,OAAO,GAAG;AAEpE,MAAI,CAAC,KAAK,IAAI,OAAO,OAAO,EAAE;AAC7B,QAAK,IAAI,OAAO,OAAO;AACvB,cAAW,KAAK,OAAO,OAAO;;;AAGhC,QAAO;;;;;;;;;;;;;;;;;;AAmBR,SAAgB,uBACf,SACA,QACW;CACX,MAAM,aAAa,oBAAoB,OAAO;AAC9C,KAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,KAAI,CAAC,QACJ,OAAM,IAAI,MACT,+CAA+C,WAAW,OAAO,GAChE,WAAW,WAAW,IAAI,UAAU,UACpC,wLACD;CAGF,IAAI;AACJ,KAAI;AACH,aAAW,IAAI,IAAI,QAAQ,CAAC;UACpB,GAAG;AACX,QAAM,IAAI,MAAM,qDAAqD,QAAQ,IAAI,EAChF,OAAO,GACP,CAAC;;AAGH,KAAI,SAAS,SAAS,IAAI,CACzB,OAAM,IAAI,MACT,iCAAiC,QAAQ,yHACzC;AAEF,KAAI,oBAAoB,SAAS,CAChC,OAAM,IAAI,MACT,iCAAiC,QAAQ,oJACzC;AAGF,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC;AAC1B,MAAI,MAAM,YAAY,CAAC,EAAE,SAAS,MAAM,SAAS,CAChD,OAAM,YACL,QACA,IAAI,OAAO,mCAAmC,QAAQ,+EACtD;;AAIH,QAAO;;AAGR,SAAS,YAAY,QAA6B,QAAgB,OAAwB;CACzF,MAAM,sBAAM,IAAI,MAAM,0BAA0B,OAAO,IAAI,SAAS;AACpE,KAAI,UAAU,OAAW,CAAC,IAAoC,QAAQ;AACtE,QAAO;;AAGR,MAAM,yBAAyB;AAE/B,SAAS,oBAAoB,GAAoB;AAEhD,KAAI,EAAE,WAAW,IAAI,CAAE,QAAO;AAE9B,QAAO,uBAAuB,KAAK,EAAE"}