emdash 1.0.1 → 1.2.0

package/src/astro/integration/dev-env.ts

@@ -0,0 +1,84 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const DEV_ENV_SECRET_VAR_NAMES = new Set(["EMDASH_ENCRYPTION_KEY"]);
+const NEWLINE_RE = /\r?\n/;
+
+/**
+ * Parse a minimal subset of dotenv syntax, enough for the local secrets
+ * scaffolder and common user edits. Inline comments, blank lines, and
+ * lines without an `=` are ignored; leading/trailing whitespace is trimmed.
+ * Single and double quotes are stripped; no variable expansion is performed.
+ */
+function parseDotenv(content: string): Record<string, string> {
+	const result: Record<string, string> = {};
+	for (const rawLine of content.split(NEWLINE_RE)) {
+		const line = stripInlineComment(rawLine).trim();
+		if (line === "" || line.startsWith("#")) continue;
+
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+
+		const key = line.slice(0, eq).trim();
+		let value = line.slice(eq + 1).trim();
+
+		// Strip matching quote pair. Keep escaped quotes simple: only unescape
+		// the quote char that wrapped the value.
+		if (value.length >= 2) {
+			const first = value[0];
+			const last = value.at(-1)!;
+			if ((first === '"' || first === "'") && first === last) {
+				value = value.slice(1, -1).replaceAll(`\\${first}`, first);
+			}
+		}
+
+		result[key] = value;
+	}
+	return result;
+}
+
+/**
+ * Remove an inline `#` comment only if it is not inside a quoted value. This
+ * keeps values like `FOO="a # b"` intact while stripping trailing comments.
+ */
+function stripInlineComment(line: string): string {
+	let inSingleQuote = false;
+	let inDoubleQuote = false;
+	for (let i = 0; i < line.length; i++) {
+		const char = line[i];
+		if (char === "'" && !inDoubleQuote) {
+			inSingleQuote = !inSingleQuote;
+		} else if (char === '"' && !inSingleQuote) {
+			inDoubleQuote = !inDoubleQuote;
+		} else if (char === "#" && !inSingleQuote && !inDoubleQuote) {
+			return line.slice(0, i);
+		}
+	}
+	return line;
+}
+
+/**
+ * Load the plugin-secret encryption key from the project's `.env` into
+ * `process.env` during `astro dev`. Existing environment variables (e.g.
+ * already exported in the shell, or set by the host platform) are honored and
+ * never overwritten.
+ *
+ * This keeps the deliberate `process.env`-only rule in the secrets module
+ * while letting freshly scaffolded Node sites use the generated encryption key
+ * without a manual `export` step. Other EmDash variables are intentionally not
+ * copied, so `.env` values intended for production do not accidentally replace
+ * generated dev values (for example `SITE_URL`).
+ */
+export function loadDevEnv(root: URL | string): void {
+	const rootPath = typeof root === "string" ? root : fileURLToPath(root);
+	const envPath = join(rootPath, ".env");
+	if (!existsSync(envPath)) return;
+
+	const parsed = parseDotenv(readFileSync(envPath, "utf-8"));
+	for (const [key, value] of Object.entries(parsed)) {
+		if (DEV_ENV_SECRET_VAR_NAMES.has(key) && !process.env[key]) {
+			process.env[key] = value;
+		}
+	}
+}

package/src/astro/integration/index.ts

@@ -15,6 +15,7 @@ import { fileURLToPath } from "node:url";
 
 import type { AstroIntegration, AstroIntegrationLogger, AstroIntegrationMiddleware } from "astro";
 
+import { getEnvSiteUrl } from "../../api/public-url.js";
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
 import { normalizeMigrationConfig } from "../../database/migrations/policy.js";
 import { normalizeAstroI18n } from "../../i18n/normalize.js";
@@ -34,6 +35,8 @@ import {
 } from "../../registry/config.js";
 import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
+import { readAdminLocaleManifest, resolveAdminLocales } from "./admin-locales.js";
+import { loadDevEnv } from "./dev-env.js";
 import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
 import { notoSans } from "./font-provider.js";
 import {
@@ -43,7 +46,7 @@ import {
 	injectMcpRoute,
 } from "./routes.js";
 import type { EmDashConfig } from "./runtime.js";
-import { createViteConfig } from "./vite-config.js";
+import { createViteConfig, resolveAdminDist } from "./vite-config.js";
 
 // Re-export runtime types and functions
 export type {
@@ -77,12 +80,25 @@ const DEFAULT_STORAGE = local({
 	baseUrl: "/_emdash/api/media/file",
 });
 
-interface ImageRemotePattern {
+export interface ImageRemotePattern {
 	protocol?: "http" | "https";
 	hostname?: string;
 	pathname?: string;
 }
 
+/**
+ * Resolve the site origin for `image.remotePatterns`: the configured `siteUrl`,
+ * then `EMDASH_SITE_URL` / `SITE_URL`. Astro bakes `remotePatterns` into the
+ * build output, so the env vars only take effect if they are set when
+ * `astro build` runs.
+ *
+ * @internal Exported for unit testing.
+ */
+export function resolveBuildTimeSiteUrl(configuredSiteUrl: string | undefined): string | undefined {
+	if (configuredSiteUrl) return configuredSiteUrl;
+	return getEnvSiteUrl();
+}
+
 /**
  * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
  *
@@ -142,10 +158,12 @@ export function buildImageRemotePatterns(
 
 	if (siteUrl) {
 		try {
-			patterns.push({
-				hostname: new URL(siteUrl).hostname,
-				pathname: `${INTERNAL_MEDIA_PREFIX}**`,
-			});
+			const { hostname } = new URL(siteUrl);
+			// WHATWG URL accepts `*` in a hostname, which Astro's matcher treats
+			// as a wildcard that would allowlist other hosts.
+			if (!hostname.includes("*")) {
+				patterns.push({ hostname, pathname: `${INTERNAL_MEDIA_PREFIX}**` });
+			}
 		} catch {
 			// ignore an unparseable site URL
 		}
@@ -238,6 +256,18 @@ export function resolveImageEndpoint(opts: {
 	};
 }
 
+const EDGE_SLASHES = /^\/+|\/+$/g;
+
+/**
+ * The `routePattern` Astro reports for requests to the image endpoint. It drops
+ * the trailing slash `image.endpoint.route` carries under `trailingSlash: "always"`.
+ *
+ * @internal
+ */
+export function imageEndpointRoutePattern(route: string | undefined): string {
+	return `/${(route ?? "/_image").replace(EDGE_SLASHES, "")}`;
+}
+
 /**
  * Warn when `@astrojs/react` is not registered in the host's `integrations`.
  *
@@ -447,8 +477,9 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 	// Validate siteUrl if provided in astro.config.mjs.
 	// Env-var fallback (EMDASH_SITE_URL / SITE_URL) is handled at runtime by
-	// getPublicOrigin() in api/public-url.ts — NOT here — so Docker images built
-	// without a domain can pick it up at container start via process.env.
+	// getPublicOrigin() in api/public-url.ts — don't fold it into
+	// resolvedConfig.siteUrl here — so Docker images built without a domain can
+	// pick it up at container start via process.env.
 	if (resolvedConfig.siteUrl) {
 		const raw = resolvedConfig.siteUrl;
 		try {
@@ -518,6 +549,14 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		}
 	}
 
+	if (config.admin?.locales !== undefined) {
+		const manifest = readAdminLocaleManifest(resolveAdminDist());
+		resolvedConfig.admin = {
+			...config.admin,
+			locales: resolveAdminLocales(config.admin.locales, Object.keys(manifest)),
+		};
+	}
+
 	// Resolved plugins (populated at build time by importing entrypoints)
 	let _resolvedPlugins: ResolvedPlugin[] = [];
 
@@ -551,6 +590,19 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					allowLocalhost: command === "dev" || command === "sync",
 				});
 				printBanner(logger);
+				if (command === "dev") {
+					// In Node `astro dev`, Vite loads `.env` into `import.meta.env`
+					// but not `process.env`. The plugin-secret encryption key
+					// intentionally reads only `process.env`, so a freshly
+					// scaffolded site can't save secret plugin settings until the
+					// key is copied over. Load only `EMDASH_ENCRYPTION_KEY` here,
+					// honoring any value already present in the shell.
+					try {
+						loadDevEnv(astroConfig.root);
+					} catch (error: unknown) {
+						logger.warn(`Failed to load EMDASH_ENCRYPTION_KEY from .env: ${String(error)}`);
+					}
+				}
 				// Capture the host's Astro version so the runtime can expose it
 				// to the admin and the registry install gate for `env:astro`
 				// constraint checks.
@@ -629,7 +681,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				// merges arrays, so user-configured remotePatterns are preserved.
 				const imageRemotePatterns = buildImageRemotePatterns(
 					resolvedConfig.storage,
-					resolvedConfig.siteUrl,
+					resolveBuildTimeSiteUrl(resolvedConfig.siteUrl),
 					command,
 				);
 
@@ -645,7 +697,12 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 				const imageConfig: Record<string, unknown> = {};
 				if (imageRemotePatterns.length) imageConfig.remotePatterns = imageRemotePatterns;
-				if (imageEndpoint) imageConfig.endpoint = { entrypoint: imageEndpoint };
+				if (imageEndpoint) {
+					imageConfig.endpoint = { entrypoint: imageEndpoint };
+					serializableConfig.imageEndpointRoute = imageEndpointRoutePattern(
+						astroConfig.image?.endpoint?.route,
+					);
+				}
 
 				updateConfig({
 					security: securityConfig,

package/src/astro/integration/routes.ts

@@ -126,6 +126,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/dashboard.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/calendar",
+		entrypoint: resolveRoute("api/calendar.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/admin/scheduled-policy-rejections/[collection]/[id]",
 		entrypoint: resolveRoute("api/admin/scheduled-policy-rejections/[collection]/[id].ts"),
@@ -480,6 +485,21 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/settings/email.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain",
+		entrypoint: resolveRoute("api/settings/domain.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain/notify",
+		entrypoint: resolveRoute("api/settings/domain-notify.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/site/domain-proof",
+		entrypoint: resolveRoute("api/site/domain-proof.ts"),
+	});
+
 	// Backup routes
 	injectRoute({
 		pattern: "/_emdash/api/settings/backups",
@@ -1200,6 +1220,11 @@ export function injectBuiltinAuthRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/auth/magic-link/verify.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/auth/handover",
+		entrypoint: resolveRoute("api/auth/handover.ts"),
+	});
+
 	// OAuth routes
 	injectRoute({
 		pattern: "/_emdash/api/auth/oauth/[provider]",

package/src/astro/integration/runtime.ts

@@ -652,6 +652,21 @@ export interface EmDashConfig {
 		footerLabel?: string | false;
 		/** URL or path to a custom favicon for the admin panel. */
 		favicon?: string;
+		/**
+		 * Build-time allowlist of admin UI locales to ship.
+		 *
+		 * Only the listed locales are bundled and offered in the language
+		 * switcher; other locales fall back to English. `en` is always
+		 * included. Unknown codes fail the build.
+		 *
+		 * @example
+		 * ```ts
+		 * emdash({
+		 *   admin: { locales: ["en", "de"] },
+		 * })
+		 * ```
+		 */
+		locales?: string[];
 	};
 
 	/**

package/src/astro/integration/vite-config.ts

@@ -14,6 +14,7 @@ import type { AstroConfig } from "astro";
 import type { Plugin } from "vite";
 
 import { COMMIT, VERSION } from "../../version.js";
+import { createAdminLocaleResolverPlugin, readAdminLocaleManifest } from "./admin-locales.js";
 import type { EmDashConfig, PluginDescriptor } from "./runtime.js";
 import {
 	VIRTUAL_CONFIG_ID,
@@ -120,7 +121,7 @@ export function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string
  * Resolve path to the admin package dist directory.
  * Used for Vite alias to ensure the package is found in pnpm's isolated node_modules.
  */
-function resolveAdminDist(): string {
+export function resolveAdminDist(): string {
 	const require = createRequire(import.meta.url);
 	const adminPath = require.resolve("@emdash-cms/admin");
 	// Return the directory containing the built package (dist/)
@@ -425,6 +426,7 @@ export function createViteConfig(
 
 	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : undefined;
 	const useSource = adminSourcePath !== undefined;
+	const adminLocales = options.resolvedConfig.admin?.locales;
 	const useSyncExternalStoreShimPath = resolveIntegrationShim("use-sync-external-store.js");
 	const useSyncExternalStoreWithSelectorShimPath = resolveIntegrationShim(
 		"use-sync-external-store-with-selector.js",
@@ -445,6 +447,7 @@ export function createViteConfig(
 			__EMDASH_PSEUDO_LOCALE__: JSON.stringify(
 				isDev && process.env["EMDASH_PSEUDO_LOCALE"] === "1",
 			),
+			__EMDASH_ADMIN_LOCALES__: JSON.stringify(adminLocales ?? null),
 		},
 		resolve: {
 			dedupe: ["@emdash-cms/admin", "react", "react-dom"],
@@ -493,6 +496,18 @@ export function createViteConfig(
 		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Monorepo has both vite 6 (docs) and vite 7 (core). tsgo resolves correctly.
 		plugins: [
 			createVirtualModulesPlugin(options, command),
+			// Must precede the Lingui macro plugin, which redirects source
+			// catalog imports to dist/ in dev.
+			...(adminLocales
+				? [
+						createAdminLocaleResolverPlugin({
+							adminDistPath,
+							adminSourcePath,
+							locales: adminLocales,
+							manifest: readAdminLocaleManifest(adminDistPath),
+						}),
+					]
+				: []),
 			...(cloudflare ? [] : [createWorkersBuiltinsExternalPlugin()]),
 			// In dev mode with source alias, compile Lingui macros on the fly
 			// and redirect locale .mjs imports to dist/.
@@ -646,6 +661,19 @@ export function createViteConfig(
 						"emdash > lowlight",
 						"emdash > highlight.js",
 						"emdash > highlight.js/lib/core",
+						// The HTML block's code editor loads these lazily. Discovering
+						// them on first use would re-optimize and reload the admin.
+						"emdash > @emdash-cms/admin > @codemirror/autocomplete",
+						"emdash > @emdash-cms/admin > @codemirror/commands",
+						"emdash > @emdash-cms/admin > @codemirror/lang-css",
+						"emdash > @emdash-cms/admin > @codemirror/lang-html",
+						"emdash > @emdash-cms/admin > @codemirror/lang-javascript",
+						"emdash > @emdash-cms/admin > @codemirror/language",
+						"emdash > @emdash-cms/admin > @codemirror/state",
+						"emdash > @emdash-cms/admin > @codemirror/view",
+						"emdash > @emdash-cms/admin > @lezer/highlight",
+						// Each admin language loads its date locale on first use.
+						"emdash > @emdash-cms/admin > react-day-picker/locale/*",
 					]
 				: [
 						"@emdash-cms/admin",

package/src/astro/middleware/auth.ts

@@ -114,6 +114,7 @@ const PUBLIC_API_EXACT = new Set([
 	"/_emdash/api/auth/passkey/verify",
 	"/_emdash/api/auth/mode",
 	"/_emdash/api/health",
+	"/_emdash/api/site/domain-proof",
 	"/_emdash/api/oauth/token",
 	"/_emdash/api/snapshot",
 	"/_emdash/api/visual-editing/toolbar-labels",
@@ -239,7 +240,20 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				return apiError("CSRF_REJECTED", "Missing required header", 403);
 			}
 		}
-		return next();
+		const response = await next();
+		if (!import.meta.env.DEV) {
+			response.headers.set(
+				"Content-Security-Policy",
+				buildEmDashCsp(
+					getRegistryConfigInput(context.locals.emdash?.config.registry),
+					getConfiguredStorageEndpoint(
+						context.locals.emdash?.config.storage,
+						context.locals.emdash?.storage,
+					),
+				),
+			);
+		}
+		return response;
 	}
 
 	// For public routes: soft auth check (set locals.user if session exists, but never block)
@@ -569,8 +583,7 @@ async function handleExternalAuth(
 			let newName: string | undefined;
 			let newRole: RoleLevel | undefined;
 
-			// Sync name from provider if provider provides one and local differs
-			if (authResult.name && user.name !== authResult.name) {
+			if (externalConfig.syncName !== false && authResult.name && user.name !== authResult.name) {
 				newName = authResult.name;
 				updates.name = newName;
 			}

package/src/astro/middleware/csp.ts

@@ -93,8 +93,10 @@ export function buildEmDashCsp(registry?: RegistryConfigInput, storageEndpoint?:
 		"style-src 'self' 'unsafe-inline'",
 		connectSrc.join(" "),
 		"form-action 'self'",
+		"frame-src 'self' https:",
 		"frame-ancestors 'none'",
 		"img-src 'self' https: data: blob:",
+		"media-src 'self' blob: https:",
 		"object-src 'none'",
 		"base-uri 'self'",
 	].join("; ");

package/src/astro/middleware/redirect.ts

@@ -14,10 +14,13 @@
  * wasn't already matched by a redirect, log it.
  */
 
+import type { APIContext } from "astro";
 import { defineMiddleware } from "astro:middleware";
 
+import { after } from "../../after.js";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
+import { createRedirectSource } from "../../redirects/artifacts.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
 import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
@@ -40,6 +43,16 @@ function warnUnsafeDestination(id: string): void {
 	);
 }
 
+function recordHitInBackground(repo: RedirectRepository, id: string): void {
+	after(async () => {
+		try {
+			await repo.recordHit(id);
+		} catch (error) {
+			console.error("[emdash:redirects] failed to record redirect hit:", error);
+		}
+	});
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 
@@ -68,10 +81,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	try {
 		const repo = new RedirectRepository(db);
 
-		// One query loads both exact and pattern rules into the cache; warm
-		// requests issue zero queries. Empty-redirect sites cache an empty
-		// Map + array, so the next request returns immediately without probing.
-		const cached = await loadCachedRedirects(() => repo.findAllEnabled());
+		// One query loads the published rules into the cache; warm requests
+		// issue zero queries, and an expired cache checks the published version
+		// in the background. Empty-redirect sites cache an empty Map + array.
+		const cached = await loadCachedRedirects(createRedirectSource(db));
 
 		// 1. Exact match (O(1) Map lookup)
 		let exact = cached.exact.get(pathname);
@@ -83,7 +96,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			// Terminal statuses (410 Gone / 451): serve the status directly,
 			// with no Location header.
 			if (isTerminalStatus(exact.type)) {
-				repo.recordHit(exact.id).catch(() => {});
+				recordHitInBackground(repo, exact.id);
 				return new Response(null, { status: exact.type });
 			}
 			const dest = exact.destination;
@@ -91,7 +104,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				warnUnsafeDestination(exact.id);
 				return next();
 			}
-			repo.recordHit(exact.id).catch(() => {});
+			recordHitInBackground(repo, exact.id);
 			const code = isRedirectCode(exact.type) ? exact.type : 301;
 			return context.redirect(dest, code);
 		}
@@ -102,14 +115,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			const { redirect, destination } = patternMatch;
 			// Terminal statuses (410 Gone / 451): serve the status directly.
 			if (isTerminalStatus(redirect.type)) {
-				repo.recordHit(redirect.id).catch(() => {});
+				recordHitInBackground(repo, redirect.id);
 				return new Response(null, { status: redirect.type });
 			}
 			if (!isSiteRelativeDestination(destination)) {
 				warnUnsafeDestination(redirect.id);
 				return next();
 			}
-			repo.recordHit(redirect.id).catch(() => {});
+			recordHitInBackground(repo, redirect.id);
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
 			return context.redirect(destination, code);
 		}
@@ -117,12 +130,21 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// No redirect matched -- proceed and check for 404
 		const response = await next();
 
-		// Log misses (fire-and-forget) under the path the visitor requested.
-		// Two shapes count as a miss: an unmatched route rendering the error
-		// page with status 404, and a matched route answering a content miss
-		// with a redirect to /404 (the documented template pattern) — there the
-		// missed path exists only on this first pass, before the browser
-		// follows the redirect. The error page itself is never logged: /404
+		// Keep a 404 out of the route cache: publishing the missing entry later
+		// purges content tags, not the missed path, so a cached 404 would outlive
+		// the fix. Astro has no cache handle for URLs that match no route, but a
+		// page answering a content miss with Astro.rewrite("/404") has one.
+		if (response.status === 404) {
+			const routeCache: APIContext["cache"] | undefined = context.cache;
+			routeCache?.set(false);
+		}
+
+		// Log misses under the path the visitor requested.
+		// Two shapes count as a miss: a 404 response (an unmatched route, or a
+		// page answering a content miss with Astro.rewrite("/404")), and a
+		// matched route answering a content miss with a redirect to /404 —
+		// there the missed path exists only on this first pass, before the
+		// browser follows the redirect. The error page itself is never logged: /404
 		// answers 404 by design and carries no path information.
 		const location = response.headers.get("location");
 		const missedByRedirect =
@@ -131,13 +153,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		if (missedDirectly || missedByRedirect) {
 			const referrer = context.request.headers.get("referer") ?? null;
 			const userAgent = context.request.headers.get("user-agent") ?? null;
-			repo
-				.log404({
-					path: pathname,
-					referrer,
-					userAgent,
-				})
-				.catch(() => {});
+			after(async () => {
+				try {
+					await repo.log404({
+						path: pathname,
+						referrer,
+						userAgent,
+					});
+				} catch (error) {
+					console.error("[emdash:redirects] failed to log 404:", error);
+				}
+			});
 		}
 
 		return response;