emdash 1.0.1 → 1.2.0

package/dist/astro/routes/api/auth/logout.mjs

@@ -1,9 +1,9 @@
-import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import { n as apiSuccess, r as handleError } from "../../../../error-DIYXAVk4.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-9DbtxSNG.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import { n as apiSuccess, r as handleError } from "../../../../error-DxgQdaZ_.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-BguJ00Pv.mjs";
 
 //#region src/astro/routes/api/auth/logout.ts
 const prerender = false;

package/dist/astro/routes/api/auth/magic-link/send.mjs

@@ -1,26 +1,27 @@
 import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
-import "../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import "../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../comments-zrTgWBSg.mjs";
-import { T as magicLinkSendBody } from "../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../status-C6IrSLMT.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import { T as magicLinkSendBody } from "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-C0eHXPd-.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-wEYRMHBv.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-D0BcE76H.mjs";
-import { t as resolveEmailLocale } from "../../../../../email-locale-B4X9LXe9.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-d4Tk6biT.mjs";
+import { n as getSiteBaseUrl } from "../../../../../site-url-CrDZaAvo.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-Dvamvay-.mjs";
+import { t as resolveEmailLocale } from "../../../../../email-locale-DFdUA6UF.mjs";
 import { sendMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { getMagicLinkEmailStrings } from "@emdash-cms/admin/locales/emails";

package/dist/astro/routes/api/auth/magic-link/send.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { getMagicLinkEmailStrings } from \"@emdash-cms/admin/locales/emails\";\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { resolveEmailLocale } from \"#api/email-locale.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteOptions = await options.getMany<string>([\"emdash:site_title\", \"emdash:locale\"]);\n\t\tconst siteName = siteOptions.get(\"emdash:site_title\") ?? \"EmDash\";\n\n\t\t// Localized copy following the site locale; the locale also\n\t\t// drives lang/dir on the email HTML so RTL copy renders correctly.\n\t\tconst emailLocale = resolveEmailLocale(siteOptions.get(\"emdash:locale\"), request);\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\temailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),\n\t\t\temailLocale,\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EACvE,MAAM,cAAc,MAAM,QAAQ,QAAgB,CAAC,qBAAqB,gBAAgB,CAAC;EACzF,MAAM,WAAW,YAAY,IAAI,oBAAoB,IAAI;EAIzD,MAAM,cAAc,mBAAmB,YAAY,IAAI,gBAAgB,EAAE,QAAQ;AAWjF,QAAM,cAV0B;GAC/B;GACA;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,cAAc,MAAM,yBAAyB,aAAa,SAAS;GACnE;GACA,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}
+{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { getMagicLinkEmailStrings } from \"@emdash-cms/admin/locales/emails\";\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { resolveEmailLocale } from \"#api/email-locale.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteOptions = await options.getMany<string>([\"emdash:site_title\", \"emdash:locale\"]);\n\t\tconst siteName = siteOptions.get(\"emdash:site_title\") ?? \"EmDash\";\n\n\t\t// Localized copy following the site locale; the locale also\n\t\t// drives lang/dir on the email HTML so RTL copy renders correctly.\n\t\tconst emailLocale = resolveEmailLocale(siteOptions.get(\"emdash:locale\"), request);\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\temailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),\n\t\t\temailLocale,\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EACvE,MAAM,cAAc,MAAM,QAAQ,QAAgB,CAAC,qBAAqB,gBAAgB,CAAC;EACzF,MAAM,WAAW,YAAY,IAAI,oBAAoB,IAAI;EAIzD,MAAM,cAAc,mBAAmB,YAAY,IAAI,gBAAgB,EAAE,QAAQ;AAWjF,QAAM,cAV0B;GAC/B;GACA;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,cAAc,MAAM,yBAAyB,aAAa,SAAS;GACnE;GACA,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}

package/dist/astro/routes/api/auth/magic-link/verify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"mappings":";;;cAca,SAAA;AAAA,cAWA,GAAA,EAAK,QAAA;AAAA,cAYL,IAAA,EAAM,QAAA"}
+{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"mappings":";;;cAea,SAAA;AAAA,cAYA,GAAA,EAAK,QAAA;AAAA,cAYL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/magic-link/verify.mjs

@@ -1,23 +1,23 @@
 import "../../../../../config-CvmjJcVw.mjs";
-import "../../../../../after-PcEvMY_6.mjs";
-import "../../../../../base64-DvnNgP7e.mjs";
+import { t as after } from "../../../../../after-PcEvMY_6.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import "../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../comments-zrTgWBSg.mjs";
-import { E as magicLinkVerifyBody } from "../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../status-C6IrSLMT.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import { E as magicLinkVerifyBody } from "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as sessionUnavailableError } from "../../../../../session-user-C6IEjuty.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-1dtJc2zv.mjs";
 import { MagicLinkError, verifyMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
@@ -40,7 +40,13 @@ const POST = async ({ request, locals, session }) => {
 		if (isParseError(body)) return body;
 		const adapter = createKyselyAdapter(emdash.db);
 		const user = await verifyMagicLink(adapter, body.token);
-		adapter.deleteExpiredTokens().catch(() => {});
+		after(async () => {
+			try {
+				await adapter.deleteExpiredTokens();
+			} catch (error) {
+				console.error("[magic-link] failed to delete expired tokens:", error);
+			}
+		});
 		session.set("user", { id: user.id });
 		return apiSuccess({ success: true });
 	} catch (error) {

package/dist/astro/routes/api/auth/magic-link/verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"sourcesContent":["/**\n * GET  /_emdash/api/auth/magic-link/verify\n * POST /_emdash/api/auth/magic-link/verify\n *\n * GET is the link in the email. It only forwards to the admin confirmation\n * page, because mail scanners fetch every link in a message and would\n * otherwise use up the single-use token before the recipient clicks.\n *\n * POST verifies the token and creates the session.\n * Tokens are single-use and expire after 15 minutes.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { verifyMagicLink, MagicLinkError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkVerifyBody } from \"#api/schemas.js\";\n\nimport { sessionUnavailableError } from \"../../../../session-user.js\";\n\nexport const GET: APIRoute = async ({ url, redirect }) => {\n\tconst token = url.searchParams.get(\"token\");\n\tif (!token) {\n\t\treturn redirect(\"/_emdash/admin/login?error=missing_token\");\n\t}\n\n\tconst confirmUrl = new URLSearchParams({ token });\n\tconst rawRedirect = url.searchParams.get(\"redirect\");\n\tif (rawRedirect) confirmUrl.set(\"redirect\", rawRedirect);\n\treturn redirect(`/_emdash/admin/login/magic-link?${confirmUrl.toString()}`);\n};\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!session) return sessionUnavailableError();\n\n\ttry {\n\t\tconst body = await parseBody(request, magicLinkVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await verifyMagicLink(adapter, body.token);\n\n\t\t// Fire-and-forget cleanup of expired tokens -- prevents accumulation\n\t\tvoid adapter.deleteExpiredTokens().catch(() => {});\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\tif (error instanceof MagicLinkError) {\n\t\t\tconst statusMap: Record<MagicLinkError[\"code\"], number> = {\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_not_found: 404,\n\t\t\t\temail_not_configured: 500,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code]);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to verify magic link\", \"MAGIC_LINK_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAWzB,MAAa,MAAgB,OAAO,EAAE,KAAK,eAAe;CACzD,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAC3C,KAAI,CAAC,MACJ,QAAO,SAAS,2CAA2C;CAG5D,MAAM,aAAa,IAAI,gBAAgB,EAAE,OAAO,CAAC;CACjD,MAAM,cAAc,IAAI,aAAa,IAAI,WAAW;AACpD,KAAI,YAAa,YAAW,IAAI,YAAY,YAAY;AACxD,QAAO,SAAS,mCAAmC,WAAW,UAAU,GAAG;;AAG5E,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,QAAS,QAAO,yBAAyB;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB;AAC1D,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,OAAO,MAAM,gBAAgB,SAAS,KAAK,MAAM;AAGvD,EAAK,QAAQ,qBAAqB,CAAC,YAAY,GAAG;AAElD,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAEpC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,MAAI,iBAAiB,eAOpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SANU;GACzD,eAAe;GACf,eAAe;GACf,gBAAgB;GAChB,sBAAsB;GACtB,CACkE,MAAM,MAAM;AAGhF,SAAO,YAAY,OAAO,+BAA+B,0BAA0B"}
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"sourcesContent":["/**\n * GET  /_emdash/api/auth/magic-link/verify\n * POST /_emdash/api/auth/magic-link/verify\n *\n * GET is the link in the email. It only forwards to the admin confirmation\n * page, because mail scanners fetch every link in a message and would\n * otherwise use up the single-use token before the recipient clicks.\n *\n * POST verifies the token and creates the session.\n * Tokens are single-use and expire after 15 minutes, or 5 minutes for\n * sign-in handover links.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { verifyMagicLink, MagicLinkError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkVerifyBody } from \"#api/schemas.js\";\n\nimport { after } from \"../../../../../after.js\";\nimport { sessionUnavailableError } from \"../../../../session-user.js\";\n\nexport const GET: APIRoute = async ({ url, redirect }) => {\n\tconst token = url.searchParams.get(\"token\");\n\tif (!token) {\n\t\treturn redirect(\"/_emdash/admin/login?error=missing_token\");\n\t}\n\n\tconst confirmUrl = new URLSearchParams({ token });\n\tconst rawRedirect = url.searchParams.get(\"redirect\");\n\tif (rawRedirect) confirmUrl.set(\"redirect\", rawRedirect);\n\treturn redirect(`/_emdash/admin/login/magic-link?${confirmUrl.toString()}`);\n};\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!session) return sessionUnavailableError();\n\n\ttry {\n\t\tconst body = await parseBody(request, magicLinkVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await verifyMagicLink(adapter, body.token);\n\n\t\t// Cleanup of expired tokens -- prevents accumulation\n\t\tafter(async () => {\n\t\t\ttry {\n\t\t\t\tawait adapter.deleteExpiredTokens();\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\"[magic-link] failed to delete expired tokens:\", error);\n\t\t\t}\n\t\t});\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\tif (error instanceof MagicLinkError) {\n\t\t\tconst statusMap: Record<MagicLinkError[\"code\"], number> = {\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_not_found: 404,\n\t\t\t\temail_not_configured: 500,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code]);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to verify magic link\", \"MAGIC_LINK_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAYzB,MAAa,MAAgB,OAAO,EAAE,KAAK,eAAe;CACzD,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAC3C,KAAI,CAAC,MACJ,QAAO,SAAS,2CAA2C;CAG5D,MAAM,aAAa,IAAI,gBAAgB,EAAE,OAAO,CAAC;CACjD,MAAM,cAAc,IAAI,aAAa,IAAI,WAAW;AACpD,KAAI,YAAa,YAAW,IAAI,YAAY,YAAY;AACxD,QAAO,SAAS,mCAAmC,WAAW,UAAU,GAAG;;AAG5E,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,QAAS,QAAO,yBAAyB;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB;AAC1D,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,OAAO,MAAM,gBAAgB,SAAS,KAAK,MAAM;AAGvD,QAAM,YAAY;AACjB,OAAI;AACH,UAAM,QAAQ,qBAAqB;YAC3B,OAAO;AACf,YAAQ,MAAM,iDAAiD,MAAM;;IAErE;AAEF,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAEpC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,MAAI,iBAAiB,eAOpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SANU;GACzD,eAAe;GACf,eAAe;GACf,gBAAgB;GAChB,sBAAsB;GACtB,CACkE,MAAM,MAAM;AAGhF,SAAO,YAAY,OAAO,+BAA+B,0BAA0B"}

package/dist/astro/routes/api/auth/me.mjs

@@ -1,21 +1,21 @@
 import "../../../../config-CvmjJcVw.mjs";
-import "../../../../base64-DvnNgP7e.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import { t as UserRepository } from "../../../../user-BOvuF1sQ.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import "../../../../settings-CwcrX-Ay.mjs";
-import "../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-5Y0W39xR.mjs";
-import "../../../../redirects-1nhdEaTq.mjs";
-import "../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../media-Bs6qmlVl.mjs";
-import "../../../../comments-zrTgWBSg.mjs";
-import { x as authMeActionBody } from "../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../menus-mC_XTxD7.mjs";
-import "../../../../status-C6IrSLMT.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import { t as UserRepository } from "../../../../user-B-ZdGjhI.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import "../../../../settings-GaZ5sVgg.mjs";
+import "../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-Cn5aSk1N.mjs";
+import "../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../media-CRKsKlfK.mjs";
+import "../../../../comments-BzmIKVb2.mjs";
+import { x as authMeActionBody } from "../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../menus-D1HC8npj.mjs";
+import "../../../../status-Dl85BK39.mjs";
 import "../../../../api/schemas/index.mjs";
 
 //#region src/astro/routes/api/auth/me.ts

package/dist/astro/routes/api/auth/mode.mjs

@@ -1,9 +1,9 @@
-import "../../../../base64-DvnNgP7e.mjs";
-import "../../../../types-j6MBDjlZ.mjs";
-import "../../../../errors-CjXd1LgH.mjs";
-import "../../../../errors-CNvATh_7.mjs";
-import { n as apiSuccess } from "../../../../error-DIYXAVk4.mjs";
-import { t as getAuthMode } from "../../../../mode-B9-gMXL9.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
+import "../../../../types-C-Xp0CcN.mjs";
+import "../../../../errors-CjtE5aWF.mjs";
+import "../../../../errors-hskQ0C8G.mjs";
+import { n as apiSuccess } from "../../../../error-DxgQdaZ_.mjs";
+import { t as getAuthMode } from "../../../../mode-eieqAWLe.mjs";
 
 //#region src/astro/routes/api/auth/mode.ts
 const prerender = false;

package/dist/astro/routes/api/auth/oauth/_provider_/callback.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAwEA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"callback.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"mappings":";;;cAQa,SAAA;AAAA,cAyHA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs

@@ -1,21 +1,25 @@
 import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
 import "../../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
-import "../../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../../errors-CNvATh_7.mjs";
-import "../../../../../../error-DIYXAVk4.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-7j0cpCFc.mjs";
-import { t as SESSION_UNAVAILABLE_MESSAGE } from "../../../../../../session-user-C6IEjuty.mjs";
-import { n as finalizeSetup } from "../../../../../../setup-complete-BOrI10UY.mjs";
-import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-CxXTjXdI.mjs";
-import { OAuthError, Role, handleOAuthCallback } from "@emdash-cms/auth";
+import "../../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../../error-DxgQdaZ_.mjs";
+import { i as getPublicOrigin } from "../../../../../../public-url-uT1Ok2Tu.mjs";
+import { t as SESSION_UNAVAILABLE_MESSAGE } from "../../../../../../session-user-1dtJc2zv.mjs";
+import { n as finalizeSetup } from "../../../../../../setup-complete-DidMAWJS.mjs";
+import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-CnmYYsVQ.mjs";
+import { OAuthError, Role, handleOAuthCallback, isValidMicrosoftTenant } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/oauth/[provider]/callback.ts
 const prerender = false;
-const VALID_PROVIDERS = new Set(["github", "google"]);
+const VALID_PROVIDERS = new Set([
+	"github",
+	"google",
+	"microsoft"
+]);
 function isValidProvider(provider) {
 	return VALID_PROVIDERS.has(provider);
 }
@@ -27,9 +31,16 @@ function envString(env, ...keys) {
 	}
 }
 /**
+* The `emailVerified` option passed to `microsoft()` in the site config
+*/
+function getMicrosoftEmailVerified(authProviders) {
+	const options = authProviders?.find((p) => p.id === "microsoft")?.config;
+	if (options && typeof options === "object" && "emailVerified" in options && typeof options.emailVerified === "boolean") return options.emailVerified;
+}
+/**
 * Get OAuth config from environment variables
 */
-function getOAuthConfig(env) {
+function getOAuthConfig(env, microsoftEmailVerified) {
 	const providers = {};
 	const githubClientId = envString(env, "EMDASH_OAUTH_GITHUB_CLIENT_ID", "GITHUB_CLIENT_ID");
 	const githubClientSecret = envString(env, "EMDASH_OAUTH_GITHUB_CLIENT_SECRET", "GITHUB_CLIENT_SECRET");
@@ -43,6 +54,15 @@ function getOAuthConfig(env) {
 		clientId: googleClientId,
 		clientSecret: googleClientSecret
 	};
+	const microsoftClientId = envString(env, "EMDASH_OAUTH_MICROSOFT_CLIENT_ID", "MICROSOFT_CLIENT_ID");
+	const microsoftClientSecret = envString(env, "EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET", "MICROSOFT_CLIENT_SECRET");
+	const microsoftTenant = envString(env, "EMDASH_OAUTH_MICROSOFT_TENANT_ID", "MICROSOFT_TENANT_ID");
+	if (microsoftClientId && microsoftClientSecret && microsoftTenant && isValidMicrosoftTenant(microsoftTenant)) providers.microsoft = {
+		clientId: microsoftClientId,
+		clientSecret: microsoftClientSecret,
+		tenant: microsoftTenant,
+		emailVerified: microsoftEmailVerified
+	};
 	return providers;
 }
 const GET = async ({ params, request, locals, session, redirect }) => {
@@ -62,7 +82,7 @@ const GET = async ({ params, request, locals, session, redirect }) => {
 	if (!code || !state) return redirect(`/_emdash/admin/login?error=invalid_callback&message=${encodeURIComponent("Missing code or state parameter")}`);
 	try {
 		const { env: cfEnv } = await import("virtual:emdash/env");
-		const providers = getOAuthConfig(cfEnv ?? import.meta.env);
+		const providers = getOAuthConfig(cfEnv ?? import.meta.env, getMicrosoftEmailVerified(emdash.config.authProviders));
 		if (!providers[provider]) return redirect(`/_emdash/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`);
 		if (!session) return redirect(`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(SESSION_UNAVAILABLE_MESSAGE)}`);
 		const adapter = createKyselyAdapter(emdash.db);
@@ -135,6 +155,9 @@ const GET = async ({ params, request, locals, session, redirect }) => {
 				case "profile_fetch_failed":
 					message = "Failed to retrieve your profile. Please try again.";
 					break;
+				case "id_token_invalid":
+					message = "Could not verify your sign-in with the provider. Please try again.";
+					break;
 				default:
 					message = "Authentication failed. Please try again.";
 					break;

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"callback.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/oauth/[provider]/callback\n *\n * Handle OAuth callback from provider\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport {\n\thandleOAuthCallback,\n\tOAuthError,\n\tRole,\n\ttype OAuthConsumerConfig,\n\ttype RoleLevel,\n} from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { finalizeSetup } from \"#api/setup-complete.js\";\nimport { createOAuthStateStore } from \"#auth/oauth-state-store.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nimport { SESSION_UNAVAILABLE_MESSAGE } from \"../../../../../session-user.js\";\n\ntype ProviderName = \"github\" | \"google\";\n\nconst VALID_PROVIDERS = new Set<string>([\"github\", \"google\"]);\n\nfunction isValidProvider(provider: string): provider is ProviderName {\n\treturn VALID_PROVIDERS.has(provider);\n}\n\n/** Safely extract a string value from an env-like record */\nfunction envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst val = env[key];\n\t\tif (typeof val === \"string\" && val) return val;\n\t}\n\treturn undefined;\n}\n\n/**\n * Get OAuth config from environment variables\n */\nfunction getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig[\"providers\"] {\n\tconst providers: OAuthConsumerConfig[\"providers\"] = {};\n\n\t// GitHub\n\tconst githubClientId = envString(env, \"EMDASH_OAUTH_GITHUB_CLIENT_ID\", \"GITHUB_CLIENT_ID\");\n\tconst githubClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GITHUB_CLIENT_SECRET\",\n\t\t\"GITHUB_CLIENT_SECRET\",\n\t);\n\tif (githubClientId && githubClientSecret) {\n\t\tproviders.github = {\n\t\t\tclientId: githubClientId,\n\t\t\tclientSecret: githubClientSecret,\n\t\t};\n\t}\n\n\t// Google\n\tconst googleClientId = envString(env, \"EMDASH_OAUTH_GOOGLE_CLIENT_ID\", \"GOOGLE_CLIENT_ID\");\n\tconst googleClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GOOGLE_CLIENT_SECRET\",\n\t\t\"GOOGLE_CLIENT_SECRET\",\n\t);\n\tif (googleClientId && googleClientSecret) {\n\t\tproviders.google = {\n\t\t\tclientId: googleClientId,\n\t\t\tclientSecret: googleClientSecret,\n\t\t};\n\t}\n\n\treturn providers;\n}\n\nexport const GET: APIRoute = async ({ params, request, locals, session, redirect }) => {\n\tconst { emdash } = locals;\n\tconst provider = params.provider;\n\n\t// Validate provider\n\tif (!provider || !isValidProvider(provider)) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_provider&message=${encodeURIComponent(\"Invalid OAuth provider\")}`,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(\"Database not configured\")}`,\n\t\t);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst code = url.searchParams.get(\"code\");\n\tconst state = url.searchParams.get(\"state\");\n\tconst error = url.searchParams.get(\"error\");\n\tconst errorDescription = url.searchParams.get(\"error_description\");\n\n\t// Handle OAuth errors from provider\n\tif (error) {\n\t\tconst message = errorDescription || error;\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=oauth_denied&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n\n\t// Validate required params\n\tif (!code || !state) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_callback&message=${encodeURIComponent(\"Missing code or state parameter\")}`,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Get OAuth providers from environment. Astro 6 removed\n\t\t// `Astro.locals.runtime.env` (accessing it throws rather than\n\t\t// returning undefined, so optional-chaining doesn't help) -- read\n\t\t// Cloudflare bindings via the emdash virtual module instead, which\n\t\t// re-exports `cloudflare:workers`' `env` under that adapter and\n\t\t// falls back to `import.meta.env` on Node (#1736).\n\t\t// @ts-ignore - virtual module, generated by the Astro integration\n\t\tconst { env: cfEnv } = (await import(\"virtual:emdash/env\")) as {\n\t\t\tenv?: Record<string, unknown>;\n\t\t};\n\t\tconst env = cfEnv ?? import.meta.env;\n\t\tconst providers = getOAuthConfig(env);\n\n\t\tif (!providers[provider]) {\n\t\t\treturn redirect(\n\t\t\t\t`/_emdash/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`,\n\t\t\t);\n\t\t}\n\n\t\tif (!session) {\n\t\t\treturn redirect(\n\t\t\t\t`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(SESSION_UNAVAILABLE_MESSAGE)}`,\n\t\t\t);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst stateStore = createOAuthStateStore(emdash.db);\n\n\t\tconst config: OAuthConsumerConfig = {\n\t\t\tbaseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,\n\t\t\tproviders,\n\t\t\tcanSelfSignup: async (email: string) => {\n\t\t\t\t// During setup: first user becomes admin.\n\t\t\t\t// Check setup_complete flag instead of countUsers() to avoid\n\t\t\t\t// a TOCTOU race where concurrent callbacks both see 0 users.\n\t\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\t\t\t\tif (setupComplete !== true && setupComplete !== \"true\") {\n\t\t\t\t\treturn { allowed: true, role: Role.ADMIN };\n\t\t\t\t}\n\n\t\t\t\t// Extract domain from email\n\t\t\t\tconst domain = email.split(\"@\")[1]?.toLowerCase();\n\t\t\t\tif (!domain) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Check allowed_domains table for a matching, enabled entry\n\t\t\t\tconst entry = await emdash.db\n\t\t\t\t\t.selectFrom(\"allowed_domains\")\n\t\t\t\t\t.selectAll()\n\t\t\t\t\t.where(\"domain\", \"=\", domain)\n\t\t\t\t\t.where(\"enabled\", \"=\", 1)\n\t\t\t\t\t.executeTakeFirst();\n\n\t\t\t\tif (!entry) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Map the stored role level to the Role enum\n\t\t\t\tconst roleLevel = entry.default_role;\n\t\t\t\tconst roleMap: Record<number, RoleLevel> = {\n\t\t\t\t\t50: Role.ADMIN,\n\t\t\t\t\t40: Role.EDITOR,\n\t\t\t\t\t30: Role.AUTHOR,\n\t\t\t\t\t20: Role.CONTRIBUTOR,\n\t\t\t\t\t10: Role.SUBSCRIBER,\n\t\t\t\t};\n\t\t\t\tconst role = roleMap[roleLevel] ?? Role.CONTRIBUTOR;\n\t\t\t\tif (!roleMap[roleLevel]) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`[oauth] Unknown role level ${roleLevel} for domain ${domain}, defaulting to CONTRIBUTOR`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn { allowed: true, role };\n\t\t\t},\n\t\t};\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupCompleteBefore = await options.get(\"emdash:setup_complete\");\n\t\tconst user = await handleOAuthCallback(config, adapter, provider, code, state, stateStore);\n\t\tconst isFirstUser = setupCompleteBefore !== true && setupCompleteBefore !== \"true\";\n\n\t\t// Finalize setup outside the transaction (idempotent, safe if two callbacks race).\n\t\tif (isFirstUser) {\n\t\t\tawait finalizeSetup(emdash.db);\n\t\t\tconsole.log(`[oauth] Setup complete: created admin user via ${provider} (${user.email})`);\n\t\t}\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\t// Redirect to admin dashboard\n\t\treturn redirect(\"/_emdash/admin\");\n\t} catch (callbackError) {\n\t\tconsole.error(\"OAuth callback error:\", callbackError);\n\n\t\tlet message = \"Authentication failed\";\n\t\tlet errorCode = \"oauth_error\";\n\n\t\tif (callbackError instanceof OAuthError) {\n\t\t\terrorCode = callbackError.code;\n\n\t\t\t// Map all error codes to user-friendly messages (never expose raw error.message)\n\t\t\tswitch (callbackError.code) {\n\t\t\t\tcase \"invalid_state\":\n\t\t\t\t\tmessage = \"OAuth session expired or invalid. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"signup_not_allowed\":\n\t\t\t\t\tmessage = \"Self-signup is not allowed for your email. Please contact an administrator.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_invalid\":\n\t\t\t\t\tmessage = \"This invite link is invalid or has expired. Please ask for a new one.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_mismatch\":\n\t\t\t\t\tmessage = \"This invite was sent to a different email address than your account.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_unverified\":\n\t\t\t\t\tmessage =\n\t\t\t\t\t\t\"Your account's email is not verified by the provider. Please verify it and try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"user_not_found\":\n\t\t\t\t\tmessage = \"Your account was not found. It may have been deleted.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"token_exchange_failed\":\n\t\t\t\t\tmessage = \"Failed to complete authentication. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"profile_fetch_failed\":\n\t\t\t\t\tmessage = \"Failed to retrieve your profile. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\tmessage = \"Authentication failed. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\t// For generic errors, keep the default \"Authentication failed\" message\n\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=${errorCode}&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAoBzB,MAAM,kBAAkB,IAAI,IAAY,CAAC,UAAU,SAAS,CAAC;AAE7D,SAAS,gBAAgB,UAA4C;AACpE,QAAO,gBAAgB,IAAI,SAAS;;;AAIrC,SAAS,UAAU,KAA8B,GAAG,MAAoC;AACvF,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,IAAK,QAAO;;;;;;AAQ7C,SAAS,eAAe,KAAgE;CACvF,MAAM,YAA8C,EAAE;CAGtD,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;AAGF,QAAO;;AAGR,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,eAAe;CACtF,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,OAAO;AAGxB,KAAI,CAAC,YAAY,CAAC,gBAAgB,SAAS,CAC1C,QAAO,SACN,uDAAuD,mBAAmB,yBAAyB,GACnG;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SACN,mDAAmD,mBAAmB,0BAA0B,GAChG;CAGF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,mBAAmB,IAAI,aAAa,IAAI,oBAAoB;AAGlE,KAAI,OAAO;EACV,MAAM,UAAU,oBAAoB;AACpC,SAAO,SACN,mDAAmD,mBAAmB,QAAQ,GAC9E;;AAIF,KAAI,CAAC,QAAQ,CAAC,MACb,QAAO,SACN,uDAAuD,mBAAmB,kCAAkC,GAC5G;AAGF,KAAI;EAQH,MAAM,EAAE,KAAK,UAAW,MAAM,OAAO;EAIrC,MAAM,YAAY,eADN,SAAS,OAAO,KAAK,IACI;AAErC,MAAI,CAAC,UAAU,UACd,QAAO,SACN,8DAA8D,mBAAmB,kBAAkB,SAAS,oBAAoB,GAChI;AAGF,MAAI,CAAC,QACJ,QAAO,SACN,mDAAmD,mBAAmB,4BAA4B,GAClG;EAGF,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,aAAa,sBAAsB,OAAO,GAAG;EAEnD,MAAM,SAA8B;GACnC,SAAS,GAAG,gBAAgB,KAAK,QAAQ,OAAO,CAAC;GACjD;GACA,eAAe,OAAO,UAAkB;IAKvC,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAChE,QAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO;KAAE,SAAS;KAAM,MAAM,KAAK;KAAO;IAI3C,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,IAAI,aAAa;AACjD,QAAI,CAAC,OACJ,QAAO;IAIR,MAAM,QAAQ,MAAM,OAAO,GACzB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,UAAU,KAAK,OAAO,CAC5B,MAAM,WAAW,KAAK,EAAE,CACxB,kBAAkB;AAEpB,QAAI,CAAC,MACJ,QAAO;IAIR,MAAM,YAAY,MAAM;IACxB,MAAM,UAAqC;KAC1C,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT;IACD,MAAM,OAAO,QAAQ,cAAc,KAAK;AACxC,QAAI,CAAC,QAAQ,WACZ,SAAQ,KACP,8BAA8B,UAAU,cAAc,OAAO,6BAC7D;AAGF,WAAO;KAAE,SAAS;KAAM;KAAM;;GAE/B;EAGD,MAAM,sBAAsB,MADZ,IAAI,kBAAkB,OAAO,GAAG,CACN,IAAI,wBAAwB;EACtE,MAAM,OAAO,MAAM,oBAAoB,QAAQ,SAAS,UAAU,MAAM,OAAO,WAAW;AAI1F,MAHoB,wBAAwB,QAAQ,wBAAwB,QAG3D;AAChB,SAAM,cAAc,OAAO,GAAG;AAC9B,WAAQ,IAAI,kDAAkD,SAAS,IAAI,KAAK,MAAM,GAAG;;AAG1F,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAGpC,SAAO,SAAS,iBAAiB;UACzB,eAAe;AACvB,UAAQ,MAAM,yBAAyB,cAAc;EAErD,IAAI,UAAU;EACd,IAAI,YAAY;AAEhB,MAAI,yBAAyB,YAAY;AACxC,eAAY,cAAc;AAG1B,WAAQ,cAAc,MAAtB;IACC,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eACC;AACD;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD;AACC,eAAU;AACV;;;AAKH,SAAO,SACN,8BAA8B,UAAU,WAAW,mBAAmB,QAAQ,GAC9E"}
+{"version":3,"file":"callback.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/auth/oauth/[provider]/callback.ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/oauth/[provider]/callback\n *\n * Handle OAuth callback from provider\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport {\n\thandleOAuthCallback,\n\tOAuthError,\n\tRole,\n\tisValidMicrosoftTenant,\n\ttype OAuthConsumerConfig,\n\ttype RoleLevel,\n} from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { finalizeSetup } from \"#api/setup-complete.js\";\nimport { createOAuthStateStore } from \"#auth/oauth-state-store.js\";\nimport type { AuthProviderDescriptor } from \"#auth/types.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nimport { SESSION_UNAVAILABLE_MESSAGE } from \"../../../../../session-user.js\";\n\ntype ProviderName = \"github\" | \"google\" | \"microsoft\";\n\nconst VALID_PROVIDERS = new Set<string>([\"github\", \"google\", \"microsoft\"]);\n\nfunction isValidProvider(provider: string): provider is ProviderName {\n\treturn VALID_PROVIDERS.has(provider);\n}\n\n/** Safely extract a string value from an env-like record */\nfunction envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst val = env[key];\n\t\tif (typeof val === \"string\" && val) return val;\n\t}\n\treturn undefined;\n}\n\n/**\n * The `emailVerified` option passed to `microsoft()` in the site config\n */\nfunction getMicrosoftEmailVerified(\n\tauthProviders: AuthProviderDescriptor[] | undefined,\n): boolean | undefined {\n\tconst options = authProviders?.find((p) => p.id === \"microsoft\")?.config;\n\tif (\n\t\toptions &&\n\t\ttypeof options === \"object\" &&\n\t\t\"emailVerified\" in options &&\n\t\ttypeof options.emailVerified === \"boolean\"\n\t) {\n\t\treturn options.emailVerified;\n\t}\n\treturn undefined;\n}\n\n/**\n * Get OAuth config from environment variables\n */\nfunction getOAuthConfig(\n\tenv: Record<string, unknown>,\n\tmicrosoftEmailVerified: boolean | undefined,\n): OAuthConsumerConfig[\"providers\"] {\n\tconst providers: OAuthConsumerConfig[\"providers\"] = {};\n\n\t// GitHub\n\tconst githubClientId = envString(env, \"EMDASH_OAUTH_GITHUB_CLIENT_ID\", \"GITHUB_CLIENT_ID\");\n\tconst githubClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GITHUB_CLIENT_SECRET\",\n\t\t\"GITHUB_CLIENT_SECRET\",\n\t);\n\tif (githubClientId && githubClientSecret) {\n\t\tproviders.github = {\n\t\t\tclientId: githubClientId,\n\t\t\tclientSecret: githubClientSecret,\n\t\t};\n\t}\n\n\t// Google\n\tconst googleClientId = envString(env, \"EMDASH_OAUTH_GOOGLE_CLIENT_ID\", \"GOOGLE_CLIENT_ID\");\n\tconst googleClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GOOGLE_CLIENT_SECRET\",\n\t\t\"GOOGLE_CLIENT_SECRET\",\n\t);\n\tif (googleClientId && googleClientSecret) {\n\t\tproviders.google = {\n\t\t\tclientId: googleClientId,\n\t\t\tclientSecret: googleClientSecret,\n\t\t};\n\t}\n\n\t// Microsoft\n\tconst microsoftClientId = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_MICROSOFT_CLIENT_ID\",\n\t\t\"MICROSOFT_CLIENT_ID\",\n\t);\n\tconst microsoftClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET\",\n\t\t\"MICROSOFT_CLIENT_SECRET\",\n\t);\n\tconst microsoftTenant = envString(env, \"EMDASH_OAUTH_MICROSOFT_TENANT_ID\", \"MICROSOFT_TENANT_ID\");\n\tif (\n\t\tmicrosoftClientId &&\n\t\tmicrosoftClientSecret &&\n\t\tmicrosoftTenant &&\n\t\tisValidMicrosoftTenant(microsoftTenant)\n\t) {\n\t\tproviders.microsoft = {\n\t\t\tclientId: microsoftClientId,\n\t\t\tclientSecret: microsoftClientSecret,\n\t\t\ttenant: microsoftTenant,\n\t\t\temailVerified: microsoftEmailVerified,\n\t\t};\n\t}\n\n\treturn providers;\n}\n\nexport const GET: APIRoute = async ({ params, request, locals, session, redirect }) => {\n\tconst { emdash } = locals;\n\tconst provider = params.provider;\n\n\t// Validate provider\n\tif (!provider || !isValidProvider(provider)) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_provider&message=${encodeURIComponent(\"Invalid OAuth provider\")}`,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(\"Database not configured\")}`,\n\t\t);\n\t}\n\n\tconst url = new URL(request.url);\n\tconst code = url.searchParams.get(\"code\");\n\tconst state = url.searchParams.get(\"state\");\n\tconst error = url.searchParams.get(\"error\");\n\tconst errorDescription = url.searchParams.get(\"error_description\");\n\n\t// Handle OAuth errors from provider\n\tif (error) {\n\t\tconst message = errorDescription || error;\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=oauth_denied&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n\n\t// Validate required params\n\tif (!code || !state) {\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=invalid_callback&message=${encodeURIComponent(\"Missing code or state parameter\")}`,\n\t\t);\n\t}\n\n\ttry {\n\t\t// Get OAuth providers from environment. Astro 6 removed\n\t\t// `Astro.locals.runtime.env` (accessing it throws rather than\n\t\t// returning undefined, so optional-chaining doesn't help) -- read\n\t\t// Cloudflare bindings via the emdash virtual module instead, which\n\t\t// re-exports `cloudflare:workers`' `env` under that adapter and\n\t\t// falls back to `import.meta.env` on Node (#1736).\n\t\t// @ts-ignore - virtual module, generated by the Astro integration\n\t\tconst { env: cfEnv } = (await import(\"virtual:emdash/env\")) as {\n\t\t\tenv?: Record<string, unknown>;\n\t\t};\n\t\tconst env = cfEnv ?? import.meta.env;\n\t\tconst providers = getOAuthConfig(env, getMicrosoftEmailVerified(emdash.config.authProviders));\n\n\t\tif (!providers[provider]) {\n\t\t\treturn redirect(\n\t\t\t\t`/_emdash/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`,\n\t\t\t);\n\t\t}\n\n\t\tif (!session) {\n\t\t\treturn redirect(\n\t\t\t\t`/_emdash/admin/login?error=server_error&message=${encodeURIComponent(SESSION_UNAVAILABLE_MESSAGE)}`,\n\t\t\t);\n\t\t}\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst stateStore = createOAuthStateStore(emdash.db);\n\n\t\tconst config: OAuthConsumerConfig = {\n\t\t\tbaseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,\n\t\t\tproviders,\n\t\t\tcanSelfSignup: async (email: string) => {\n\t\t\t\t// During setup: first user becomes admin.\n\t\t\t\t// Check setup_complete flag instead of countUsers() to avoid\n\t\t\t\t// a TOCTOU race where concurrent callbacks both see 0 users.\n\t\t\t\tconst options = new OptionsRepository(emdash.db);\n\t\t\t\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\t\t\t\tif (setupComplete !== true && setupComplete !== \"true\") {\n\t\t\t\t\treturn { allowed: true, role: Role.ADMIN };\n\t\t\t\t}\n\n\t\t\t\t// Extract domain from email\n\t\t\t\tconst domain = email.split(\"@\")[1]?.toLowerCase();\n\t\t\t\tif (!domain) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Check allowed_domains table for a matching, enabled entry\n\t\t\t\tconst entry = await emdash.db\n\t\t\t\t\t.selectFrom(\"allowed_domains\")\n\t\t\t\t\t.selectAll()\n\t\t\t\t\t.where(\"domain\", \"=\", domain)\n\t\t\t\t\t.where(\"enabled\", \"=\", 1)\n\t\t\t\t\t.executeTakeFirst();\n\n\t\t\t\tif (!entry) {\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\n\t\t\t\t// Map the stored role level to the Role enum\n\t\t\t\tconst roleLevel = entry.default_role;\n\t\t\t\tconst roleMap: Record<number, RoleLevel> = {\n\t\t\t\t\t50: Role.ADMIN,\n\t\t\t\t\t40: Role.EDITOR,\n\t\t\t\t\t30: Role.AUTHOR,\n\t\t\t\t\t20: Role.CONTRIBUTOR,\n\t\t\t\t\t10: Role.SUBSCRIBER,\n\t\t\t\t};\n\t\t\t\tconst role = roleMap[roleLevel] ?? Role.CONTRIBUTOR;\n\t\t\t\tif (!roleMap[roleLevel]) {\n\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t`[oauth] Unknown role level ${roleLevel} for domain ${domain}, defaulting to CONTRIBUTOR`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn { allowed: true, role };\n\t\t\t},\n\t\t};\n\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst setupCompleteBefore = await options.get(\"emdash:setup_complete\");\n\t\tconst user = await handleOAuthCallback(config, adapter, provider, code, state, stateStore);\n\t\tconst isFirstUser = setupCompleteBefore !== true && setupCompleteBefore !== \"true\";\n\n\t\t// Finalize setup outside the transaction (idempotent, safe if two callbacks race).\n\t\tif (isFirstUser) {\n\t\t\tawait finalizeSetup(emdash.db);\n\t\t\tconsole.log(`[oauth] Setup complete: created admin user via ${provider} (${user.email})`);\n\t\t}\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\t// Redirect to admin dashboard\n\t\treturn redirect(\"/_emdash/admin\");\n\t} catch (callbackError) {\n\t\tconsole.error(\"OAuth callback error:\", callbackError);\n\n\t\tlet message = \"Authentication failed\";\n\t\tlet errorCode = \"oauth_error\";\n\n\t\tif (callbackError instanceof OAuthError) {\n\t\t\terrorCode = callbackError.code;\n\n\t\t\t// Map all error codes to user-friendly messages (never expose raw error.message)\n\t\t\tswitch (callbackError.code) {\n\t\t\t\tcase \"invalid_state\":\n\t\t\t\t\tmessage = \"OAuth session expired or invalid. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"signup_not_allowed\":\n\t\t\t\t\tmessage = \"Self-signup is not allowed for your email. Please contact an administrator.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_invalid\":\n\t\t\t\t\tmessage = \"This invite link is invalid or has expired. Please ask for a new one.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_mismatch\":\n\t\t\t\t\tmessage = \"This invite was sent to a different email address than your account.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"invite_email_unverified\":\n\t\t\t\t\tmessage =\n\t\t\t\t\t\t\"Your account's email is not verified by the provider. Please verify it and try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"user_not_found\":\n\t\t\t\t\tmessage = \"Your account was not found. It may have been deleted.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"token_exchange_failed\":\n\t\t\t\t\tmessage = \"Failed to complete authentication. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"profile_fetch_failed\":\n\t\t\t\t\tmessage = \"Failed to retrieve your profile. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"id_token_invalid\":\n\t\t\t\t\tmessage = \"Could not verify your sign-in with the provider. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\tmessage = \"Authentication failed. Please try again.\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\t// For generic errors, keep the default \"Authentication failed\" message\n\n\t\treturn redirect(\n\t\t\t`/_emdash/admin/login?error=${errorCode}&message=${encodeURIComponent(message)}`,\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAQA,MAAa,YAAY;AAsBzB,MAAM,kBAAkB,IAAI,IAAY;CAAC;CAAU;CAAU;CAAY,CAAC;AAE1E,SAAS,gBAAgB,UAA4C;AACpE,QAAO,gBAAgB,IAAI,SAAS;;;AAIrC,SAAS,UAAU,KAA8B,GAAG,MAAoC;AACvF,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,IAAK,QAAO;;;;;;AAQ7C,SAAS,0BACR,eACsB;CACtB,MAAM,UAAU,eAAe,MAAM,MAAM,EAAE,OAAO,YAAY,EAAE;AAClE,KACC,WACA,OAAO,YAAY,YACnB,mBAAmB,WACnB,OAAO,QAAQ,kBAAkB,UAEjC,QAAO,QAAQ;;;;;AAQjB,SAAS,eACR,KACA,wBACmC;CACnC,MAAM,YAA8C,EAAE;CAGtD,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,oBAAoB,UACzB,KACA,oCACA,sBACA;CACD,MAAM,wBAAwB,UAC7B,KACA,wCACA,0BACA;CACD,MAAM,kBAAkB,UAAU,KAAK,oCAAoC,sBAAsB;AACjG,KACC,qBACA,yBACA,mBACA,uBAAuB,gBAAgB,CAEvC,WAAU,YAAY;EACrB,UAAU;EACV,cAAc;EACd,QAAQ;EACR,eAAe;EACf;AAGF,QAAO;;AAGR,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,eAAe;CACtF,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,OAAO;AAGxB,KAAI,CAAC,YAAY,CAAC,gBAAgB,SAAS,CAC1C,QAAO,SACN,uDAAuD,mBAAmB,yBAAyB,GACnG;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SACN,mDAAmD,mBAAmB,0BAA0B,GAChG;CAGF,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;CAC3C,MAAM,mBAAmB,IAAI,aAAa,IAAI,oBAAoB;AAGlE,KAAI,OAAO;EACV,MAAM,UAAU,oBAAoB;AACpC,SAAO,SACN,mDAAmD,mBAAmB,QAAQ,GAC9E;;AAIF,KAAI,CAAC,QAAQ,CAAC,MACb,QAAO,SACN,uDAAuD,mBAAmB,kCAAkC,GAC5G;AAGF,KAAI;EAQH,MAAM,EAAE,KAAK,UAAW,MAAM,OAAO;EAIrC,MAAM,YAAY,eADN,SAAS,OAAO,KAAK,KACK,0BAA0B,OAAO,OAAO,cAAc,CAAC;AAE7F,MAAI,CAAC,UAAU,UACd,QAAO,SACN,8DAA8D,mBAAmB,kBAAkB,SAAS,oBAAoB,GAChI;AAGF,MAAI,CAAC,QACJ,QAAO,SACN,mDAAmD,mBAAmB,4BAA4B,GAClG;EAGF,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,aAAa,sBAAsB,OAAO,GAAG;EAEnD,MAAM,SAA8B;GACnC,SAAS,GAAG,gBAAgB,KAAK,QAAQ,OAAO,CAAC;GACjD;GACA,eAAe,OAAO,UAAkB;IAKvC,MAAM,gBAAgB,MADN,IAAI,kBAAkB,OAAO,GAAG,CACZ,IAAI,wBAAwB;AAChE,QAAI,kBAAkB,QAAQ,kBAAkB,OAC/C,QAAO;KAAE,SAAS;KAAM,MAAM,KAAK;KAAO;IAI3C,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,IAAI,aAAa;AACjD,QAAI,CAAC,OACJ,QAAO;IAIR,MAAM,QAAQ,MAAM,OAAO,GACzB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,UAAU,KAAK,OAAO,CAC5B,MAAM,WAAW,KAAK,EAAE,CACxB,kBAAkB;AAEpB,QAAI,CAAC,MACJ,QAAO;IAIR,MAAM,YAAY,MAAM;IACxB,MAAM,UAAqC;KAC1C,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT,IAAI,KAAK;KACT;IACD,MAAM,OAAO,QAAQ,cAAc,KAAK;AACxC,QAAI,CAAC,QAAQ,WACZ,SAAQ,KACP,8BAA8B,UAAU,cAAc,OAAO,6BAC7D;AAGF,WAAO;KAAE,SAAS;KAAM;KAAM;;GAE/B;EAGD,MAAM,sBAAsB,MADZ,IAAI,kBAAkB,OAAO,GAAG,CACN,IAAI,wBAAwB;EACtE,MAAM,OAAO,MAAM,oBAAoB,QAAQ,SAAS,UAAU,MAAM,OAAO,WAAW;AAI1F,MAHoB,wBAAwB,QAAQ,wBAAwB,QAG3D;AAChB,SAAM,cAAc,OAAO,GAAG;AAC9B,WAAQ,IAAI,kDAAkD,SAAS,IAAI,KAAK,MAAM,GAAG;;AAG1F,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAGpC,SAAO,SAAS,iBAAiB;UACzB,eAAe;AACvB,UAAQ,MAAM,yBAAyB,cAAc;EAErD,IAAI,UAAU;EACd,IAAI,YAAY;AAEhB,MAAI,yBAAyB,YAAY;AACxC,eAAY,cAAc;AAG1B,WAAQ,cAAc,MAAtB;IACC,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eACC;AACD;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD,KAAK;AACJ,eAAU;AACV;IACD;AACC,eAAU;AACV;;;AAKH,SAAO,SACN,8BAA8B,UAAU,WAAW,mBAAmB,QAAQ,GAC9E"}

package/dist/astro/routes/api/auth/oauth/_provider_.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_provider_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/oauth/[provider].ts"],"mappings":";;;cAQa,SAAA;AAAA,cAgEA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"_provider_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/oauth/[provider].ts"],"mappings":";;;cAQa,SAAA;AAAA,cA6FA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/auth/oauth/_provider_.mjs

@@ -1,10 +1,14 @@
-import { r as getPublicOrigin } from "../../../../../public-url-7j0cpCFc.mjs";
-import { t as createOAuthStateStore } from "../../../../../oauth-state-store-CxXTjXdI.mjs";
-import { createAuthorizationUrl } from "@emdash-cms/auth";
+import { i as getPublicOrigin } from "../../../../../public-url-uT1Ok2Tu.mjs";
+import { t as createOAuthStateStore } from "../../../../../oauth-state-store-CnmYYsVQ.mjs";
+import { createAuthorizationUrl, isValidMicrosoftTenant } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/auth/oauth/[provider].ts
 const prerender = false;
-const VALID_PROVIDERS = new Set(["github", "google"]);
+const VALID_PROVIDERS = new Set([
+	"github",
+	"google",
+	"microsoft"
+]);
 /** Invite tokens are base64url; clamp shape and length before persisting to state. */
 const INVITE_TOKEN_REGEX = /^[A-Za-z0-9_-]{1,256}$/;
 function isValidProvider(provider) {
@@ -34,6 +38,14 @@ function getOAuthConfig(env) {
 		clientId: googleClientId,
 		clientSecret: googleClientSecret
 	};
+	const microsoftClientId = envString(env, "EMDASH_OAUTH_MICROSOFT_CLIENT_ID", "MICROSOFT_CLIENT_ID");
+	const microsoftClientSecret = envString(env, "EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET", "MICROSOFT_CLIENT_SECRET");
+	const microsoftTenant = envString(env, "EMDASH_OAUTH_MICROSOFT_TENANT_ID", "MICROSOFT_TENANT_ID");
+	if (microsoftClientId && microsoftClientSecret && microsoftTenant && isValidMicrosoftTenant(microsoftTenant)) providers.microsoft = {
+		clientId: microsoftClientId,
+		clientSecret: microsoftClientSecret,
+		tenant: microsoftTenant
+	};
 	return providers;
 }
 const GET = async ({ params, request, locals, redirect }) => {
@@ -46,7 +58,10 @@ const GET = async ({ params, request, locals, redirect }) => {
 		const url = new URL(request.url);
 		const { env: cfEnv } = await import("virtual:emdash/env");
 		const providers = getOAuthConfig(cfEnv ?? import.meta.env);
-		if (!providers[provider]) return redirect(`${errorRedirectBase}?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured. Set either EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_ID and EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_SECRET, or ${provider.toUpperCase()}_CLIENT_ID and ${provider.toUpperCase()}_CLIENT_SECRET.`)}`);
+		if (!providers[provider]) {
+			const tenantHint = provider === "microsoft" ? " Microsoft also needs EMDASH_OAUTH_MICROSOFT_TENANT_ID or MICROSOFT_TENANT_ID: a directory (tenant) ID, or common, organizations or consumers." : "";
+			return redirect(`${errorRedirectBase}?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured. Set either EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_ID and EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_SECRET, or ${provider.toUpperCase()}_CLIENT_ID and ${provider.toUpperCase()}_CLIENT_SECRET.${tenantHint}`)}`);
+		}
 		const config = {
 			baseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,
 			providers

package/dist/astro/routes/api/auth/oauth/_provider_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_provider_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/oauth/[provider].ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/oauth/[provider]\n *\n * Start OAuth flow - redirects to provider authorization URL\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { createAuthorizationUrl, type OAuthConsumerConfig } from \"@emdash-cms/auth\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { createOAuthStateStore } from \"#auth/oauth-state-store.js\";\n\ntype ProviderName = \"github\" | \"google\";\n\nconst VALID_PROVIDERS = new Set<string>([\"github\", \"google\"]);\n\n/** Invite tokens are base64url; clamp shape and length before persisting to state. */\nconst INVITE_TOKEN_REGEX = /^[A-Za-z0-9_-]{1,256}$/;\n\nfunction isValidProvider(provider: string): provider is ProviderName {\n\treturn VALID_PROVIDERS.has(provider);\n}\n\n/** Safely extract a string value from an env-like record */\nfunction envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst val = env[key];\n\t\tif (typeof val === \"string\" && val) return val;\n\t}\n\treturn undefined;\n}\n\n/**\n * Get OAuth config from environment variables\n */\nfunction getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig[\"providers\"] {\n\tconst providers: OAuthConsumerConfig[\"providers\"] = {};\n\n\t// GitHub\n\tconst githubClientId = envString(env, \"EMDASH_OAUTH_GITHUB_CLIENT_ID\", \"GITHUB_CLIENT_ID\");\n\tconst githubClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GITHUB_CLIENT_SECRET\",\n\t\t\"GITHUB_CLIENT_SECRET\",\n\t);\n\tif (githubClientId && githubClientSecret) {\n\t\tproviders.github = {\n\t\t\tclientId: githubClientId,\n\t\t\tclientSecret: githubClientSecret,\n\t\t};\n\t}\n\n\t// Google\n\tconst googleClientId = envString(env, \"EMDASH_OAUTH_GOOGLE_CLIENT_ID\", \"GOOGLE_CLIENT_ID\");\n\tconst googleClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GOOGLE_CLIENT_SECRET\",\n\t\t\"GOOGLE_CLIENT_SECRET\",\n\t);\n\tif (googleClientId && googleClientSecret) {\n\t\tproviders.google = {\n\t\t\tclientId: googleClientId,\n\t\t\tclientSecret: googleClientSecret,\n\t\t};\n\t}\n\n\treturn providers;\n}\n\nexport const GET: APIRoute = async ({ params, request, locals, redirect }) => {\n\tconst { emdash } = locals;\n\tconst provider = params.provider;\n\n\t// Determine where to redirect errors (setup wizard or login page)\n\tconst referer = request.headers.get(\"referer\") ?? \"\";\n\tconst errorRedirectBase = referer.includes(\"/setup\")\n\t\t? \"/_emdash/admin/setup\"\n\t\t: \"/_emdash/admin/login\";\n\n\t// Validate provider\n\tif (!provider || !isValidProvider(provider)) {\n\t\treturn redirect(\n\t\t\t`${errorRedirectBase}?error=invalid_provider&message=${encodeURIComponent(\"Invalid OAuth provider\")}`,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn redirect(\n\t\t\t`${errorRedirectBase}?error=server_error&message=${encodeURIComponent(\"Database not configured\")}`,\n\t\t);\n\t}\n\n\ttry {\n\t\tconst url = new URL(request.url);\n\n\t\t// Get OAuth providers from environment. Astro 6 removed\n\t\t// `Astro.locals.runtime.env` (accessing it throws rather than\n\t\t// returning undefined, so optional-chaining doesn't help) -- read\n\t\t// Cloudflare bindings via the emdash virtual module instead, which\n\t\t// re-exports `cloudflare:workers`' `env` under that adapter and\n\t\t// falls back to `import.meta.env` on Node (#1736).\n\t\t// @ts-ignore - virtual module, generated by the Astro integration\n\t\tconst { env: cfEnv } = (await import(\"virtual:emdash/env\")) as {\n\t\t\tenv?: Record<string, unknown>;\n\t\t};\n\t\tconst env = cfEnv ?? import.meta.env;\n\t\tconst providers = getOAuthConfig(env);\n\n\t\tif (!providers[provider]) {\n\t\t\treturn redirect(\n\t\t\t\t`${errorRedirectBase}?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured. Set either EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_ID and EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_SECRET, or ${provider.toUpperCase()}_CLIENT_ID and ${provider.toUpperCase()}_CLIENT_SECRET.`)}`,\n\t\t\t);\n\t\t}\n\n\t\tconst config: OAuthConsumerConfig = {\n\t\t\tbaseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,\n\t\t\tproviders,\n\t\t};\n\n\t\tconst stateStore = createOAuthStateStore(emdash.db);\n\n\t\t// When the flow starts from an invite link, carry the invite token so the\n\t\t// callback can complete the invite for a matching, verified email. Validate\n\t\t// its shape/length first: this endpoint is unauthenticated, so we avoid\n\t\t// persisting arbitrary or oversized values into the short-lived state store.\n\t\tconst rawInvite = url.searchParams.get(\"invite\");\n\t\tconst inviteToken = rawInvite && INVITE_TOKEN_REGEX.test(rawInvite) ? rawInvite : undefined;\n\n\t\tconst { url: authUrl } = await createAuthorizationUrl(config, provider, stateStore, {\n\t\t\tinviteToken,\n\t\t});\n\n\t\treturn redirect(authUrl);\n\t} catch (error) {\n\t\tconsole.error(\"OAuth initiation error:\", error);\n\t\treturn redirect(\n\t\t\t`${errorRedirectBase}?error=oauth_error&message=${encodeURIComponent(\"Failed to start OAuth flow. Please try again.\")}`,\n\t\t);\n\t}\n};\n"],"mappings":";;;;;AAQA,MAAa,YAAY;AASzB,MAAM,kBAAkB,IAAI,IAAY,CAAC,UAAU,SAAS,CAAC;;AAG7D,MAAM,qBAAqB;AAE3B,SAAS,gBAAgB,UAA4C;AACpE,QAAO,gBAAgB,IAAI,SAAS;;;AAIrC,SAAS,UAAU,KAA8B,GAAG,MAAoC;AACvF,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,IAAK,QAAO;;;;;;AAQ7C,SAAS,eAAe,KAAgE;CACvF,MAAM,YAA8C,EAAE;CAGtD,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;AAGF,QAAO;;AAGR,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,eAAe;CAC7E,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,OAAO;CAIxB,MAAM,qBADU,QAAQ,QAAQ,IAAI,UAAU,IAAI,IAChB,SAAS,SAAS,GACjD,yBACA;AAGH,KAAI,CAAC,YAAY,CAAC,gBAAgB,SAAS,CAC1C,QAAO,SACN,GAAG,kBAAkB,kCAAkC,mBAAmB,yBAAyB,GACnG;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SACN,GAAG,kBAAkB,8BAA8B,mBAAmB,0BAA0B,GAChG;AAGF,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAShC,MAAM,EAAE,KAAK,UAAW,MAAM,OAAO;EAIrC,MAAM,YAAY,eADN,SAAS,OAAO,KAAK,IACI;AAErC,MAAI,CAAC,UAAU,UACd,QAAO,SACN,GAAG,kBAAkB,yCAAyC,mBAAmB,kBAAkB,SAAS,8CAA8C,SAAS,aAAa,CAAC,8BAA8B,SAAS,aAAa,CAAC,qBAAqB,SAAS,aAAa,CAAC,iBAAiB,SAAS,aAAa,CAAC,iBAAiB,GAC3U;EAGF,MAAM,SAA8B;GACnC,SAAS,GAAG,gBAAgB,KAAK,QAAQ,OAAO,CAAC;GACjD;GACA;EAED,MAAM,aAAa,sBAAsB,OAAO,GAAG;EAMnD,MAAM,YAAY,IAAI,aAAa,IAAI,SAAS;EAGhD,MAAM,EAAE,KAAK,YAAY,MAAM,uBAAuB,QAAQ,UAAU,YAAY,EACnF,aAHmB,aAAa,mBAAmB,KAAK,UAAU,GAAG,YAAY,QAIjF,CAAC;AAEF,SAAO,SAAS,QAAQ;UAChB,OAAO;AACf,UAAQ,MAAM,2BAA2B,MAAM;AAC/C,SAAO,SACN,GAAG,kBAAkB,6BAA6B,mBAAmB,gDAAgD,GACrH"}
+{"version":3,"file":"_provider_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/oauth/[provider].ts"],"sourcesContent":["/**\n * GET /_emdash/api/auth/oauth/[provider]\n *\n * Start OAuth flow - redirects to provider authorization URL\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport {\n\tcreateAuthorizationUrl,\n\tisValidMicrosoftTenant,\n\ttype OAuthConsumerConfig,\n} from \"@emdash-cms/auth\";\n\nimport { getPublicOrigin } from \"#api/public-url.js\";\nimport { createOAuthStateStore } from \"#auth/oauth-state-store.js\";\n\ntype ProviderName = \"github\" | \"google\" | \"microsoft\";\n\nconst VALID_PROVIDERS = new Set<string>([\"github\", \"google\", \"microsoft\"]);\n\n/** Invite tokens are base64url; clamp shape and length before persisting to state. */\nconst INVITE_TOKEN_REGEX = /^[A-Za-z0-9_-]{1,256}$/;\n\nfunction isValidProvider(provider: string): provider is ProviderName {\n\treturn VALID_PROVIDERS.has(provider);\n}\n\n/** Safely extract a string value from an env-like record */\nfunction envString(env: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst val = env[key];\n\t\tif (typeof val === \"string\" && val) return val;\n\t}\n\treturn undefined;\n}\n\n/**\n * Get OAuth config from environment variables\n */\nfunction getOAuthConfig(env: Record<string, unknown>): OAuthConsumerConfig[\"providers\"] {\n\tconst providers: OAuthConsumerConfig[\"providers\"] = {};\n\n\t// GitHub\n\tconst githubClientId = envString(env, \"EMDASH_OAUTH_GITHUB_CLIENT_ID\", \"GITHUB_CLIENT_ID\");\n\tconst githubClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GITHUB_CLIENT_SECRET\",\n\t\t\"GITHUB_CLIENT_SECRET\",\n\t);\n\tif (githubClientId && githubClientSecret) {\n\t\tproviders.github = {\n\t\t\tclientId: githubClientId,\n\t\t\tclientSecret: githubClientSecret,\n\t\t};\n\t}\n\n\t// Google\n\tconst googleClientId = envString(env, \"EMDASH_OAUTH_GOOGLE_CLIENT_ID\", \"GOOGLE_CLIENT_ID\");\n\tconst googleClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_GOOGLE_CLIENT_SECRET\",\n\t\t\"GOOGLE_CLIENT_SECRET\",\n\t);\n\tif (googleClientId && googleClientSecret) {\n\t\tproviders.google = {\n\t\t\tclientId: googleClientId,\n\t\t\tclientSecret: googleClientSecret,\n\t\t};\n\t}\n\n\t// Microsoft\n\tconst microsoftClientId = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_MICROSOFT_CLIENT_ID\",\n\t\t\"MICROSOFT_CLIENT_ID\",\n\t);\n\tconst microsoftClientSecret = envString(\n\t\tenv,\n\t\t\"EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET\",\n\t\t\"MICROSOFT_CLIENT_SECRET\",\n\t);\n\tconst microsoftTenant = envString(env, \"EMDASH_OAUTH_MICROSOFT_TENANT_ID\", \"MICROSOFT_TENANT_ID\");\n\tif (\n\t\tmicrosoftClientId &&\n\t\tmicrosoftClientSecret &&\n\t\tmicrosoftTenant &&\n\t\tisValidMicrosoftTenant(microsoftTenant)\n\t) {\n\t\tproviders.microsoft = {\n\t\t\tclientId: microsoftClientId,\n\t\t\tclientSecret: microsoftClientSecret,\n\t\t\ttenant: microsoftTenant,\n\t\t};\n\t}\n\n\treturn providers;\n}\n\nexport const GET: APIRoute = async ({ params, request, locals, redirect }) => {\n\tconst { emdash } = locals;\n\tconst provider = params.provider;\n\n\t// Determine where to redirect errors (setup wizard or login page)\n\tconst referer = request.headers.get(\"referer\") ?? \"\";\n\tconst errorRedirectBase = referer.includes(\"/setup\")\n\t\t? \"/_emdash/admin/setup\"\n\t\t: \"/_emdash/admin/login\";\n\n\t// Validate provider\n\tif (!provider || !isValidProvider(provider)) {\n\t\treturn redirect(\n\t\t\t`${errorRedirectBase}?error=invalid_provider&message=${encodeURIComponent(\"Invalid OAuth provider\")}`,\n\t\t);\n\t}\n\n\tif (!emdash?.db) {\n\t\treturn redirect(\n\t\t\t`${errorRedirectBase}?error=server_error&message=${encodeURIComponent(\"Database not configured\")}`,\n\t\t);\n\t}\n\n\ttry {\n\t\tconst url = new URL(request.url);\n\n\t\t// Get OAuth providers from environment. Astro 6 removed\n\t\t// `Astro.locals.runtime.env` (accessing it throws rather than\n\t\t// returning undefined, so optional-chaining doesn't help) -- read\n\t\t// Cloudflare bindings via the emdash virtual module instead, which\n\t\t// re-exports `cloudflare:workers`' `env` under that adapter and\n\t\t// falls back to `import.meta.env` on Node (#1736).\n\t\t// @ts-ignore - virtual module, generated by the Astro integration\n\t\tconst { env: cfEnv } = (await import(\"virtual:emdash/env\")) as {\n\t\t\tenv?: Record<string, unknown>;\n\t\t};\n\t\tconst env = cfEnv ?? import.meta.env;\n\t\tconst providers = getOAuthConfig(env);\n\n\t\tif (!providers[provider]) {\n\t\t\tconst tenantHint =\n\t\t\t\tprovider === \"microsoft\"\n\t\t\t\t\t? \" Microsoft also needs EMDASH_OAUTH_MICROSOFT_TENANT_ID or MICROSOFT_TENANT_ID: a directory (tenant) ID, or common, organizations or consumers.\"\n\t\t\t\t\t: \"\";\n\t\t\treturn redirect(\n\t\t\t\t`${errorRedirectBase}?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured. Set either EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_ID and EMDASH_OAUTH_${provider.toUpperCase()}_CLIENT_SECRET, or ${provider.toUpperCase()}_CLIENT_ID and ${provider.toUpperCase()}_CLIENT_SECRET.${tenantHint}`)}`,\n\t\t\t);\n\t\t}\n\n\t\tconst config: OAuthConsumerConfig = {\n\t\t\tbaseUrl: `${getPublicOrigin(url, emdash?.config)}/_emdash`,\n\t\t\tproviders,\n\t\t};\n\n\t\tconst stateStore = createOAuthStateStore(emdash.db);\n\n\t\t// When the flow starts from an invite link, carry the invite token so the\n\t\t// callback can complete the invite for a matching, verified email. Validate\n\t\t// its shape/length first: this endpoint is unauthenticated, so we avoid\n\t\t// persisting arbitrary or oversized values into the short-lived state store.\n\t\tconst rawInvite = url.searchParams.get(\"invite\");\n\t\tconst inviteToken = rawInvite && INVITE_TOKEN_REGEX.test(rawInvite) ? rawInvite : undefined;\n\n\t\tconst { url: authUrl } = await createAuthorizationUrl(config, provider, stateStore, {\n\t\t\tinviteToken,\n\t\t});\n\n\t\treturn redirect(authUrl);\n\t} catch (error) {\n\t\tconsole.error(\"OAuth initiation error:\", error);\n\t\treturn redirect(\n\t\t\t`${errorRedirectBase}?error=oauth_error&message=${encodeURIComponent(\"Failed to start OAuth flow. Please try again.\")}`,\n\t\t);\n\t}\n};\n"],"mappings":";;;;;AAQA,MAAa,YAAY;AAazB,MAAM,kBAAkB,IAAI,IAAY;CAAC;CAAU;CAAU;CAAY,CAAC;;AAG1E,MAAM,qBAAqB;AAE3B,SAAS,gBAAgB,UAA4C;AACpE,QAAO,gBAAgB,IAAI,SAAS;;;AAIrC,SAAS,UAAU,KAA8B,GAAG,MAAoC;AACvF,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,IAAK,QAAO;;;;;;AAQ7C,SAAS,eAAe,KAAgE;CACvF,MAAM,YAA8C,EAAE;CAGtD,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,iBAAiB,UAAU,KAAK,iCAAiC,mBAAmB;CAC1F,MAAM,qBAAqB,UAC1B,KACA,qCACA,uBACA;AACD,KAAI,kBAAkB,mBACrB,WAAU,SAAS;EAClB,UAAU;EACV,cAAc;EACd;CAIF,MAAM,oBAAoB,UACzB,KACA,oCACA,sBACA;CACD,MAAM,wBAAwB,UAC7B,KACA,wCACA,0BACA;CACD,MAAM,kBAAkB,UAAU,KAAK,oCAAoC,sBAAsB;AACjG,KACC,qBACA,yBACA,mBACA,uBAAuB,gBAAgB,CAEvC,WAAU,YAAY;EACrB,UAAU;EACV,cAAc;EACd,QAAQ;EACR;AAGF,QAAO;;AAGR,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,eAAe;CAC7E,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,OAAO;CAIxB,MAAM,qBADU,QAAQ,QAAQ,IAAI,UAAU,IAAI,IAChB,SAAS,SAAS,GACjD,yBACA;AAGH,KAAI,CAAC,YAAY,CAAC,gBAAgB,SAAS,CAC1C,QAAO,SACN,GAAG,kBAAkB,kCAAkC,mBAAmB,yBAAyB,GACnG;AAGF,KAAI,CAAC,QAAQ,GACZ,QAAO,SACN,GAAG,kBAAkB,8BAA8B,mBAAmB,0BAA0B,GAChG;AAGF,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAShC,MAAM,EAAE,KAAK,UAAW,MAAM,OAAO;EAIrC,MAAM,YAAY,eADN,SAAS,OAAO,KAAK,IACI;AAErC,MAAI,CAAC,UAAU,WAAW;GACzB,MAAM,aACL,aAAa,cACV,mJACA;AACJ,UAAO,SACN,GAAG,kBAAkB,yCAAyC,mBAAmB,kBAAkB,SAAS,8CAA8C,SAAS,aAAa,CAAC,8BAA8B,SAAS,aAAa,CAAC,qBAAqB,SAAS,aAAa,CAAC,iBAAiB,SAAS,aAAa,CAAC,iBAAiB,aAAa,GACxV;;EAGF,MAAM,SAA8B;GACnC,SAAS,GAAG,gBAAgB,KAAK,QAAQ,OAAO,CAAC;GACjD;GACA;EAED,MAAM,aAAa,sBAAsB,OAAO,GAAG;EAMnD,MAAM,YAAY,IAAI,aAAa,IAAI,SAAS;EAGhD,MAAM,EAAE,KAAK,YAAY,MAAM,uBAAuB,QAAQ,UAAU,YAAY,EACnF,aAHmB,aAAa,mBAAmB,KAAK,UAAU,GAAG,YAAY,QAIjF,CAAC;AAEF,SAAO,SAAS,QAAQ;UAChB,OAAO;AACf,UAAQ,MAAM,2BAA2B,MAAM;AAC/C,SAAO,SACN,GAAG,kBAAkB,6BAA6B,mBAAmB,gDAAgD,GACrH"}

package/dist/astro/routes/api/auth/passkey/_id_.mjs

@@ -1,20 +1,20 @@
 import "../../../../../config-CvmjJcVw.mjs";
-import "../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import "../../../../../settings-CwcrX-Ay.mjs";
-import "../../../../../site-settings-B7vGFRDT.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-5Y0W39xR.mjs";
-import "../../../../../redirects-1nhdEaTq.mjs";
-import "../../../../../entry-lock-yIkBduqJ.mjs";
-import "../../../../../media-Bs6qmlVl.mjs";
-import "../../../../../comments-zrTgWBSg.mjs";
-import { A as passkeyRenameBody } from "../../../../../byline-fields-BYbTptTU.mjs";
-import "../../../../../menus-mC_XTxD7.mjs";
-import "../../../../../status-C6IrSLMT.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import "../../../../../settings-GaZ5sVgg.mjs";
+import "../../../../../site-settings-CDdT4mVm.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
+import "../../../../../redirects-DFT7Wr-e.mjs";
+import "../../../../../entry-lock-Cjz0h45X.mjs";
+import "../../../../../media-CRKsKlfK.mjs";
+import "../../../../../comments-BzmIKVb2.mjs";
+import { A as passkeyRenameBody } from "../../../../../byline-fields-Bze3ZdAw.mjs";
+import "../../../../../menus-D1HC8npj.mjs";
+import "../../../../../status-Dl85BK39.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/passkey/index.mjs

@@ -1,8 +1,8 @@
-import "../../../../../base64-DvnNgP7e.mjs";
-import "../../../../../types-j6MBDjlZ.mjs";
-import "../../../../../errors-CjXd1LgH.mjs";
-import "../../../../../errors-CNvATh_7.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DIYXAVk4.mjs";
+import "../../../../../base64-BQBZwXCx.mjs";
+import "../../../../../types-C-Xp0CcN.mjs";
+import "../../../../../errors-CjtE5aWF.mjs";
+import "../../../../../errors-hskQ0C8G.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/passkey/index.ts

package/dist/astro/routes/api/auth/passkey/options.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"mappings":";;;cAUa,SAAA;AAAA,cAcA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"options.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"mappings":";;;cAUa,SAAA;AAAA,cAgBA,IAAA,EAAM,QAAA"}