emdash 1.1.0 → 1.2.0

package/src/astro/image-endpoint.ts

@@ -15,9 +15,12 @@ import { GET as genericGET } from "astro/assets/endpoint/generic";
 import { getConfiguredImageService, imageConfig } from "astro:assets";
 
 import {
+	getTransformFingerprint,
 	matchInternalMediaKey,
 	MUTABLE_MEDIA_CACHE_CONTROL,
 	originalMediaHeaders,
+	validatorHeaders,
+	isNotModified,
 } from "../media/image-endpoint.js";
 
 export const prerender = false;
@@ -38,8 +41,33 @@ function isNotFound(error: unknown): boolean {
 	);
 }
 
-function streamOriginal(body: ReadableStream<Uint8Array>, contentType: string): Response {
-	return new Response(body, { status: 200, headers: originalMediaHeaders(contentType) });
+function streamOriginal(
+	body: ReadableStream<Uint8Array>,
+	contentType: string,
+	size: number,
+	lastModified?: Date,
+): Response {
+	return new Response(body, {
+		status: 200,
+		headers: originalMediaHeaders(contentType, size, lastModified),
+	});
+}
+
+function notModifiedResponse(
+	contentType: string,
+	size: number,
+	lastModified?: Date,
+	suffix?: string,
+): Response {
+	return new Response(null, {
+		status: 304,
+		headers: {
+			"Content-Type": contentType,
+			"Cache-Control": MUTABLE_MEDIA_CACHE_CONTROL,
+			"X-Content-Type-Options": "nosniff",
+			...validatorHeaders(size, lastModified, suffix),
+		},
+	});
 }
 
 export const GET: APIRoute = async (ctx) => {
@@ -59,11 +87,24 @@ export const GET: APIRoute = async (ctx) => {
 
 		// Only raster images are transformable; serve anything else unchanged.
 		if (!source.contentType.startsWith("image/")) {
-			return streamOriginal(source.body, source.contentType);
+			if (isNotModified(ctx.request, source.size, source.lastModified)) {
+				return notModifiedResponse(source.contentType, source.size, source.lastModified);
+			}
+			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
 		}
 
 		const transform = await service.parseURL(url, imageConfig);
-		if (!transform) return streamOriginal(source.body, source.contentType);
+		if (!transform) {
+			if (isNotModified(ctx.request, source.size, source.lastModified)) {
+				return notModifiedResponse(source.contentType, source.size, source.lastModified);
+			}
+			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
+		}
+
+		const fingerprint = getTransformFingerprint(url.searchParams);
+		if (isNotModified(ctx.request, source.size, source.lastModified, fingerprint)) {
+			return notModifiedResponse(source.contentType, source.size, source.lastModified, fingerprint);
+		}
 
 		const inputBuffer = new Uint8Array(await new Response(source.body).arrayBuffer());
 		const { data, format } = await service.transform(inputBuffer, transform, imageConfig);
@@ -74,6 +115,7 @@ export const GET: APIRoute = async (ctx) => {
 				"Content-Type": FORMAT_MIME[format] ?? source.contentType,
 				"Cache-Control": MUTABLE_MEDIA_CACHE_CONTROL,
 				"X-Content-Type-Options": "nosniff",
+				...validatorHeaders(source.size, source.lastModified, fingerprint),
 			},
 		});
 	} catch (error) {

package/src/astro/integration/admin-locales.ts

@@ -0,0 +1,168 @@
+/**
+ * Build-time support for the `admin.locales` allowlist: validates it against
+ * the catalogs the installed admin package ships, and keeps excluded catalogs
+ * out of the bundle by resolving their imports to the source-locale catalog.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { posix, resolve } from "node:path";
+
+import type { Plugin } from "vite";
+
+const SOURCE_LOCALE = "en";
+const MANIFEST_FILE = "locales-manifest.json";
+const QUERY_RE = /[?#].*$/;
+
+/** Locale code mapped to its catalog chunk, relative to the admin dist directory. */
+export type AdminLocaleManifest = Record<string, string>;
+
+function isStringRecord(value: unknown): value is Record<string, string> {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		!Array.isArray(value) &&
+		Object.values(value).every((entry) => typeof entry === "string")
+	);
+}
+
+/**
+ * Read the locale manifest emitted by the `@emdash-cms/admin` build. Throws if
+ * it is missing, malformed, lacks the source locale, or names a chunk that is
+ * not in the dist directory.
+ */
+export function readAdminLocaleManifest(adminDistPath: string): AdminLocaleManifest {
+	const manifestPath = resolve(adminDistPath, MANIFEST_FILE);
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch (error) {
+		throw new Error(
+			`\`admin.locales\` needs the admin locale manifest at ${manifestPath}, but it could not be read. ` +
+				"Reinstall or rebuild @emdash-cms/admin.",
+			{ cause: error },
+		);
+	}
+
+	const locales =
+		typeof parsed === "object" && parsed !== null && "locales" in parsed
+			? parsed.locales
+			: undefined;
+	if (!isStringRecord(locales) || !Object.hasOwn(locales, SOURCE_LOCALE)) {
+		throw new Error(
+			`The admin locale manifest at ${manifestPath} is invalid: expected a "locales" object ` +
+				`mapping locale codes to chunk files, including "${SOURCE_LOCALE}". ` +
+				"Reinstall or rebuild @emdash-cms/admin.",
+		);
+	}
+
+	for (const [code, chunk] of Object.entries(locales)) {
+		if (!existsSync(resolve(adminDistPath, chunk))) {
+			throw new Error(
+				`The admin locale manifest at ${manifestPath} lists "${chunk}" for "${code}", ` +
+					"but that file does not exist. Reinstall or rebuild @emdash-cms/admin.",
+			);
+		}
+	}
+
+	return locales;
+}
+
+function canonicalizeLocale(code: string): string | undefined {
+	try {
+		return new Intl.Locale(code.trim()).baseName;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Resolve a user-supplied `admin.locales` list to the admin's own locale
+ * codes. Matching ignores case and surrounding whitespace, the source locale
+ * is always included first, and duplicates are dropped. Throws, naming every
+ * unrecognized entry and listing the available codes, if any entry does not
+ * match an available locale.
+ */
+export function resolveAdminLocales(requested: unknown, available: Iterable<string>): string[] {
+	if (!Array.isArray(requested)) {
+		throw new Error("`admin.locales` must be an array of locale codes.");
+	}
+	const entries: unknown[] = requested;
+
+	const byCanonical = new Map<string, string>();
+	for (const code of available) {
+		byCanonical.set(canonicalizeLocale(code) ?? code, code);
+	}
+
+	const resolved = new Set([SOURCE_LOCALE]);
+	const unknownEntries: string[] = [];
+	for (const entry of entries) {
+		const canonical = typeof entry === "string" ? canonicalizeLocale(entry) : undefined;
+		const code = canonical === undefined ? undefined : byCanonical.get(canonical);
+		if (code === undefined) {
+			unknownEntries.push(String(JSON.stringify(entry)));
+		} else {
+			resolved.add(code);
+		}
+	}
+
+	if (unknownEntries.length > 0) {
+		const availableCodes = [...byCanonical.values()].toSorted().join(", ");
+		throw new Error(
+			`Unknown admin locale${unknownEntries.length === 1 ? "" : "s"} in \`admin.locales\`: ` +
+				`${unknownEntries.join(", ")}. Available locales: ${availableCodes}.`,
+		);
+	}
+
+	return [...resolved];
+}
+
+function toVitePath(path: string): string {
+	return path.replaceAll("\\", "/");
+}
+
+interface AdminLocaleResolverOptions {
+	adminDistPath: string;
+	/** Set in dev when the admin package is aliased to its source. */
+	adminSourcePath?: string;
+	locales: readonly string[];
+	manifest: AdminLocaleManifest;
+}
+
+/**
+ * Vite plugin that resolves imports of excluded admin catalogs to the source
+ * locale's catalog, so the excluded catalogs are never bundled. Covers both
+ * the built admin package (hashed chunks listed in the manifest) and, in dev,
+ * the admin source (`./<code>/messages.mjs`).
+ */
+export function createAdminLocaleResolverPlugin(options: AdminLocaleResolverOptions): Plugin {
+	const { manifest } = options;
+	const sourceLocaleChunk = manifest[SOURCE_LOCALE];
+	if (sourceLocaleChunk === undefined) {
+		throw new Error(`The admin locale manifest has no "${SOURCE_LOCALE}" catalog.`);
+	}
+
+	const allowed = new Set(options.locales);
+	const distDir = toVitePath(options.adminDistPath);
+	const sourceDir = options.adminSourcePath ? toVitePath(options.adminSourcePath) : undefined;
+	const redirects = new Map<string, string>();
+	for (const [code, chunk] of Object.entries(manifest)) {
+		if (code === SOURCE_LOCALE || allowed.has(code)) continue;
+		redirects.set(posix.join(distDir, chunk), posix.join(distDir, sourceLocaleChunk));
+		if (sourceDir) {
+			redirects.set(
+				posix.join(sourceDir, "locales", code, "messages.mjs"),
+				posix.join(distDir, "locales", SOURCE_LOCALE, "messages.mjs"),
+			);
+		}
+	}
+
+	return {
+		name: "emdash-admin-locales",
+		enforce: "pre",
+		resolveId(source, importer) {
+			if (!importer || !source.startsWith(".")) return;
+			const importerDir = posix.dirname(toVitePath(importer).replace(QUERY_RE, ""));
+			return redirects.get(posix.join(importerDir, source.replace(QUERY_RE, "")));
+		},
+	};
+}

package/src/astro/integration/dev-env.ts

@@ -0,0 +1,84 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const DEV_ENV_SECRET_VAR_NAMES = new Set(["EMDASH_ENCRYPTION_KEY"]);
+const NEWLINE_RE = /\r?\n/;
+
+/**
+ * Parse a minimal subset of dotenv syntax, enough for the local secrets
+ * scaffolder and common user edits. Inline comments, blank lines, and
+ * lines without an `=` are ignored; leading/trailing whitespace is trimmed.
+ * Single and double quotes are stripped; no variable expansion is performed.
+ */
+function parseDotenv(content: string): Record<string, string> {
+	const result: Record<string, string> = {};
+	for (const rawLine of content.split(NEWLINE_RE)) {
+		const line = stripInlineComment(rawLine).trim();
+		if (line === "" || line.startsWith("#")) continue;
+
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+
+		const key = line.slice(0, eq).trim();
+		let value = line.slice(eq + 1).trim();
+
+		// Strip matching quote pair. Keep escaped quotes simple: only unescape
+		// the quote char that wrapped the value.
+		if (value.length >= 2) {
+			const first = value[0];
+			const last = value.at(-1)!;
+			if ((first === '"' || first === "'") && first === last) {
+				value = value.slice(1, -1).replaceAll(`\\${first}`, first);
+			}
+		}
+
+		result[key] = value;
+	}
+	return result;
+}
+
+/**
+ * Remove an inline `#` comment only if it is not inside a quoted value. This
+ * keeps values like `FOO="a # b"` intact while stripping trailing comments.
+ */
+function stripInlineComment(line: string): string {
+	let inSingleQuote = false;
+	let inDoubleQuote = false;
+	for (let i = 0; i < line.length; i++) {
+		const char = line[i];
+		if (char === "'" && !inDoubleQuote) {
+			inSingleQuote = !inSingleQuote;
+		} else if (char === '"' && !inSingleQuote) {
+			inDoubleQuote = !inDoubleQuote;
+		} else if (char === "#" && !inSingleQuote && !inDoubleQuote) {
+			return line.slice(0, i);
+		}
+	}
+	return line;
+}
+
+/**
+ * Load the plugin-secret encryption key from the project's `.env` into
+ * `process.env` during `astro dev`. Existing environment variables (e.g.
+ * already exported in the shell, or set by the host platform) are honored and
+ * never overwritten.
+ *
+ * This keeps the deliberate `process.env`-only rule in the secrets module
+ * while letting freshly scaffolded Node sites use the generated encryption key
+ * without a manual `export` step. Other EmDash variables are intentionally not
+ * copied, so `.env` values intended for production do not accidentally replace
+ * generated dev values (for example `SITE_URL`).
+ */
+export function loadDevEnv(root: URL | string): void {
+	const rootPath = typeof root === "string" ? root : fileURLToPath(root);
+	const envPath = join(rootPath, ".env");
+	if (!existsSync(envPath)) return;
+
+	const parsed = parseDotenv(readFileSync(envPath, "utf-8"));
+	for (const [key, value] of Object.entries(parsed)) {
+		if (DEV_ENV_SECRET_VAR_NAMES.has(key) && !process.env[key]) {
+			process.env[key] = value;
+		}
+	}
+}

package/src/astro/integration/index.ts

@@ -15,6 +15,7 @@ import { fileURLToPath } from "node:url";
 
 import type { AstroIntegration, AstroIntegrationLogger, AstroIntegrationMiddleware } from "astro";
 
+import { getEnvSiteUrl } from "../../api/public-url.js";
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
 import { normalizeMigrationConfig } from "../../database/migrations/policy.js";
 import { normalizeAstroI18n } from "../../i18n/normalize.js";
@@ -34,6 +35,8 @@ import {
 } from "../../registry/config.js";
 import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
+import { readAdminLocaleManifest, resolveAdminLocales } from "./admin-locales.js";
+import { loadDevEnv } from "./dev-env.js";
 import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
 import { notoSans } from "./font-provider.js";
 import {
@@ -43,7 +46,7 @@ import {
 	injectMcpRoute,
 } from "./routes.js";
 import type { EmDashConfig } from "./runtime.js";
-import { createViteConfig } from "./vite-config.js";
+import { createViteConfig, resolveAdminDist } from "./vite-config.js";
 
 // Re-export runtime types and functions
 export type {
@@ -77,12 +80,25 @@ const DEFAULT_STORAGE = local({
 	baseUrl: "/_emdash/api/media/file",
 });
 
-interface ImageRemotePattern {
+export interface ImageRemotePattern {
 	protocol?: "http" | "https";
 	hostname?: string;
 	pathname?: string;
 }
 
+/**
+ * Resolve the site origin for `image.remotePatterns`: the configured `siteUrl`,
+ * then `EMDASH_SITE_URL` / `SITE_URL`. Astro bakes `remotePatterns` into the
+ * build output, so the env vars only take effect if they are set when
+ * `astro build` runs.
+ *
+ * @internal Exported for unit testing.
+ */
+export function resolveBuildTimeSiteUrl(configuredSiteUrl: string | undefined): string | undefined {
+	if (configuredSiteUrl) return configuredSiteUrl;
+	return getEnvSiteUrl();
+}
+
 /**
  * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
  *
@@ -142,10 +158,12 @@ export function buildImageRemotePatterns(
 
 	if (siteUrl) {
 		try {
-			patterns.push({
-				hostname: new URL(siteUrl).hostname,
-				pathname: `${INTERNAL_MEDIA_PREFIX}**`,
-			});
+			const { hostname } = new URL(siteUrl);
+			// WHATWG URL accepts `*` in a hostname, which Astro's matcher treats
+			// as a wildcard that would allowlist other hosts.
+			if (!hostname.includes("*")) {
+				patterns.push({ hostname, pathname: `${INTERNAL_MEDIA_PREFIX}**` });
+			}
 		} catch {
 			// ignore an unparseable site URL
 		}
@@ -459,8 +477,9 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 	// Validate siteUrl if provided in astro.config.mjs.
 	// Env-var fallback (EMDASH_SITE_URL / SITE_URL) is handled at runtime by
-	// getPublicOrigin() in api/public-url.ts — NOT here — so Docker images built
-	// without a domain can pick it up at container start via process.env.
+	// getPublicOrigin() in api/public-url.ts — don't fold it into
+	// resolvedConfig.siteUrl here — so Docker images built without a domain can
+	// pick it up at container start via process.env.
 	if (resolvedConfig.siteUrl) {
 		const raw = resolvedConfig.siteUrl;
 		try {
@@ -530,6 +549,14 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		}
 	}
 
+	if (config.admin?.locales !== undefined) {
+		const manifest = readAdminLocaleManifest(resolveAdminDist());
+		resolvedConfig.admin = {
+			...config.admin,
+			locales: resolveAdminLocales(config.admin.locales, Object.keys(manifest)),
+		};
+	}
+
 	// Resolved plugins (populated at build time by importing entrypoints)
 	let _resolvedPlugins: ResolvedPlugin[] = [];
 
@@ -563,6 +590,19 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					allowLocalhost: command === "dev" || command === "sync",
 				});
 				printBanner(logger);
+				if (command === "dev") {
+					// In Node `astro dev`, Vite loads `.env` into `import.meta.env`
+					// but not `process.env`. The plugin-secret encryption key
+					// intentionally reads only `process.env`, so a freshly
+					// scaffolded site can't save secret plugin settings until the
+					// key is copied over. Load only `EMDASH_ENCRYPTION_KEY` here,
+					// honoring any value already present in the shell.
+					try {
+						loadDevEnv(astroConfig.root);
+					} catch (error: unknown) {
+						logger.warn(`Failed to load EMDASH_ENCRYPTION_KEY from .env: ${String(error)}`);
+					}
+				}
 				// Capture the host's Astro version so the runtime can expose it
 				// to the admin and the registry install gate for `env:astro`
 				// constraint checks.
@@ -641,7 +681,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				// merges arrays, so user-configured remotePatterns are preserved.
 				const imageRemotePatterns = buildImageRemotePatterns(
 					resolvedConfig.storage,
-					resolvedConfig.siteUrl,
+					resolveBuildTimeSiteUrl(resolvedConfig.siteUrl),
 					command,
 				);
 

package/src/astro/integration/routes.ts

@@ -485,6 +485,21 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/settings/email.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain",
+		entrypoint: resolveRoute("api/settings/domain.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain/notify",
+		entrypoint: resolveRoute("api/settings/domain-notify.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/site/domain-proof",
+		entrypoint: resolveRoute("api/site/domain-proof.ts"),
+	});
+
 	// Backup routes
 	injectRoute({
 		pattern: "/_emdash/api/settings/backups",
@@ -1205,6 +1220,11 @@ export function injectBuiltinAuthRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/auth/magic-link/verify.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/auth/handover",
+		entrypoint: resolveRoute("api/auth/handover.ts"),
+	});
+
 	// OAuth routes
 	injectRoute({
 		pattern: "/_emdash/api/auth/oauth/[provider]",

package/src/astro/integration/runtime.ts

@@ -652,6 +652,21 @@ export interface EmDashConfig {
 		footerLabel?: string | false;
 		/** URL or path to a custom favicon for the admin panel. */
 		favicon?: string;
+		/**
+		 * Build-time allowlist of admin UI locales to ship.
+		 *
+		 * Only the listed locales are bundled and offered in the language
+		 * switcher; other locales fall back to English. `en` is always
+		 * included. Unknown codes fail the build.
+		 *
+		 * @example
+		 * ```ts
+		 * emdash({
+		 *   admin: { locales: ["en", "de"] },
+		 * })
+		 * ```
+		 */
+		locales?: string[];
 	};
 
 	/**

package/src/astro/integration/vite-config.ts

@@ -14,6 +14,7 @@ import type { AstroConfig } from "astro";
 import type { Plugin } from "vite";
 
 import { COMMIT, VERSION } from "../../version.js";
+import { createAdminLocaleResolverPlugin, readAdminLocaleManifest } from "./admin-locales.js";
 import type { EmDashConfig, PluginDescriptor } from "./runtime.js";
 import {
 	VIRTUAL_CONFIG_ID,
@@ -120,7 +121,7 @@ export function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string
  * Resolve path to the admin package dist directory.
  * Used for Vite alias to ensure the package is found in pnpm's isolated node_modules.
  */
-function resolveAdminDist(): string {
+export function resolveAdminDist(): string {
 	const require = createRequire(import.meta.url);
 	const adminPath = require.resolve("@emdash-cms/admin");
 	// Return the directory containing the built package (dist/)
@@ -425,6 +426,7 @@ export function createViteConfig(
 
 	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : undefined;
 	const useSource = adminSourcePath !== undefined;
+	const adminLocales = options.resolvedConfig.admin?.locales;
 	const useSyncExternalStoreShimPath = resolveIntegrationShim("use-sync-external-store.js");
 	const useSyncExternalStoreWithSelectorShimPath = resolveIntegrationShim(
 		"use-sync-external-store-with-selector.js",
@@ -445,6 +447,7 @@ export function createViteConfig(
 			__EMDASH_PSEUDO_LOCALE__: JSON.stringify(
 				isDev && process.env["EMDASH_PSEUDO_LOCALE"] === "1",
 			),
+			__EMDASH_ADMIN_LOCALES__: JSON.stringify(adminLocales ?? null),
 		},
 		resolve: {
 			dedupe: ["@emdash-cms/admin", "react", "react-dom"],
@@ -493,6 +496,18 @@ export function createViteConfig(
 		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Monorepo has both vite 6 (docs) and vite 7 (core). tsgo resolves correctly.
 		plugins: [
 			createVirtualModulesPlugin(options, command),
+			// Must precede the Lingui macro plugin, which redirects source
+			// catalog imports to dist/ in dev.
+			...(adminLocales
+				? [
+						createAdminLocaleResolverPlugin({
+							adminDistPath,
+							adminSourcePath,
+							locales: adminLocales,
+							manifest: readAdminLocaleManifest(adminDistPath),
+						}),
+					]
+				: []),
 			...(cloudflare ? [] : [createWorkersBuiltinsExternalPlugin()]),
 			// In dev mode with source alias, compile Lingui macros on the fly
 			// and redirect locale .mjs imports to dist/.
@@ -657,6 +672,8 @@ export function createViteConfig(
 						"emdash > @emdash-cms/admin > @codemirror/state",
 						"emdash > @emdash-cms/admin > @codemirror/view",
 						"emdash > @emdash-cms/admin > @lezer/highlight",
+						// Each admin language loads its date locale on first use.
+						"emdash > @emdash-cms/admin > react-day-picker/locale/*",
 					]
 				: [
 						"@emdash-cms/admin",

package/src/astro/middleware/auth.ts

@@ -114,6 +114,7 @@ const PUBLIC_API_EXACT = new Set([
 	"/_emdash/api/auth/passkey/verify",
 	"/_emdash/api/auth/mode",
 	"/_emdash/api/health",
+	"/_emdash/api/site/domain-proof",
 	"/_emdash/api/oauth/token",
 	"/_emdash/api/snapshot",
 	"/_emdash/api/visual-editing/toolbar-labels",
@@ -239,7 +240,20 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				return apiError("CSRF_REJECTED", "Missing required header", 403);
 			}
 		}
-		return next();
+		const response = await next();
+		if (!import.meta.env.DEV) {
+			response.headers.set(
+				"Content-Security-Policy",
+				buildEmDashCsp(
+					getRegistryConfigInput(context.locals.emdash?.config.registry),
+					getConfiguredStorageEndpoint(
+						context.locals.emdash?.config.storage,
+						context.locals.emdash?.storage,
+					),
+				),
+			);
+		}
+		return response;
 	}
 
 	// For public routes: soft auth check (set locals.user if session exists, but never block)
@@ -569,8 +583,7 @@ async function handleExternalAuth(
 			let newName: string | undefined;
 			let newRole: RoleLevel | undefined;
 
-			// Sync name from provider if provider provides one and local differs
-			if (authResult.name && user.name !== authResult.name) {
+			if (externalConfig.syncName !== false && authResult.name && user.name !== authResult.name) {
 				newName = authResult.name;
 				updates.name = newName;
 			}

package/src/astro/middleware/csp.ts

@@ -96,6 +96,7 @@ export function buildEmDashCsp(registry?: RegistryConfigInput, storageEndpoint?:
 		"frame-src 'self' https:",
 		"frame-ancestors 'none'",
 		"img-src 'self' https: data: blob:",
+		"media-src 'self' blob: https:",
 		"object-src 'none'",
 		"base-uri 'self'",
 	].join("; ");