emdash 1.1.0 → 1.3.0

package/dist/astro/routes/api/auth/dev-bypass.mjs

@@ -1,10 +1,10 @@
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../errors-CuHQRiBW.mjs";
-import "../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-B0rgPgsQ.mjs";
-import { t as escapeHtml } from "../../../../escape-nJW7dR0s.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-BRoLiWQE.mjs";
+import "../../../../types-D2NEXtgB.mjs";
+import "../../../../errors-B4f4It-2.mjs";
+import "../../../../errors-BOYNdIo3.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CVWeIOku.mjs";
+import { t as escapeHtml } from "../../../../escape-lsNq38PP.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-CQAV7mCo.mjs";
 import { ulid } from "ulidx";
 
 //#region src/astro/routes/api/auth/dev-bypass.ts

package/dist/astro/routes/api/auth/handover.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/auth/handover.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=handover.d.mts.map

package/dist/astro/routes/api/auth/handover.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handover.d.mts","names":[],"sources":["../../../../../src/astro/routes/api/auth/handover.ts"],"mappings":";;;cAqBa,SAAA;AAAA,cAKA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/handover.mjs

@@ -0,0 +1,49 @@
+import "../../../../after-PcEvMY_6.mjs";
+import "../../../../options-DhrI7eMv.mjs";
+import "../../../../base64-BQBZwXCx.mjs";
+import "../../../../types-D2NEXtgB.mjs";
+import "../../../../errors-B4f4It-2.mjs";
+import "../../../../errors-BOYNdIo3.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CVWeIOku.mjs";
+import { t as getChosenSiteOrigin } from "../../../../site-url-MB685I5X.mjs";
+import { t as checkRateLimit } from "../../../../rate-limit-Xp4d0NBY.mjs";
+import { createMagicLinkUrl } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+
+//#region src/astro/routes/api/auth/handover.ts
+/**
+* POST /_emdash/api/auth/handover
+*
+* Returns a single-use sign-in link for the current user at the site's
+* chosen address: the configured `siteUrl`, otherwise the **Site URL**.
+* After a domain change, passkeys created on the old address don't work on
+* the new one, so this is how a signed-in user moves their session there.
+* The link expires after 5 minutes and opens Security settings ready to add
+* a passkey.
+*
+* Signed-in sessions only: bearer tokens are refused.
+*/
+const prerender = false;
+const HANDOVER_EXPIRY_MS = 300 * 1e3;
+const HANDOVER_REDIRECT = "/_emdash/admin/settings/security?addPasskey=1";
+const POST = async ({ locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!user) return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	if (locals.tokenScopes !== void 0) return apiError("FORBIDDEN", "Sign-in handover requires a signed-in session", 403);
+	try {
+		if (!(await checkRateLimit(emdash.db, user.id, "auth/handover", 5, 300)).allowed) return apiError("RATE_LIMITED", "Too many sign-in links. Try again in a few minutes.", 429);
+		const origin = await getChosenSiteOrigin(emdash.db, emdash.config);
+		if (!origin) return apiError("NO_SITE_URL", "Set a Site URL before continuing at another address", 409);
+		return apiSuccess({ url: await createMagicLinkUrl(createKyselyAdapter(emdash.db), user, origin, {
+			expiresInMs: HANDOVER_EXPIRY_MS,
+			redirect: HANDOVER_REDIRECT
+		}) });
+	} catch (error) {
+		return handleError(error, "Failed to create a sign-in link", "SIGN_IN_HANDOVER_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };
+//# sourceMappingURL=handover.mjs.map

package/dist/astro/routes/api/auth/handover.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handover.mjs","names":[],"sources":["../../../../../src/astro/routes/api/auth/handover.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/handover\n *\n * Returns a single-use sign-in link for the current user at the site's\n * chosen address: the configured `siteUrl`, otherwise the **Site URL**.\n * After a domain change, passkeys created on the old address don't work on\n * the new one, so this is how a signed-in user moves their session there.\n * The link expires after 5 minutes and opens Security settings ready to add\n * a passkey.\n *\n * Signed-in sessions only: bearer tokens are refused.\n */\n\nimport { createMagicLinkUrl } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { getChosenSiteOrigin } from \"#api/site-url.js\";\nimport { checkRateLimit } from \"#auth/rate-limit.js\";\n\nexport const prerender = false;\n\nconst HANDOVER_EXPIRY_MS = 5 * 60 * 1000;\nconst HANDOVER_REDIRECT = \"/_emdash/admin/settings/security?addPasskey=1\";\n\nexport const POST: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!user) {\n\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t}\n\tif (locals.tokenScopes !== undefined) {\n\t\treturn apiError(\"FORBIDDEN\", \"Sign-in handover requires a signed-in session\", 403);\n\t}\n\n\ttry {\n\t\tconst rateLimit = await checkRateLimit(emdash.db, user.id, \"auth/handover\", 5, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\treturn apiError(\"RATE_LIMITED\", \"Too many sign-in links. Try again in a few minutes.\", 429);\n\t\t}\n\n\t\tconst origin = await getChosenSiteOrigin(emdash.db, emdash.config);\n\t\tif (!origin) {\n\t\t\treturn apiError(\"NO_SITE_URL\", \"Set a Site URL before continuing at another address\", 409);\n\t\t}\n\n\t\tconst url = await createMagicLinkUrl(createKyselyAdapter(emdash.db), user, origin, {\n\t\t\texpiresInMs: HANDOVER_EXPIRY_MS,\n\t\t\tredirect: HANDOVER_REDIRECT,\n\t\t});\n\t\treturn apiSuccess({ url });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to create a sign-in link\", \"SIGN_IN_HANDOVER_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,MAAM,qBAAqB,MAAS;AACpC,MAAM,oBAAoB;AAE1B,MAAa,OAAiB,OAAO,EAAE,aAAa;CACnD,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,KACJ,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;AAE/D,KAAI,OAAO,gBAAgB,OAC1B,QAAO,SAAS,aAAa,iDAAiD,IAAI;AAGnF,KAAI;AAEH,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,KAAK,IAAI,iBAAiB,GAAG,IAAI,EACpE,QACd,QAAO,SAAS,gBAAgB,uDAAuD,IAAI;EAG5F,MAAM,SAAS,MAAM,oBAAoB,OAAO,IAAI,OAAO,OAAO;AAClE,MAAI,CAAC,OACJ,QAAO,SAAS,eAAe,uDAAuD,IAAI;AAO3F,SAAO,WAAW,EAAE,KAJR,MAAM,mBAAmB,oBAAoB,OAAO,GAAG,EAAE,MAAM,QAAQ;GAClF,aAAa;GACb,UAAU;GACV,CAAC,EACuB,CAAC;UAClB,OAAO;AACf,SAAO,YAAY,OAAO,mCAAmC,yBAAyB"}

package/dist/astro/routes/api/auth/invite/accept.mjs

@@ -1,8 +1,8 @@
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
 import { InviteError, roleFromLevel, validateInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/invite/complete.mjs

@@ -3,26 +3,26 @@ import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import { S as inviteCompleteBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../settings-Dd1uivmQ.mjs";
+import "../../../../../site-settings-DRHfX7bq.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
+import "../../../../../redirects-BEVSRMa2.mjs";
+import "../../../../../entry-lock-Df6-XhIu.mjs";
+import "../../../../../media-1WC65OCB.mjs";
+import "../../../../../comments-yiRFx3w5.mjs";
+import { S as inviteCompleteBody } from "../../../../../byline-fields-BLXZnX7N.mjs";
+import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CFtudhyw.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-CxZxPqaw.mjs";
-import { r as sessionUnavailableError } from "../../../../../session-user-CqkPtrPL.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-C-MxsV22.mjs";
+import { i as getPublicOrigin } from "../../../../../public-url-Bt98vysr.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-CEug-p0t.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-C17BYx2-.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-DlpPdf8L.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-D0kdzEao.mjs";
 import { InviteError, completeInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/auth/invite/index.mjs

@@ -2,23 +2,23 @@ import "../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import { C as inviteCreateBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../settings-Dd1uivmQ.mjs";
+import "../../../../../site-settings-DRHfX7bq.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
+import "../../../../../redirects-BEVSRMa2.mjs";
+import "../../../../../entry-lock-Df6-XhIu.mjs";
+import "../../../../../media-1WC65OCB.mjs";
+import "../../../../../comments-yiRFx3w5.mjs";
+import { C as inviteCreateBody } from "../../../../../byline-fields-BLXZnX7N.mjs";
+import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-Ceq_AUK0.mjs";
-import { t as resolveEmailLocale } from "../../../../../email-locale-Cc5YSXfJ.mjs";
+import { n as getSiteBaseUrl } from "../../../../../site-url-MB685I5X.mjs";
+import { t as resolveEmailLocale } from "../../../../../email-locale-BJ8DjTzZ.mjs";
 import { InviteError, Role, createInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { getInviteEmailStrings } from "@emdash-cms/admin/locales/emails";

package/dist/astro/routes/api/auth/invite/register-options.mjs

@@ -2,24 +2,24 @@ import "../../../../../config-CvmjJcVw.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import { w as inviteRegisterOptionsBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../settings-Dd1uivmQ.mjs";
+import "../../../../../site-settings-DRHfX7bq.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
+import "../../../../../redirects-BEVSRMa2.mjs";
+import "../../../../../entry-lock-Df6-XhIu.mjs";
+import "../../../../../media-1WC65OCB.mjs";
+import "../../../../../comments-yiRFx3w5.mjs";
+import { w as inviteRegisterOptionsBody } from "../../../../../byline-fields-BLXZnX7N.mjs";
+import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-CxZxPqaw.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-C-MxsV22.mjs";
+import { i as getPublicOrigin } from "../../../../../public-url-Bt98vysr.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-C17BYx2-.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-D0kdzEao.mjs";
 import { ulid } from "ulidx";
 import { InviteError, validateInvite } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";

package/dist/astro/routes/api/auth/logout.mjs

@@ -1,9 +1,9 @@
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../errors-CuHQRiBW.mjs";
-import "../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess, r as handleError } from "../../../../error-B0rgPgsQ.mjs";
-import { t as isSafeRedirect } from "../../../../redirect-BRoLiWQE.mjs";
+import "../../../../types-D2NEXtgB.mjs";
+import "../../../../errors-B4f4It-2.mjs";
+import "../../../../errors-BOYNdIo3.mjs";
+import { n as apiSuccess, r as handleError } from "../../../../error-CVWeIOku.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-CQAV7mCo.mjs";
 
 //#region src/astro/routes/api/auth/logout.ts
 const prerender = false;

package/dist/astro/routes/api/auth/magic-link/send.mjs

@@ -1,26 +1,27 @@
 import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../options-DhrI7eMv.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import { T as magicLinkSendBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../settings-Dd1uivmQ.mjs";
+import "../../../../../site-settings-DRHfX7bq.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-CVWeIOku.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
+import "../../../../../redirects-BEVSRMa2.mjs";
+import "../../../../../entry-lock-Df6-XhIu.mjs";
+import "../../../../../media-1WC65OCB.mjs";
+import "../../../../../comments-yiRFx3w5.mjs";
+import { T as magicLinkSendBody } from "../../../../../byline-fields-BLXZnX7N.mjs";
+import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-BqfQFs6a.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-Ceq_AUK0.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-iMvcu3eu.mjs";
-import { t as resolveEmailLocale } from "../../../../../email-locale-Cc5YSXfJ.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-BU3Nx9g1.mjs";
+import { n as getSiteBaseUrl } from "../../../../../site-url-MB685I5X.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-Xp4d0NBY.mjs";
+import { t as resolveEmailLocale } from "../../../../../email-locale-BJ8DjTzZ.mjs";
 import { sendMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { getMagicLinkEmailStrings } from "@emdash-cms/admin/locales/emails";

package/dist/astro/routes/api/auth/magic-link/send.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { getMagicLinkEmailStrings } from \"@emdash-cms/admin/locales/emails\";\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { resolveEmailLocale } from \"#api/email-locale.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteOptions = await options.getMany<string>([\"emdash:site_title\", \"emdash:locale\"]);\n\t\tconst siteName = siteOptions.get(\"emdash:site_title\") ?? \"EmDash\";\n\n\t\t// Localized copy following the site locale; the locale also\n\t\t// drives lang/dir on the email HTML so RTL copy renders correctly.\n\t\tconst emailLocale = resolveEmailLocale(siteOptions.get(\"emdash:locale\"), request);\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\temailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),\n\t\t\temailLocale,\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EACvE,MAAM,cAAc,MAAM,QAAQ,QAAgB,CAAC,qBAAqB,gBAAgB,CAAC;EACzF,MAAM,WAAW,YAAY,IAAI,oBAAoB,IAAI;EAIzD,MAAM,cAAc,mBAAmB,YAAY,IAAI,gBAAgB,EAAE,QAAQ;AAWjF,QAAM,cAV0B;GAC/B;GACA;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,cAAc,MAAM,yBAAyB,aAAa,SAAS;GACnE;GACA,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}
+{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { getMagicLinkEmailStrings } from \"@emdash-cms/admin/locales/emails\";\nimport { sendMagicLink, type MagicLinkConfig } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { resolveEmailLocale } from \"#api/email-locale.js\";\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteOptions = await options.getMany<string>([\"emdash:site_title\", \"emdash:locale\"]);\n\t\tconst siteName = siteOptions.get(\"emdash:site_title\") ?? \"EmDash\";\n\n\t\t// Localized copy following the site locale; the locale also\n\t\t// drives lang/dir on the email HTML so RTL copy renders correctly.\n\t\tconst emailLocale = resolveEmailLocale(siteOptions.get(\"emdash:locale\"), request);\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t\temailStrings: await getMagicLinkEmailStrings(emailLocale, siteName),\n\t\t\temailLocale,\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAezB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;EAChD,MAAM,UAAU,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;EACvE,MAAM,cAAc,MAAM,QAAQ,QAAgB,CAAC,qBAAqB,gBAAgB,CAAC;EACzF,MAAM,WAAW,YAAY,IAAI,oBAAoB,IAAI;EAIzD,MAAM,cAAc,mBAAmB,YAAY,IAAI,gBAAgB,EAAE,QAAQ;AAWjF,QAAM,cAV0B;GAC/B;GACA;GACA,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,cAAc,MAAM,yBAAyB,aAAa,SAAS;GACnE;GACA,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}

package/dist/astro/routes/api/auth/magic-link/verify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"mappings":";;;cAca,SAAA;AAAA,cAWA,GAAA,EAAK,QAAA;AAAA,cAYL,IAAA,EAAM,QAAA"}
+{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"mappings":";;;cAea,SAAA;AAAA,cAYA,GAAA,EAAK,QAAA;AAAA,cAYL,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/auth/magic-link/verify.mjs

@@ -1,23 +1,23 @@
 import "../../../../../config-CvmjJcVw.mjs";
-import "../../../../../after-PcEvMY_6.mjs";
+import { t as after } from "../../../../../after-PcEvMY_6.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import { E as magicLinkVerifyBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../settings-Dd1uivmQ.mjs";
+import "../../../../../site-settings-DRHfX7bq.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
+import "../../../../../redirects-BEVSRMa2.mjs";
+import "../../../../../entry-lock-Df6-XhIu.mjs";
+import "../../../../../media-1WC65OCB.mjs";
+import "../../../../../comments-yiRFx3w5.mjs";
+import { E as magicLinkVerifyBody } from "../../../../../byline-fields-BLXZnX7N.mjs";
+import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as sessionUnavailableError } from "../../../../../session-user-CqkPtrPL.mjs";
+import { r as sessionUnavailableError } from "../../../../../session-user-DlpPdf8L.mjs";
 import { MagicLinkError, verifyMagicLink } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
@@ -40,7 +40,13 @@ const POST = async ({ request, locals, session }) => {
 		if (isParseError(body)) return body;
 		const adapter = createKyselyAdapter(emdash.db);
 		const user = await verifyMagicLink(adapter, body.token);
-		adapter.deleteExpiredTokens().catch(() => {});
+		after(async () => {
+			try {
+				await adapter.deleteExpiredTokens();
+			} catch (error) {
+				console.error("[magic-link] failed to delete expired tokens:", error);
+			}
+		});
 		session.set("user", { id: user.id });
 		return apiSuccess({ success: true });
 	} catch (error) {

package/dist/astro/routes/api/auth/magic-link/verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"sourcesContent":["/**\n * GET  /_emdash/api/auth/magic-link/verify\n * POST /_emdash/api/auth/magic-link/verify\n *\n * GET is the link in the email. It only forwards to the admin confirmation\n * page, because mail scanners fetch every link in a message and would\n * otherwise use up the single-use token before the recipient clicks.\n *\n * POST verifies the token and creates the session.\n * Tokens are single-use and expire after 15 minutes.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { verifyMagicLink, MagicLinkError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkVerifyBody } from \"#api/schemas.js\";\n\nimport { sessionUnavailableError } from \"../../../../session-user.js\";\n\nexport const GET: APIRoute = async ({ url, redirect }) => {\n\tconst token = url.searchParams.get(\"token\");\n\tif (!token) {\n\t\treturn redirect(\"/_emdash/admin/login?error=missing_token\");\n\t}\n\n\tconst confirmUrl = new URLSearchParams({ token });\n\tconst rawRedirect = url.searchParams.get(\"redirect\");\n\tif (rawRedirect) confirmUrl.set(\"redirect\", rawRedirect);\n\treturn redirect(`/_emdash/admin/login/magic-link?${confirmUrl.toString()}`);\n};\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!session) return sessionUnavailableError();\n\n\ttry {\n\t\tconst body = await parseBody(request, magicLinkVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await verifyMagicLink(adapter, body.token);\n\n\t\t// Fire-and-forget cleanup of expired tokens -- prevents accumulation\n\t\tvoid adapter.deleteExpiredTokens().catch(() => {});\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\tif (error instanceof MagicLinkError) {\n\t\t\tconst statusMap: Record<MagicLinkError[\"code\"], number> = {\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_not_found: 404,\n\t\t\t\temail_not_configured: 500,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code]);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to verify magic link\", \"MAGIC_LINK_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAWzB,MAAa,MAAgB,OAAO,EAAE,KAAK,eAAe;CACzD,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAC3C,KAAI,CAAC,MACJ,QAAO,SAAS,2CAA2C;CAG5D,MAAM,aAAa,IAAI,gBAAgB,EAAE,OAAO,CAAC;CACjD,MAAM,cAAc,IAAI,aAAa,IAAI,WAAW;AACpD,KAAI,YAAa,YAAW,IAAI,YAAY,YAAY;AACxD,QAAO,SAAS,mCAAmC,WAAW,UAAU,GAAG;;AAG5E,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,QAAS,QAAO,yBAAyB;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB;AAC1D,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,OAAO,MAAM,gBAAgB,SAAS,KAAK,MAAM;AAGvD,EAAK,QAAQ,qBAAqB,CAAC,YAAY,GAAG;AAElD,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAEpC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,MAAI,iBAAiB,eAOpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SANU;GACzD,eAAe;GACf,eAAe;GACf,gBAAgB;GAChB,sBAAsB;GACtB,CACkE,MAAM,MAAM;AAGhF,SAAO,YAAY,OAAO,+BAA+B,0BAA0B"}
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/verify.ts"],"sourcesContent":["/**\n * GET  /_emdash/api/auth/magic-link/verify\n * POST /_emdash/api/auth/magic-link/verify\n *\n * GET is the link in the email. It only forwards to the admin confirmation\n * page, because mail scanners fetch every link in a message and would\n * otherwise use up the single-use token before the recipient clicks.\n *\n * POST verifies the token and creates the session.\n * Tokens are single-use and expire after 15 minutes, or 5 minutes for\n * sign-in handover links.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { verifyMagicLink, MagicLinkError } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkVerifyBody } from \"#api/schemas.js\";\n\nimport { after } from \"../../../../../after.js\";\nimport { sessionUnavailableError } from \"../../../../session-user.js\";\n\nexport const GET: APIRoute = async ({ url, redirect }) => {\n\tconst token = url.searchParams.get(\"token\");\n\tif (!token) {\n\t\treturn redirect(\"/_emdash/admin/login?error=missing_token\");\n\t}\n\n\tconst confirmUrl = new URLSearchParams({ token });\n\tconst rawRedirect = url.searchParams.get(\"redirect\");\n\tif (rawRedirect) confirmUrl.set(\"redirect\", rawRedirect);\n\treturn redirect(`/_emdash/admin/login/magic-link?${confirmUrl.toString()}`);\n};\n\nexport const POST: APIRoute = async ({ request, locals, session }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tif (!session) return sessionUnavailableError();\n\n\ttry {\n\t\tconst body = await parseBody(request, magicLinkVerifyBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await verifyMagicLink(adapter, body.token);\n\n\t\t// Cleanup of expired tokens -- prevents accumulation\n\t\tafter(async () => {\n\t\t\ttry {\n\t\t\t\tawait adapter.deleteExpiredTokens();\n\t\t\t} catch (error) {\n\t\t\t\tconsole.error(\"[magic-link] failed to delete expired tokens:\", error);\n\t\t\t}\n\t\t});\n\n\t\tsession.set(\"user\", { id: user.id });\n\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\tif (error instanceof MagicLinkError) {\n\t\t\tconst statusMap: Record<MagicLinkError[\"code\"], number> = {\n\t\t\t\tinvalid_token: 400,\n\t\t\t\ttoken_expired: 410,\n\t\t\t\tuser_not_found: 404,\n\t\t\t\temail_not_configured: 500,\n\t\t\t};\n\t\t\treturn apiError(error.code.toUpperCase(), error.message, statusMap[error.code]);\n\t\t}\n\n\t\treturn handleError(error, \"Failed to verify magic link\", \"MAGIC_LINK_VERIFY_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAYzB,MAAa,MAAgB,OAAO,EAAE,KAAK,eAAe;CACzD,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAC3C,KAAI,CAAC,MACJ,QAAO,SAAS,2CAA2C;CAG5D,MAAM,aAAa,IAAI,gBAAgB,EAAE,OAAO,CAAC;CACjD,MAAM,cAAc,IAAI,aAAa,IAAI,WAAW;AACpD,KAAI,YAAa,YAAW,IAAI,YAAY,YAAY;AACxD,QAAO,SAAS,mCAAmC,WAAW,UAAU,GAAG;;AAG5E,MAAa,OAAiB,OAAO,EAAE,SAAS,QAAQ,cAAc;CACrE,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAEpE,KAAI,CAAC,QAAS,QAAO,yBAAyB;AAE9C,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB;AAC1D,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,MAAM,OAAO,MAAM,gBAAgB,SAAS,KAAK,MAAM;AAGvD,QAAM,YAAY;AACjB,OAAI;AACH,UAAM,QAAQ,qBAAqB;YAC3B,OAAO;AACf,YAAQ,MAAM,iDAAiD,MAAM;;IAErE;AAEF,UAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAEpC,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,MAAI,iBAAiB,eAOpB,QAAO,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,SANU;GACzD,eAAe;GACf,eAAe;GACf,gBAAgB;GAChB,sBAAsB;GACtB,CACkE,MAAM,MAAM;AAGhF,SAAO,YAAY,OAAO,+BAA+B,0BAA0B"}

package/dist/astro/routes/api/auth/me.mjs

@@ -1,21 +1,21 @@
 import "../../../../config-CvmjJcVw.mjs";
 import "../../../../base64-BQBZwXCx.mjs";
 import "../../../../url-Dn3IStq8.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import { t as UserRepository } from "../../../../user-Dnp53zTq.mjs";
-import "../../../../errors-CuHQRiBW.mjs";
-import "../../../../errors-DTE6C3K_.mjs";
-import "../../../../settings-WHr45II1.mjs";
-import "../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CmFDTGzp.mjs";
-import "../../../../redirects-D4EWeXAo.mjs";
-import "../../../../entry-lock-sxz2PGAT.mjs";
-import "../../../../media-aahnKHze.mjs";
-import "../../../../comments-BRtp992B.mjs";
-import { x as authMeActionBody } from "../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../menus-BQKqf0Up.mjs";
-import "../../../../status-D39Fpy8R.mjs";
+import "../../../../types-D2NEXtgB.mjs";
+import { t as UserRepository } from "../../../../user-BlCTKVAm.mjs";
+import "../../../../errors-B4f4It-2.mjs";
+import "../../../../errors-BOYNdIo3.mjs";
+import "../../../../settings-Dd1uivmQ.mjs";
+import "../../../../site-settings-DRHfX7bq.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CVWeIOku.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-DgQ2NABT.mjs";
+import "../../../../redirects-BEVSRMa2.mjs";
+import "../../../../entry-lock-Df6-XhIu.mjs";
+import "../../../../media-1WC65OCB.mjs";
+import "../../../../comments-yiRFx3w5.mjs";
+import { x as authMeActionBody } from "../../../../byline-fields-BLXZnX7N.mjs";
+import "../../../../menus-BSzwObhV.mjs";
+import "../../../../status-BFNdxzKc.mjs";
 import "../../../../api/schemas/index.mjs";
 
 //#region src/astro/routes/api/auth/me.ts

package/dist/astro/routes/api/auth/mode.mjs

@@ -1,9 +1,9 @@
 import "../../../../base64-BQBZwXCx.mjs";
-import "../../../../types-C-Xp0CcN.mjs";
-import "../../../../errors-CuHQRiBW.mjs";
-import "../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess } from "../../../../error-B0rgPgsQ.mjs";
-import { t as getAuthMode } from "../../../../mode-nh0ppSX5.mjs";
+import "../../../../types-D2NEXtgB.mjs";
+import "../../../../errors-B4f4It-2.mjs";
+import "../../../../errors-BOYNdIo3.mjs";
+import { n as apiSuccess } from "../../../../error-CVWeIOku.mjs";
+import { t as getAuthMode } from "../../../../mode-C-D3qICy.mjs";
 
 //#region src/astro/routes/api/auth/mode.ts
 const prerender = false;

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs

@@ -2,14 +2,14 @@ import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
 import "../../../../../../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../../../../../../options-DhrI7eMv.mjs";
 import "../../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../../error-B0rgPgsQ.mjs";
-import { r as getPublicOrigin } from "../../../../../../public-url-B5a0QAh6.mjs";
-import { t as SESSION_UNAVAILABLE_MESSAGE } from "../../../../../../session-user-CqkPtrPL.mjs";
-import { n as finalizeSetup } from "../../../../../../setup-complete-B2_dhZZz.mjs";
-import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-CpGi2FZH.mjs";
+import "../../../../../../types-D2NEXtgB.mjs";
+import "../../../../../../errors-B4f4It-2.mjs";
+import "../../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../../error-CVWeIOku.mjs";
+import { i as getPublicOrigin } from "../../../../../../public-url-Bt98vysr.mjs";
+import { t as SESSION_UNAVAILABLE_MESSAGE } from "../../../../../../session-user-DlpPdf8L.mjs";
+import { n as finalizeSetup } from "../../../../../../setup-complete-BuNxAUiN.mjs";
+import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-CHMn_mwc.mjs";
 import { OAuthError, Role, handleOAuthCallback, isValidMicrosoftTenant } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/oauth/_provider_.mjs

@@ -1,5 +1,5 @@
-import { r as getPublicOrigin } from "../../../../../public-url-B5a0QAh6.mjs";
-import { t as createOAuthStateStore } from "../../../../../oauth-state-store-CpGi2FZH.mjs";
+import { i as getPublicOrigin } from "../../../../../public-url-Bt98vysr.mjs";
+import { t as createOAuthStateStore } from "../../../../../oauth-state-store-CHMn_mwc.mjs";
 import { createAuthorizationUrl, isValidMicrosoftTenant } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/auth/oauth/[provider].ts

package/dist/astro/routes/api/auth/passkey/_id_.mjs

@@ -1,20 +1,20 @@
 import "../../../../../config-CvmjJcVw.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
 import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import "../../../../../settings-WHr45II1.mjs";
-import "../../../../../site-settings-KJOqJW6W.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CmFDTGzp.mjs";
-import "../../../../../redirects-D4EWeXAo.mjs";
-import "../../../../../entry-lock-sxz2PGAT.mjs";
-import "../../../../../media-aahnKHze.mjs";
-import "../../../../../comments-BRtp992B.mjs";
-import { A as passkeyRenameBody } from "../../../../../byline-fields-DHJs0Mja.mjs";
-import "../../../../../menus-BQKqf0Up.mjs";
-import "../../../../../status-D39Fpy8R.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import "../../../../../settings-Dd1uivmQ.mjs";
+import "../../../../../site-settings-DRHfX7bq.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-DgQ2NABT.mjs";
+import "../../../../../redirects-BEVSRMa2.mjs";
+import "../../../../../entry-lock-Df6-XhIu.mjs";
+import "../../../../../media-1WC65OCB.mjs";
+import "../../../../../comments-yiRFx3w5.mjs";
+import { A as passkeyRenameBody } from "../../../../../byline-fields-BLXZnX7N.mjs";
+import "../../../../../menus-BSzwObhV.mjs";
+import "../../../../../status-BFNdxzKc.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/passkey/index.mjs

@@ -1,8 +1,8 @@
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CuHQRiBW.mjs";
-import "../../../../../errors-DTE6C3K_.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B0rgPgsQ.mjs";
+import "../../../../../types-D2NEXtgB.mjs";
+import "../../../../../errors-B4f4It-2.mjs";
+import "../../../../../errors-BOYNdIo3.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CVWeIOku.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/passkey/index.ts

package/dist/astro/routes/api/auth/passkey/options.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"mappings":";;;cAUa,SAAA;AAAA,cAcA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"options.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/auth/passkey/options.ts"],"mappings":";;;cAUa,SAAA;AAAA,cAgBA,IAAA,EAAM,QAAA"}