emdash 1.2.0 → 1.3.0

package/dist/astro/middleware/auth.d.mts

@@ -1,15 +1,15 @@
-import "../../parse-BOGhrwSq.mjs";
-import "../../types-UKr5Sf4y.mjs";
-import "../../types-C4P7F1Vq.mjs";
-import "../../options-BR9XZl7h.mjs";
-import "../../entry-lock-BAAlKYrz.mjs";
-import "../../config-C4-UxIk7.mjs";
-import "../../runner-DkeafPBA.mjs";
-import "../../storage-query-BOBmeDMD.mjs";
-import "../../index-DYsn97dY.mjs";
-import "../../types-Bq9Wohd7.mjs";
-import "../../hreflang-BsYo4x_M.mjs";
-import "../../validate-Dfv0DpZi.mjs";
+import "../../parse-CWHOFc6z.mjs";
+import "../../types-DCFavOii.mjs";
+import "../../types-QoPHm-2w.mjs";
+import "../../options-DJWaq3Ie.mjs";
+import "../../entry-lock-C7VX0NGK.mjs";
+import "../../config-Bsm_u_oE.mjs";
+import "../../runner-BObHz5FC.mjs";
+import "../../storage-query-DRyu3bSU.mjs";
+import "../../index-BB9sVisO.mjs";
+import "../../types-DHO7Pd25.mjs";
+import "../../hreflang-CY_F5OjF.mjs";
+import "../../validate-emKxGC5F.mjs";
 import { EmDashHandlers } from "../types.mjs";
 import { User } from "@emdash-cms/auth";
 import * as astro from "astro";

package/dist/astro/middleware/auth.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.mts","names":[],"sources":["../../../src/astro/middleware/auth.ts"],"mappings":";;;;;;;;;;;;;;;;;QA2CQ,MAAA;EAAA,UACG,GAAA;IAAA,UACC,MAAA;MACT,IAAA,GAAO,IAAA;MANwC;MAQ/C,WAAA;MAFO;MAIP,OAAA;MACA,MAAA,GAAS,cAAA;IAAA;IAAA,UAEA,WAAA;MACT,IAAA;QAAQ,EAAA;MAAA;MACR,cAAA;IAAA;EAAA;AAAA;AAAA,cA8HU,SAAA,EA0KX,KAAA,CA1KoB,iBAAA"}
+{"version":3,"file":"auth.d.mts","names":[],"sources":["../../../src/astro/middleware/auth.ts"],"mappings":";;;;;;;;;;;;;;;;;QA2CQ,MAAA;EAAA,UACG,GAAA;IAAA,UACC,MAAA;MACT,IAAA,GAAO,IAAA;MANwC;MAQ/C,WAAA;MAFO;MAIP,OAAA;MACA,MAAA,GAAS,cAAA;IAAA;IAAA,UAEA,WAAA;MACT,IAAA;QAAQ,EAAA;MAAA;MACR,cAAA;IAAA;EAAA;AAAA;AAAA,cAgIU,SAAA,EA0KX,KAAA,CA1KoB,iBAAA"}

package/dist/astro/middleware/auth.mjs

@@ -1,15 +1,15 @@
 import "../../after-PcEvMY_6.mjs";
 import "../../base64-BQBZwXCx.mjs";
-import "../../types-C-Xp0CcN.mjs";
-import "../../errors-CjtE5aWF.mjs";
-import { r as getRegistryConfigInput } from "../../config-Bo4eOOdV.mjs";
-import "../../errors-hskQ0C8G.mjs";
-import { t as apiError } from "../../error-DxgQdaZ_.mjs";
-import { i as getPublicOrigin } from "../../public-url-uT1Ok2Tu.mjs";
-import { t as getAuthMode } from "../../mode-eieqAWLe.mjs";
-import { n as resolveSessionUser } from "../../session-user-1dtJc2zv.mjs";
-import { a as hasScope, n as TRANSFER_SCOPES } from "../../api-tokens-D2zgAIEt.mjs";
-import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-B0ZipcZ-.mjs";
+import "../../types-D2NEXtgB.mjs";
+import "../../errors-B4f4It-2.mjs";
+import { r as getRegistryConfigInput } from "../../config-DBU6iUQB.mjs";
+import "../../errors-BOYNdIo3.mjs";
+import { t as apiError } from "../../error-CVWeIOku.mjs";
+import { i as getPublicOrigin } from "../../public-url-Bt98vysr.mjs";
+import { t as getAuthMode } from "../../mode-C-D3qICy.mjs";
+import { n as resolveSessionUser } from "../../session-user-DlpPdf8L.mjs";
+import { a as hasScope, n as TRANSFER_SCOPES } from "../../api-tokens-CdP49zVF.mjs";
+import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-Bx38ZCQp.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";
@@ -185,6 +185,7 @@ const PUBLIC_API_EXACT = new Set([
 	"/_emdash/api/search",
 	"/_emdash/api/search/suggest"
 ]);
+const DEV_PUBLIC_API_EXACT = new Set(["/_emdash/api/typegen", "/_emdash/api/dev/scheduled-tasks"]);
 const { exact: _providerExactRoutes, prefixes: _providerPrefixRoutes } = (() => {
 	const exact = /* @__PURE__ */ new Set();
 	const prefixes = [];
@@ -227,7 +228,7 @@ function isPublicEmDashRoute(pathname) {
 	if (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;
 	if (_providerExactRoutes.has(pathname)) return true;
 	if (_providerPrefixRoutes.some((p) => pathname.startsWith(p))) return true;
-	if (import.meta.env.DEV && pathname === "/_emdash/api/typegen") return true;
+	if (import.meta.env.DEV && DEV_PUBLIC_API_EXACT.has(pathname)) return true;
 	return false;
 }
 function isCsrfExemptPublicRoute(pathname) {

package/dist/astro/middleware/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","names":["virtualAuthenticate"],"sources":["../../../src/api/csrf.ts","../../../src/astro/middleware/csp.ts","../../../src/astro/middleware/auth.ts"],"sourcesContent":["/**\n * CSRF protection utilities.\n *\n * Two mechanisms:\n * 1. Custom header check (X-EmDash-Request: 1) — used for authenticated API routes.\n *    Browsers block cross-origin custom headers, so presence proves same-origin.\n * 2. Origin check — used for public API routes that skip auth. Compares the Origin\n *    header against the request origin. Same approach as Astro's `checkOrigin`.\n */\n\nimport { apiError } from \"./error.js\";\n\n/**\n * Origin-based CSRF check for public API routes that skip auth.\n *\n * State-changing requests (POST/PUT/DELETE) to public endpoints must either:\n *   1. Include the X-EmDash-Request: 1 header (custom header blocked cross-origin), OR\n *   2. Have an Origin header matching the request origin (or the configured public origin)\n *\n * This prevents cross-origin form submissions (which can't set custom headers)\n * and cross-origin fetch (blocked by CORS unless allowed). Same-origin requests\n * always include a matching Origin header.\n *\n * Returns a 403 Response if the check fails, or null if allowed.\n *\n * @param request  The incoming request\n * @param url      The request URL (internal origin)\n * @param publicOrigin  The public-facing origin from config.siteUrl. Must be\n *        `undefined` when absent — never `null` or `\"\"` (security invariant H-1a).\n */\nexport function checkPublicCsrf(\n\trequest: Request,\n\turl: URL,\n\tpublicOrigin?: string,\n): Response | null {\n\t// Custom header present — browser blocks cross-origin custom headers\n\tconst csrfHeader = request.headers.get(\"X-EmDash-Request\");\n\tif (csrfHeader === \"1\") return null;\n\n\t// Check Origin header — present on all POST/PUT/DELETE from browsers\n\tconst origin = request.headers.get(\"Origin\");\n\tif (origin) {\n\t\ttry {\n\t\t\tconst originUrl = new URL(origin);\n\t\t\t// Accept if Origin matches either the internal or public origin\n\t\t\tif (originUrl.origin === url.origin) return null;\n\t\t\tif (publicOrigin && originUrl.origin === publicOrigin) return null;\n\t\t} catch {\n\t\t\t// Malformed Origin — fall through to reject\n\t\t}\n\n\t\treturn apiError(\"CSRF_REJECTED\", \"Cross-origin request blocked\", 403);\n\t}\n\n\t// No Origin header — non-browser client (curl, server-to-server).\n\t// Allow these through since CSRF is a browser-specific attack vector.\n\t// Server-to-server requests don't carry ambient credentials (cookies).\n\treturn null;\n}\n","/**\n * Strict Content-Security-Policy for /_emdash routes (admin + API).\n *\n * Applied via middleware header rather than Astro's built-in CSP because\n * Astro's auto-hashing defeats 'unsafe-inline' (CSP3 ignores 'unsafe-inline'\n * when hashes are present), which would break user-facing pages.\n *\n * img-src allows any HTTPS origin because the admin renders user content that\n * may reference external images (migrations, external hosting, embeds).\n * Plugin security does not rely on img-src -- plugins run in V8 isolates with\n * no DOM access. connect-src stays at 'self' unless the experimental registry\n * and/or the configured storage endpoint (for direct-to-S3 signed uploads)\n * are configured, in which case those origins are allowed too.\n */\nimport type { RegistryConfigInput } from \"../../registry/types.js\";\nimport type { Storage } from \"../../storage/types.js\";\nimport type { StorageDescriptor } from \"../storage/types.js\";\n\n/** Entrypoint constant used by the `s3()` adapter (see `astro/storage/adapters.ts`). */\nconst S3_ADAPTER_ENTRYPOINT = \"emdash/storage/s3\";\n\n/**\n * Storage entrypoints are free to shape their config however they like, so\n * `endpoint` isn't a known field on `StorageDescriptor[\"config\"]` -- only\n * S3-compatible adapters (R2, S3, Minio, ...) set it. Anything else (e.g.\n * local filesystem storage) simply has no `endpoint` to allow.\n *\n * The `s3()` adapter resolves any field omitted from its config -- including\n * `endpoint` -- from the matching `S3_*` env var at runtime (see\n * `storage/s3.ts`'s `resolveS3Config`). A site configured as `s3({ ... })`\n * with only `S3_ENDPOINT` set has no `endpoint` in the descriptor's config,\n * so fall back to that env var for S3-adapter storage. Custom adapters can\n * expose their runtime upload origin through `getClientUploadOrigin()`.\n */\nexport function getConfiguredStorageEndpoint(\n\tstorage: StorageDescriptor | undefined,\n\truntimeStorage?: Pick<Storage, \"getClientUploadOrigin\"> | null,\n): string | undefined {\n\tconst config = storage?.config;\n\tif (typeof config === \"object\" && config !== null && \"endpoint\" in config) {\n\t\tconst endpoint = config.endpoint;\n\t\tif (typeof endpoint === \"string\") return endpoint;\n\t}\n\n\tif (storage?.entrypoint === S3_ADAPTER_ENTRYPOINT) {\n\t\tconst envEndpoint =\n\t\t\ttypeof process !== \"undefined\" && process.env ? process.env.S3_ENDPOINT : undefined;\n\t\tif (envEndpoint) return envEndpoint;\n\t}\n\n\treturn runtimeStorage?.getClientUploadOrigin?.();\n}\n\nfunction getRegistryAggregatorOrigin(\n\tregistry: RegistryConfigInput | undefined,\n): string | undefined {\n\tconst aggregatorUrl = typeof registry === \"string\" ? registry : registry?.aggregatorUrl;\n\tif (!aggregatorUrl) return undefined;\n\n\ttry {\n\t\tconst url = new URL(aggregatorUrl);\n\t\tif (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n\t\treturn url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction getHttpOrigin(rawUrl: string | undefined): string | undefined {\n\tif (!rawUrl) return undefined;\n\n\ttry {\n\t\tconst url = new URL(rawUrl);\n\t\tif (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n\t\treturn url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function buildEmDashCsp(registry?: RegistryConfigInput, storageEndpoint?: string): string {\n\tconst connectSrc = [\"connect-src 'self'\"];\n\tconst origins = new Set<string>();\n\tconst registryAggregatorOrigin = getRegistryAggregatorOrigin(registry);\n\tif (registryAggregatorOrigin) origins.add(registryAggregatorOrigin);\n\tconst storageOrigin = getHttpOrigin(storageEndpoint);\n\tif (storageOrigin) origins.add(storageOrigin);\n\tconnectSrc.push(...origins);\n\n\treturn [\n\t\t\"default-src 'self'\",\n\t\t\"script-src 'self' 'unsafe-inline'\",\n\t\t\"style-src 'self' 'unsafe-inline'\",\n\t\tconnectSrc.join(\" \"),\n\t\t\"form-action 'self'\",\n\t\t\"frame-src 'self' https:\",\n\t\t\"frame-ancestors 'none'\",\n\t\t\"img-src 'self' https: data: blob:\",\n\t\t\"media-src 'self' blob: https:\",\n\t\t\"object-src 'none'\",\n\t\t\"base-uri 'self'\",\n\t].join(\"; \");\n}\n","/**\n * Auth middleware for admin routes\n *\n * Checks if the user is authenticated and has appropriate permissions.\n * Supports two auth modes:\n * - Passkey (default): Session-based auth with passkey login\n * - External providers: JWT-based auth (Cloudflare Access, etc.)\n *\n * This middleware runs AFTER the setup middleware - so if we get here,\n * we know setup is complete and users exist.\n */\n\nimport type { User, RoleLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { defineMiddleware } from \"astro:middleware\";\nimport { ulid } from \"ulidx\";\n// Import auth provider via virtual module (statically bundled)\n// This avoids dynamic import issues in Cloudflare Workers\nimport { authenticate as virtualAuthenticate } from \"virtual:emdash/auth\";\n// @ts-ignore - virtual module\nimport virtualConfig from \"virtual:emdash/config\";\n\nimport { checkPublicCsrf } from \"../../api/csrf.js\";\nimport { apiError } from \"../../api/error.js\";\nimport { getPublicOrigin } from \"../../api/public-url.js\";\n\n/** Cache headers for middleware error responses (matches API_CACHE_HEADERS in api/error.ts) */\nconst MW_CACHE_HEADERS = {\n\t\"Cache-Control\": \"private, no-store\",\n} as const;\nimport {\n\tresolveApiToken,\n\tresolveOAuthToken,\n\ttype ResolvedBearerToken,\n} from \"../../api/handlers/api-tokens.js\";\nimport { hasScope, TRANSFER_SCOPES } from \"../../auth/api-tokens.js\";\nimport { getAuthMode, type ExternalAuthMode } from \"../../auth/mode.js\";\nimport type { ExternalAuthConfig } from \"../../auth/types.js\";\nimport { getRegistryConfigInput } from \"../../registry/config.js\";\nimport { resolveSessionUser } from \"../session-user.js\";\nimport type { EmDashHandlers } from \"../types.js\";\nimport { buildEmDashCsp, getConfiguredStorageEndpoint } from \"./csp.js\";\n\ndeclare global {\n\tnamespace App {\n\t\tinterface Locals {\n\t\t\tuser?: User;\n\t\t\t/** Token scopes when authenticated via API token or OAuth token. Undefined for session auth. */\n\t\t\ttokenScopes?: string[];\n\t\t\t/** Id of the API or OAuth token the request authenticated with. Undefined for session auth. */\n\t\t\ttokenId?: string;\n\t\t\temdash?: EmDashHandlers;\n\t\t}\n\t\tinterface SessionData {\n\t\t\tuser: { id: string };\n\t\t\thasSeenWelcome: boolean;\n\t\t}\n\t}\n}\n\n// Role level constants (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\nconst MCP_ENDPOINT_PATH = \"/_emdash/api/mcp\";\nconst COMMENT_SUBMISSION_PATH = /^\\/_emdash\\/api\\/comments\\/[^/]+\\/[^/]+\\/?$/;\n\nfunction isUnsafeMethod(method: string): boolean {\n\treturn method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\";\n}\n\nfunction csrfRejectedResponse(): Response {\n\treturn apiError(\"CSRF_REJECTED\", \"Missing required header\", 403);\n}\n\nfunction mcpUnauthorizedResponse(\n\turl: URL,\n\tconfig?: Parameters<typeof getPublicOrigin>[1],\n): Response {\n\tconst origin = getPublicOrigin(url, config);\n\tconst response = apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t// Preserve the OAuth discovery header so MCP clients can find the auth server.\n\tresponse.headers.set(\n\t\t\"WWW-Authenticate\",\n\t\t`Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`,\n\t);\n\treturn response;\n}\n\n/**\n * API routes that skip auth — each handles its own access control.\n *\n * Prefix entries match any path starting with that prefix.\n * Exact entries (no trailing slash or wildcard) match that path only.\n */\nconst PUBLIC_API_PREFIXES = [\n\t\"/_emdash/api/setup\",\n\t\"/_emdash/api/auth/login\",\n\t\"/_emdash/api/auth/register\",\n\t\"/_emdash/api/auth/dev-bypass\",\n\t\"/_emdash/api/auth/signup/\",\n\t\"/_emdash/api/auth/magic-link/\",\n\t\"/_emdash/api/auth/invite/\",\n\t\"/_emdash/api/auth/oauth/\",\n\t\"/_emdash/api/oauth/device/token\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/comments/\",\n\t\"/_emdash/api/media/file/\",\n\t\"/_emdash/.well-known/\",\n];\n\nconst PUBLIC_API_EXACT = new Set([\n\t\"/_emdash/api/auth/passkey/options\",\n\t\"/_emdash/api/auth/passkey/verify\",\n\t\"/_emdash/api/auth/mode\",\n\t\"/_emdash/api/health\",\n\t\"/_emdash/api/site/domain-proof\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/snapshot\",\n\t\"/_emdash/api/visual-editing/toolbar-labels\",\n\t// Public site search — read-only. Unauthenticated callers only see\n\t// published content: /search forces status='published' without the\n\t// content:read_drafts permission and /suggest hardcodes it. Admin endpoints\n\t// (/enable, /rebuild, /stats) remain private because they're not in this set.\n\t\"/_emdash/api/search\",\n\t\"/_emdash/api/search/suggest\",\n]);\n\n// Build merged public routes at module load from auth provider descriptors.\n// Routes ending with \"/\" are treated as prefixes; all others are exact matches.\nconst { exact: _providerExactRoutes, prefixes: _providerPrefixRoutes } = (() => {\n\tconst exact = new Set<string>();\n\tconst prefixes: string[] = [];\n\tif (!virtualConfig?.authProviders) return { exact, prefixes };\n\tfor (const route of virtualConfig.authProviders.flatMap((p) => p.publicRoutes ?? [])) {\n\t\tif (route.endsWith(\"/\")) {\n\t\t\tprefixes.push(route);\n\t\t} else {\n\t\t\texact.add(route);\n\t\t}\n\t}\n\treturn { exact, prefixes };\n})();\n\n/**\n * OAuth protocol endpoints that are CSRF-exempt by design.\n *\n * These are RFC-defined endpoints (RFC 6749 §3.2, RFC 7591 §3, RFC 8628 §3.1/§3.4)\n * specified to be called cross-origin by external clients (MCP clients, CLIs,\n * native apps). They authenticate each request on its own merits:\n *\n * - /oauth/token: requires PKCE code_verifier, device_code, or refresh_token\n * - /oauth/register: RFC 7591 dynamic client registration — anonymous by design\n * - /oauth/device/code: RFC 8628 device flow initiation — anonymous by design\n * - /oauth/device/token: requires device_code the client already holds\n *\n * None of these rely on ambient cookie credentials, so browser-based CSRF\n * attacks have nothing to exploit. The endpoints themselves advertise\n * `Access-Control-Allow-Origin: *`. Note: /oauth/device/authorize (the user\n * consent step) is NOT in this list — it is session-authenticated.\n */\nconst CSRF_EXEMPT_PUBLIC_ROUTES = new Set([\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/device/token\",\n]);\n\nfunction isPublicEmDashRoute(pathname: string): boolean {\n\tif (PUBLIC_API_EXACT.has(pathname)) return true;\n\tif (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;\n\tif (_providerExactRoutes.has(pathname)) return true;\n\tif (_providerPrefixRoutes.some((p) => pathname.startsWith(p))) return true;\n\tif (import.meta.env.DEV && pathname === \"/_emdash/api/typegen\") return true;\n\treturn false;\n}\n\nfunction isCsrfExemptPublicRoute(pathname: string): boolean {\n\treturn CSRF_EXEMPT_PUBLIC_ROUTES.has(pathname);\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { url } = context;\n\n\t// Only check auth on admin routes and API routes\n\tconst isAdminRoute = url.pathname.startsWith(\"/_emdash/admin\");\n\tconst isSetupRoute = url.pathname.startsWith(\"/_emdash/admin/setup\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\tconst isPublicApiRoute = isPublicEmDashRoute(url.pathname);\n\n\tconst isPublicRoute = !isAdminRoute && !isApiRoute;\n\n\t// Public API routes skip auth but still need CSRF protection on state-changing methods.\n\t// We check Origin header against the request host (same approach as Astro's checkOrigin).\n\t// This prevents cross-origin form submissions and fetch requests from malicious sites.\n\tif (isPublicApiRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (\n\t\t\tisUnsafeMethod(method) &&\n\t\t\t!isCsrfExemptPublicRoute(url.pathname) // OAuth protocol endpoints — cross-origin by design\n\t\t) {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\tif (method === \"POST\" && COMMENT_SUBMISSION_PATH.test(url.pathname)) {\n\t\t\treturn handlePublicRouteAuth(context, next);\n\t\t}\n\t\t// Search filters drafts by permission, so resolve the session user when\n\t\t// one exists; anonymous callers skip the user DB lookup. Bearer tokens\n\t\t// are not resolved on public routes; token callers continue to receive\n\t\t// published results only.\n\t\tif (url.pathname === \"/_emdash/api/search\") {\n\t\t\treturn handlePublicRouteAuth(context, next);\n\t\t}\n\t\treturn next();\n\t}\n\n\t// Plugin routes: soft auth (resolve user if credentials present, but never block).\n\t// The catch-all handler decides per-route whether auth is required (public vs private).\n\t// Public plugin routes that accept POST are vulnerable to cross-origin form submissions,\n\t// so we apply the same Origin-based CSRF check as other public routes.\n\tconst isPluginRoute = url.pathname.startsWith(\"/_emdash/api/plugins/\");\n\tif (isPluginRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\treturn handlePluginRouteAuth(context, next);\n\t}\n\n\t// Setup routes: skip auth but still enforce CSRF on state-changing methods\n\tif (isSetupRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\t\tif (csrfHeader !== \"1\") {\n\t\t\t\treturn apiError(\"CSRF_REJECTED\", \"Missing required header\", 403);\n\t\t\t}\n\t\t}\n\t\tconst response = await next();\n\t\tif (!import.meta.env.DEV) {\n\t\t\tresponse.headers.set(\n\t\t\t\t\"Content-Security-Policy\",\n\t\t\t\tbuildEmDashCsp(\n\t\t\t\t\tgetRegistryConfigInput(context.locals.emdash?.config.registry),\n\t\t\t\t\tgetConfiguredStorageEndpoint(\n\t\t\t\t\t\tcontext.locals.emdash?.config.storage,\n\t\t\t\t\t\tcontext.locals.emdash?.storage,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\t// For public routes: soft auth check (set locals.user if session exists, but never block)\n\tif (isPublicRoute) {\n\t\treturn handlePublicRouteAuth(context, next);\n\t}\n\n\t// --- Everything below is /_emdash (admin + API) ---\n\n\t// Try Bearer token auth first (API tokens and OAuth tokens).\n\t// If successful, skip CSRF (tokens aren't ambient credentials like cookies).\n\tconst bearerResult = await handleBearerAuth(context);\n\n\tif (bearerResult === \"invalid\") {\n\t\tconst response = apiError(\"INVALID_TOKEN\", \"Invalid or expired token\", 401);\n\t\t// Add WWW-Authenticate header on MCP endpoint 401s to trigger OAuth discovery\n\t\tif (url.pathname === \"/_emdash/api/mcp\") {\n\t\t\tconst origin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tresponse.headers.set(\n\t\t\t\t\"WWW-Authenticate\",\n\t\t\t\t`Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`,\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\tconst isTokenAuth = bearerResult === \"authenticated\";\n\n\t// MCP discovery/tooling is bearer-only. Session/external auth should never\n\t// be consulted for this endpoint, and unauthenticated requests must return\n\t// the OAuth discovery-style 401 response.\n\tconst method = context.request.method.toUpperCase();\n\tconst isMcpEndpoint = url.pathname === MCP_ENDPOINT_PATH;\n\tif (isMcpEndpoint && !isTokenAuth) {\n\t\treturn mcpUnauthorizedResponse(url, context.locals.emdash?.config);\n\t}\n\n\t// CSRF protection: require X-EmDash-Request header on state-changing requests.\n\t// Skip for token-authenticated requests (tokens aren't ambient credentials).\n\t// Browsers block cross-origin custom headers, so this prevents CSRF without tokens.\n\t// OAuth authorize consent is exempt: it's a standard HTML form POST that can't\n\t// include custom headers. The consent flow is protected by session + single-use codes.\n\tconst isOAuthConsent = url.pathname.startsWith(\"/_emdash/oauth/authorize\");\n\tif (\n\t\tisApiRoute &&\n\t\t!isTokenAuth &&\n\t\t!isOAuthConsent &&\n\t\tisUnsafeMethod(method) &&\n\t\t!isPublicApiRoute\n\t) {\n\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\tif (csrfHeader !== \"1\") {\n\t\t\treturn csrfRejectedResponse();\n\t\t}\n\t}\n\n\t// If already authenticated via Bearer token, enforce scope then skip session/external auth\n\tif (isTokenAuth) {\n\t\t// Enforce API token scopes based on URL pattern + HTTP method\n\t\tconst scopeError = enforceTokenScope(url.pathname, method, context.locals.tokenScopes);\n\t\tif (scopeError) return scopeError;\n\n\t\tconst response = await next();\n\t\tif (!import.meta.env.DEV) {\n\t\t\tresponse.headers.set(\n\t\t\t\t\"Content-Security-Policy\",\n\t\t\t\tbuildEmDashCsp(\n\t\t\t\t\tgetRegistryConfigInput(context.locals.emdash?.config.registry),\n\t\t\t\t\tgetConfiguredStorageEndpoint(\n\t\t\t\t\t\tcontext.locals.emdash?.config.storage,\n\t\t\t\t\t\tcontext.locals.emdash?.storage,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\tconst response = await handleEmDashAuth(context, next);\n\n\t// Set strict CSP on all /_emdash responses (prod only)\n\tif (!import.meta.env.DEV) {\n\t\tresponse.headers.set(\n\t\t\t\"Content-Security-Policy\",\n\t\t\tbuildEmDashCsp(\n\t\t\t\tgetRegistryConfigInput(context.locals.emdash?.config.registry),\n\t\t\t\tgetConfiguredStorageEndpoint(\n\t\t\t\t\tcontext.locals.emdash?.config.storage,\n\t\t\t\t\tcontext.locals.emdash?.storage,\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t}\n\n\treturn response;\n});\n\n/**\n * Auth handling for /_emdash routes. Returns a Response from either\n * an auth error/redirect or the downstream route handler.\n */\nasync function handleEmDashAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { url, locals } = context;\n\tconst { emdash } = locals;\n\n\t// Pages an anonymous visitor must be able to reach: login itself, and the\n\t// two token-bearing pages that emails link to.\n\tconst isPublicAdminRoute =\n\t\turl.pathname.startsWith(\"/_emdash/admin/login\") ||\n\t\turl.pathname.startsWith(\"/_emdash/admin/signup\") ||\n\t\turl.pathname.startsWith(\"/_emdash/admin/invite/accept\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\n\tif (!emdash?.db) {\n\t\t// No database - let the admin handle this error\n\t\treturn next();\n\t}\n\n\t// Determine auth mode from config\n\tconst authMode = getAuthMode(emdash.config);\n\n\tif (authMode.type === \"external\") {\n\t\t// In dev mode, fall back to passkey auth since external JWT won't be present\n\t\tif (import.meta.env.DEV) {\n\t\t\tif (isPublicAdminRoute) {\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\treturn handlePasskeyAuth(context, next, isApiRoute);\n\t\t}\n\n\t\t// External auth provider (Cloudflare Access, etc.)\n\t\treturn handleExternalAuth(context, next, authMode, isApiRoute);\n\t}\n\n\t// Passkey authentication (default)\n\tif (isPublicAdminRoute) {\n\t\treturn next();\n\t}\n\n\treturn handlePasskeyAuth(context, next, isApiRoute);\n}\n\n/**\n * Plugin-route auth. Resolves the user in three steps, stopping at the first that\n * applies:\n *\n * 1. Bearer token (all modes). A valid token authenticates; an invalid/expired one\n *    returns 401 (we never silently downgrade a bad token to anonymous).\n * 2. External provider — only for a *private* route in production external-auth\n *    mode. Here `handleExternalAuth` is the sole authority: the provider (e.g.\n *    Cloudflare Access) is re-verified on every request, so it hard-blocks with\n *    401 on failure. It does persist an EmDash session (so public pages can\n *    identify the user), but on these routes that session is deliberately NOT\n *    consulted as a fallback — the provider check is authoritative every time.\n * 3. Session — everything else (non-external mode, DEV, and all public routes).\n *    This is soft: it sets `locals.user` if a session exists but never blocks.\n *\n * Public routes are always allowed through. The catch-all handler still enforces\n * the `plugins:manage` permission and CSRF for private invocations.\n */\nasync function handlePluginRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals, url } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Try Bearer token auth first (API tokens and OAuth tokens)\n\t\tconst bearerResult = await handleBearerAuth(context);\n\t\tif (bearerResult === \"authenticated\") {\n\t\t\t// User and tokenScopes are set on locals by handleBearerAuth\n\t\t\treturn next();\n\t\t}\n\t\tif (bearerResult === \"invalid\") {\n\t\t\t// A token was presented but is invalid/expired — return 401 so the\n\t\t\t// caller knows their token is bad (don't silently downgrade to no-auth).\n\t\t\treturn apiError(\"INVALID_TOKEN\", \"Invalid or expired token\", 401);\n\t\t}\n\t\t// \"none\" — no token presented, try external/session auth below.\n\t} catch (error) {\n\t\tconsole.error(\"Plugin route bearer auth error:\", error);\n\t}\n\n\tconst authMode = getAuthMode(emdash?.config);\n\tif (\n\t\tauthMode.type === \"external\" &&\n\t\t!import.meta.env.DEV &&\n\t\t!isPublicPluginApiRoute(url.pathname, emdash)\n\t) {\n\t\treturn handleExternalAuth(context, next, authMode, true);\n\t}\n\n\ttry {\n\t\t// Try session auth (sets locals.user if session exists)\n\t\tconst { session } = context;\n\t\tconst sessionUser = await resolveSessionUser(session);\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\t// Log but don't block — public routes should still work without session\n\t\tconsole.error(\"Plugin route session auth error:\", error);\n\t}\n\n\treturn next();\n}\n\nfunction isPublicPluginApiRoute(pathname: string, emdash: EmDashHandlers | undefined): boolean {\n\tconst prefix = \"/_emdash/api/plugins/\";\n\tconst route = pathname.slice(prefix.length);\n\tconst slashIndex = route.indexOf(\"/\");\n\tif (slashIndex <= 0 || !emdash?.getPluginRouteMeta) return false;\n\n\treturn (\n\t\temdash.getPluginRouteMeta(route.slice(0, slashIndex), route.slice(slashIndex))?.public === true\n\t);\n}\n\n/**\n * Soft auth check for public routes with edit mode cookie.\n * Checks the session and sets locals.user if valid, but never blocks the request.\n */\nasync function handlePublicRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\tconst sessionUser = await resolveSessionUser(session);\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch {\n\t\t// Silently continue — public page should render normally\n\t}\n\n\treturn next();\n}\n\n/**\n * Handle external auth provider authentication (Cloudflare Access, etc.)\n */\nasync function handleExternalAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tauthMode: ExternalAuthMode,\n\t_isApiRoute: boolean,\n): Promise<Response> {\n\tconst { locals, request } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Use the authenticate function from the virtual module\n\t\t// (statically imported at build time to work with Cloudflare Workers)\n\t\tif (typeof virtualAuthenticate !== \"function\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Auth provider ${authMode.entrypoint} does not export an authenticate function`,\n\t\t\t);\n\t\t}\n\n\t\t// Authenticate via the provider\n\t\tconst authResult = await virtualAuthenticate(request, authMode.config);\n\n\t\t// Get external auth config for auto-provision settings\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowing AuthModeConfig to ExternalAuthConfig after provider check\n\t\tconst externalConfig = authMode.config as ExternalAuthConfig;\n\n\t\t// Find or create user\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tlet user = await adapter.getUserByEmail(authResult.email);\n\n\t\tif (!user) {\n\t\t\t// User doesn't exist\n\t\t\tif (externalConfig.autoProvision === false) {\n\t\t\t\treturn new Response(\"User not authorized\", {\n\t\t\t\t\tstatus: 403,\n\t\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Check if this is the first user (they become admin)\n\t\t\tconst userCount = await emdash.db\n\t\t\t\t.selectFrom(\"users\")\n\t\t\t\t.select(emdash.db.fn.count(\"id\").as(\"count\"))\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tconst isFirstUser = Number(userCount?.count ?? 0) === 0;\n\t\t\tconst role = isFirstUser ? ROLE_ADMIN : authResult.role;\n\n\t\t\t// Create user\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: authResult.email,\n\t\t\t\tname: authResult.name,\n\t\t\t\trole,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = await adapter.getUserByEmail(authResult.email);\n\n\t\t\tconsole.log(\n\t\t\t\t`[external-auth] Provisioned user: ${authResult.email} (role: ${role}, first: ${isFirstUser})`,\n\t\t\t);\n\t\t} else {\n\t\t\t// User exists - check if we need to sync anything\n\t\t\tconst updates: Record<string, unknown> = {};\n\t\t\tlet newName: string | undefined;\n\t\t\tlet newRole: RoleLevel | undefined;\n\n\t\t\tif (externalConfig.syncName !== false && authResult.name && user.name !== authResult.name) {\n\t\t\t\tnewName = authResult.name;\n\t\t\t\tupdates.name = newName;\n\t\t\t}\n\n\t\t\t// Sync role if enabled\n\t\t\tif (externalConfig.syncRoles && user.role !== authResult.role) {\n\t\t\t\tnewRole = authResult.role;\n\t\t\t\tupdates.role = newRole;\n\t\t\t}\n\n\t\t\tif (Object.keys(updates).length > 0) {\n\t\t\t\tupdates.updated_at = new Date().toISOString();\n\t\t\t\tawait emdash.db.updateTable(\"users\").set(updates).where(\"id\", \"=\", user.id).execute();\n\n\t\t\t\tuser = {\n\t\t\t\t\t...user,\n\t\t\t\t\t...(newName ? { name: newName } : {}),\n\t\t\t\t\t...(newRole ? { role: newRole } : {}),\n\t\t\t\t};\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`[external-auth] Updated user ${authResult.email}:`,\n\t\t\t\t\tObject.keys(updates).filter((k) => k !== \"updated_at\"),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (!user) {\n\t\t\t// This shouldn't happen, but handle it gracefully\n\t\t\treturn new Response(\"Failed to provision user\", {\n\t\t\t\tstatus: 500,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Check if user is disabled locally\n\t\tif (user.disabled) {\n\t\t\treturn new Response(\"Account disabled\", {\n\t\t\t\tstatus: 403,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Set user in locals\n\t\tlocals.user = user;\n\n\t\t// Persist to session so public pages can identify the user\n\t\t// (external auth headers are only verified on /_emdash routes)\n\t\tconst { session } = context;\n\t\tsession?.set(\"user\", { id: user.id });\n\n\t\treturn next();\n\t} catch (error) {\n\t\tconsole.error(\"[external-auth] Auth error:\", error);\n\n\t\treturn new Response(\"Authentication failed\", {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t});\n\t}\n}\n\n/**\n * Try to authenticate via Bearer token (API token or OAuth token).\n *\n * Returns:\n * - \"authenticated\" if token is valid and user is resolved\n * - \"invalid\" if a token was provided but is invalid/expired\n * - \"none\" if no Bearer token was provided\n */\nasync function handleBearerAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n): Promise<\"authenticated\" | \"invalid\" | \"none\"> {\n\tconst authHeader = context.request.headers.get(\"Authorization\");\n\tif (!authHeader?.startsWith(\"Bearer \")) return \"none\";\n\n\tconst token = authHeader.slice(7);\n\tif (!token) return \"none\";\n\n\tconst { locals } = context;\n\tconst { emdash } = locals;\n\tif (!emdash?.db) return \"none\";\n\n\t// Resolve token based on prefix\n\tlet resolved: ResolvedBearerToken | null = null;\n\n\tif (token.startsWith(\"ec_pat_\")) {\n\t\tresolved = await resolveApiToken(emdash.db, token);\n\t} else if (token.startsWith(\"ec_oat_\")) {\n\t\tresolved = await resolveOAuthToken(emdash.db, token);\n\t} else {\n\t\t// Unknown token format\n\t\treturn \"invalid\";\n\t}\n\n\tif (!resolved) return \"invalid\";\n\n\t// Look up the user\n\tconst adapter = createKyselyAdapter(emdash.db);\n\tconst user = await adapter.getUserById(resolved.userId);\n\n\tif (!user || user.disabled) return \"invalid\";\n\n\t// Set user and scopes on locals\n\tlocals.user = user;\n\tlocals.tokenScopes = resolved.scopes;\n\tlocals.tokenId = resolved.tokenId;\n\n\treturn \"authenticated\";\n}\n\n/**\n * Handle passkey (session-based) authentication\n */\nasync function handlePasskeyAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tisApiRoute: boolean,\n): Promise<Response> {\n\tconst { url, locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Check session for user (session.get returns a Promise)\n\t\tconst sessionUser = await resolveSessionUser(session);\n\n\t\tif (!sessionUser?.id) {\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\t// Keep the query string: a token-bearing link that lands here must\n\t\t\t// still carry its token after login.\n\t\t\tloginUrl.searchParams.set(\"redirect\", url.pathname + url.search);\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Get full user from database\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await adapter.getUserById(sessionUser.id);\n\n\t\tif (!user) {\n\t\t\t// User no longer exists - clear session\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 401);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Check if user is disabled\n\t\tif (user.disabled) {\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"ACCOUNT_DISABLED\", \"Account disabled\", 403);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\tloginUrl.searchParams.set(\"error\", \"account_disabled\");\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Set user in locals for use by routes\n\t\tlocals.user = user;\n\t} catch (error) {\n\t\tconsole.error(\"Auth middleware error:\", error);\n\t\t// On error, redirect to login\n\t\treturn context.redirect(\"/_emdash/admin/login\");\n\t}\n\n\treturn next();\n}\n\n// =============================================================================\n// Token scope enforcement\n// =============================================================================\n\n/**\n * Scope rules: ordered list of (pathPrefix, method, requiredScope) tuples.\n * First matching rule wins. Methods: \"*\" = any, \"WRITE\" = POST/PUT/PATCH/DELETE.\n * A list of scopes is satisfied by holding any one of them.\n *\n * Routes not matched by any rule default to \"admin\" scope (fail-closed).\n */\nconst SCOPE_RULES: Array<[prefix: string, method: string, scope: string | readonly string[]]> = [\n\t// Content routes\n\t[\"/_emdash/api/content\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/content\", \"WRITE\", \"content:write\"],\n\n\t// Media routes (excluding /file/ which is public)\n\t[\"/_emdash/api/media/file\", \"*\", \"media:read\"], // public anyway, but scope if token-authed\n\t[\"/_emdash/api/media\", \"GET\", \"media:read\"],\n\t[\"/_emdash/api/media\", \"WRITE\", \"media:write\"],\n\n\t// Schema routes\n\t[\"/_emdash/api/schema\", \"GET\", \"schema:read\"],\n\t[\"/_emdash/api/schema\", \"WRITE\", \"schema:write\"],\n\n\t// Taxonomy, menu, section, widget, revision — all content domain\n\t// GET uses content:read (implicit from taxonomies:read / menus:read via role).\n\t// WRITE uses the granular scope so tokens with only taxonomies:manage or\n\t// menus:manage are not rejected. content:write implicitly grants these via\n\t// IMPLICIT_SCOPE_GRANTS in @emdash-cms/auth.\n\t[\"/_emdash/api/taxonomies\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/taxonomies/bulk-tag\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/taxonomies\", \"WRITE\", \"taxonomies:manage\"],\n\t[\"/_emdash/api/menus\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/menus\", \"WRITE\", \"menus:manage\"],\n\t[\"/_emdash/api/sections\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/sections\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/widget-areas\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/widget-areas\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/revisions\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/revisions\", \"WRITE\", \"content:write\"],\n\n\t// Search\n\t[\"/_emdash/api/search\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/search\", \"WRITE\", \"admin\"],\n\n\t// Site transfer — must precede the generic /admin rule so a token holding\n\t// only a transfer scope reaches the route, which requires its specific one.\n\t[\"/_emdash/api/admin/transfer\", \"*\", TRANSFER_SCOPES],\n\n\t// Import, admin, plugins — all require admin scope\n\t[\"/_emdash/api/import\", \"*\", \"admin\"],\n\t[\"/_emdash/api/admin\", \"*\", \"admin\"],\n\t[\"/_emdash/api/plugins\", \"*\", \"admin\"],\n\n\t// Backups are a full-site content export and must precede the generic\n\t// settings rules, which would otherwise let a settings:read token through.\n\t[\"/_emdash/api/settings/backups\", \"*\", \"admin\"],\n\n\t// Settings — use granular scopes so tokens with settings:read or\n\t// settings:manage are not rejected at the middleware level.\n\t[\"/_emdash/api/settings\", \"GET\", \"settings:read\"],\n\t[\"/_emdash/api/settings\", \"WRITE\", \"settings:manage\"],\n];\n\nconst WRITE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Enforce API token scopes based on the request URL and HTTP method.\n * Returns a 403 Response if the scope is insufficient, or null if allowed.\n *\n * Session-authenticated requests (tokenScopes === undefined) are never checked.\n */\nfunction enforceTokenScope(\n\tpathname: string,\n\tmethod: string,\n\ttokenScopes: string[] | undefined,\n): Response | null {\n\t// Session auth — implicit full access, no scope restrictions\n\tif (!tokenScopes) return null;\n\n\t// MCP is authenticated here, but each tool enforces its own scope. A\n\t// blanket content:read/admin requirement would prevent plugin-scoped tokens\n\t// from reaching `mcp/server.ts`, where the actual tool policy lives.\n\tif (pathname === MCP_ENDPOINT_PATH) return null;\n\n\tconst isWrite = WRITE_METHODS.has(method);\n\n\tfor (const [prefix, ruleMethod, scope] of SCOPE_RULES) {\n\t\t// Match exact prefix or prefix followed by /\n\t\tif (pathname !== prefix && !pathname.startsWith(prefix + \"/\")) continue;\n\n\t\t// Check method match\n\t\tif (ruleMethod === \"*\" || (ruleMethod === \"WRITE\" && isWrite) || ruleMethod === method) {\n\t\t\tconst anyOf = typeof scope === \"string\" ? [scope] : scope;\n\t\t\tif (anyOf.some((required) => hasScope(tokenScopes, required))) return null;\n\n\t\t\treturn apiError(\n\t\t\t\t\"INSUFFICIENT_SCOPE\",\n\t\t\t\t`Token lacks required scope: ${anyOf.join(\" or \")}`,\n\t\t\t\t403,\n\t\t\t);\n\t\t}\n\t}\n\n\t// No rule matched — default to admin scope (fail-closed)\n\tif (hasScope(tokenScopes, \"admin\")) return null;\n\n\treturn apiError(\"INSUFFICIENT_SCOPE\", \"Token lacks required scope: admin\", 403);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,gBACf,SACA,KACA,cACkB;AAGlB,KADmB,QAAQ,QAAQ,IAAI,mBAAmB,KACvC,IAAK,QAAO;CAG/B,MAAM,SAAS,QAAQ,QAAQ,IAAI,SAAS;AAC5C,KAAI,QAAQ;AACX,MAAI;GACH,MAAM,YAAY,IAAI,IAAI,OAAO;AAEjC,OAAI,UAAU,WAAW,IAAI,OAAQ,QAAO;AAC5C,OAAI,gBAAgB,UAAU,WAAW,aAAc,QAAO;UACvD;AAIR,SAAO,SAAS,iBAAiB,gCAAgC,IAAI;;AAMtE,QAAO;;;;;;ACtCR,MAAM,wBAAwB;;;;;;;;;;;;;;AAe9B,SAAgB,6BACf,SACA,gBACqB;CACrB,MAAM,SAAS,SAAS;AACxB,KAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,cAAc,QAAQ;EAC1E,MAAM,WAAW,OAAO;AACxB,MAAI,OAAO,aAAa,SAAU,QAAO;;AAG1C,KAAI,SAAS,eAAe,uBAAuB;EAClD,MAAM,cACL,OAAO,YAAY,eAAe,QAAQ,MAAM,QAAQ,IAAI,cAAc;AAC3E,MAAI,YAAa,QAAO;;AAGzB,QAAO,gBAAgB,yBAAyB;;AAGjD,SAAS,4BACR,UACqB;CACrB,MAAM,gBAAgB,OAAO,aAAa,WAAW,WAAW,UAAU;AAC1E,KAAI,CAAC,cAAe,QAAO;AAE3B,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,cAAc;AAClC,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,SAAO,IAAI;SACJ;AACP;;;AAIF,SAAS,cAAc,QAAgD;AACtE,KAAI,CAAC,OAAQ,QAAO;AAEpB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,OAAO;AAC3B,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,SAAO,IAAI;SACJ;AACP;;;AAIF,SAAgB,eAAe,UAAgC,iBAAkC;CAChG,MAAM,aAAa,CAAC,qBAAqB;CACzC,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAA2B,4BAA4B,SAAS;AACtE,KAAI,yBAA0B,SAAQ,IAAI,yBAAyB;CACnE,MAAM,gBAAgB,cAAc,gBAAgB;AACpD,KAAI,cAAe,SAAQ,IAAI,cAAc;AAC7C,YAAW,KAAK,GAAG,QAAQ;AAE3B,QAAO;EACN;EACA;EACA;EACA,WAAW,KAAK,IAAI;EACpB;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,KAAK,KAAK;;;;;;AC1Eb,MAAM,mBAAmB,EACxB,iBAAiB,qBACjB;AAgCD,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,0BAA0B;AAEhC,SAAS,eAAe,QAAyB;AAChD,QAAO,WAAW,SAAS,WAAW,UAAU,WAAW;;AAG5D,SAAS,uBAAiC;AACzC,QAAO,SAAS,iBAAiB,2BAA2B,IAAI;;AAGjE,SAAS,wBACR,KACA,QACW;CACX,MAAM,SAAS,gBAAgB,KAAK,OAAO;CAC3C,MAAM,WAAW,SAAS,qBAAqB,qBAAqB,IAAI;AAExE,UAAS,QAAQ,IAChB,oBACA,6BAA6B,OAAO,wCACpC;AACD,QAAO;;;;;;;;AASR,MAAM,sBAAsB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAM,mBAAmB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAKA;CACA;CACA,CAAC;AAIF,MAAM,EAAE,OAAO,sBAAsB,UAAU,iCAAiC;CAC/E,MAAM,wBAAQ,IAAI,KAAa;CAC/B,MAAM,WAAqB,EAAE;AAC7B,KAAI,CAAC,eAAe,cAAe,QAAO;EAAE;EAAO;EAAU;AAC7D,MAAK,MAAM,SAAS,cAAc,cAAc,SAAS,MAAM,EAAE,gBAAgB,EAAE,CAAC,CACnF,KAAI,MAAM,SAAS,IAAI,CACtB,UAAS,KAAK,MAAM;KAEpB,OAAM,IAAI,MAAM;AAGlB,QAAO;EAAE;EAAO;EAAU;IACvB;;;;;;;;;;;;;;;;;;AAmBJ,MAAM,4BAA4B,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,oBAAoB,UAA2B;AACvD,KAAI,iBAAiB,IAAI,SAAS,CAAE,QAAO;AAC3C,KAAI,oBAAoB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACpE,KAAI,qBAAqB,IAAI,SAAS,CAAE,QAAO;AAC/C,KAAI,sBAAsB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACtE,KAAI,OAAO,KAAK,IAAI,OAAO,aAAa,uBAAwB,QAAO;AACvE,QAAO;;AAGR,SAAS,wBAAwB,UAA2B;AAC3D,QAAO,0BAA0B,IAAI,SAAS;;AAG/C,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,QAAQ;CAGhB,MAAM,eAAe,IAAI,SAAS,WAAW,iBAAiB;CAC9D,MAAM,eAAe,IAAI,SAAS,WAAW,uBAAuB;CACpE,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;CAC1D,MAAM,mBAAmB,oBAAoB,IAAI,SAAS;CAE1D,MAAM,gBAAgB,CAAC,gBAAgB,CAAC;AAKxC,KAAI,kBAAkB;EACrB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MACC,eAAe,OAAO,IACtB,CAAC,wBAAwB,IAAI,SAAS,EACrC;GACD,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,MAAI,WAAW,UAAU,wBAAwB,KAAK,IAAI,SAAS,CAClE,QAAO,sBAAsB,SAAS,KAAK;AAM5C,MAAI,IAAI,aAAa,sBACpB,QAAO,sBAAsB,SAAS,KAAK;AAE5C,SAAO,MAAM;;AAQd,KADsB,IAAI,SAAS,WAAW,wBAAwB,EACnD;EAClB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;GAClE,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,SAAO,sBAAsB,SAAS,KAAK;;AAI5C,KAAI,cAAc;EACjB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAEvD;OADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,SAAS,iBAAiB,2BAA2B,IAAI;;EAGlE,MAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eACC,uBAAuB,QAAQ,OAAO,QAAQ,OAAO,SAAS,EAC9D,6BACC,QAAQ,OAAO,QAAQ,OAAO,SAC9B,QAAQ,OAAO,QAAQ,QACvB,CACD,CACD;AAEF,SAAO;;AAIR,KAAI,cACH,QAAO,sBAAsB,SAAS,KAAK;CAO5C,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AAEpD,KAAI,iBAAiB,WAAW;EAC/B,MAAM,WAAW,SAAS,iBAAiB,4BAA4B,IAAI;AAE3E,MAAI,IAAI,aAAa,oBAAoB;GACxC,MAAM,SAAS,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;AAClE,YAAS,QAAQ,IAChB,oBACA,6BAA6B,OAAO,wCACpC;;AAEF,SAAO;;CAGR,MAAM,cAAc,iBAAiB;CAKrC,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AAEnD,KADsB,IAAI,aAAa,qBAClB,CAAC,YACrB,QAAO,wBAAwB,KAAK,QAAQ,OAAO,QAAQ,OAAO;CAQnE,MAAM,iBAAiB,IAAI,SAAS,WAAW,2BAA2B;AAC1E,KACC,cACA,CAAC,eACD,CAAC,kBACD,eAAe,OAAO,IACtB,CAAC,kBAGD;MADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,sBAAsB;;AAK/B,KAAI,aAAa;EAEhB,MAAM,aAAa,kBAAkB,IAAI,UAAU,QAAQ,QAAQ,OAAO,YAAY;AACtF,MAAI,WAAY,QAAO;EAEvB,MAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eACC,uBAAuB,QAAQ,OAAO,QAAQ,OAAO,SAAS,EAC9D,6BACC,QAAQ,OAAO,QAAQ,OAAO,SAC9B,QAAQ,OAAO,QAAQ,QACvB,CACD,CACD;AAEF,SAAO;;CAGR,MAAM,WAAW,MAAM,iBAAiB,SAAS,KAAK;AAGtD,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eACC,uBAAuB,QAAQ,OAAO,QAAQ,OAAO,SAAS,EAC9D,6BACC,QAAQ,OAAO,QAAQ,OAAO,SAC9B,QAAQ,OAAO,QAAQ,QACvB,CACD,CACD;AAGF,QAAO;EACN;;;;;AAMF,eAAe,iBACd,SACA,MACoB;CACpB,MAAM,EAAE,KAAK,WAAW;CACxB,MAAM,EAAE,WAAW;CAInB,MAAM,qBACL,IAAI,SAAS,WAAW,uBAAuB,IAC/C,IAAI,SAAS,WAAW,wBAAwB,IAChD,IAAI,SAAS,WAAW,+BAA+B;CACxD,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;AAE1D,KAAI,CAAC,QAAQ,GAEZ,QAAO,MAAM;CAId,MAAM,WAAW,YAAY,OAAO,OAAO;AAE3C,KAAI,SAAS,SAAS,YAAY;AAEjC,MAAI,OAAO,KAAK,IAAI,KAAK;AACxB,OAAI,mBACH,QAAO,MAAM;AAGd,UAAO,kBAAkB,SAAS,MAAM,WAAW;;AAIpD,SAAO,mBAAmB,SAAS,MAAM,UAAU,WAAW;;AAI/D,KAAI,mBACH,QAAO,MAAM;AAGd,QAAO,kBAAkB,SAAS,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;AAqBpD,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,QAAQ,QAAQ;CACxB,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AACpD,MAAI,iBAAiB,gBAEpB,QAAO,MAAM;AAEd,MAAI,iBAAiB,UAGpB,QAAO,SAAS,iBAAiB,4BAA4B,IAAI;UAG1D,OAAO;AACf,UAAQ,MAAM,mCAAmC,MAAM;;CAGxD,MAAM,WAAW,YAAY,QAAQ,OAAO;AAC5C,KACC,SAAS,SAAS,cAClB,CAAC,OAAO,KAAK,IAAI,OACjB,CAAC,uBAAuB,IAAI,UAAU,OAAO,CAE7C,QAAO,mBAAmB,SAAS,MAAM,UAAU,KAAK;AAGzD,KAAI;EAEH,MAAM,EAAE,YAAY;EACpB,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;UAGR,OAAO;AAEf,UAAQ,MAAM,oCAAoC,MAAM;;AAGzD,QAAO,MAAM;;AAGd,SAAS,uBAAuB,UAAkB,QAA6C;CAE9F,MAAM,QAAQ,SAAS,MAAM,GAAc;CAC3C,MAAM,aAAa,MAAM,QAAQ,IAAI;AACrC,KAAI,cAAc,KAAK,CAAC,QAAQ,mBAAoB,QAAO;AAE3D,QACC,OAAO,mBAAmB,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,MAAM,WAAW,CAAC,EAAE,WAAW;;;;;;AAQ7F,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;EACH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;SAGT;AAIR,QAAO,MAAM;;;;;AAMd,eAAe,mBACd,SACA,MACA,UACA,aACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;AAGH,MAAI,OAAOA,iBAAwB,WAClC,OAAM,IAAI,MACT,iBAAiB,SAAS,WAAW,2CACrC;EAIF,MAAM,aAAa,MAAMA,aAAoB,SAAS,SAAS,OAAO;EAItE,MAAM,iBAAiB,SAAS;EAGhC,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,IAAI,OAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAEzD,MAAI,CAAC,MAAM;AAEV,OAAI,eAAe,kBAAkB,MACpC,QAAO,IAAI,SAAS,uBAAuB;IAC1C,QAAQ;IACR,SAAS;KAAE,gBAAgB;KAAc,GAAG;KAAkB;IAC9D,CAAC;GAIH,MAAM,YAAY,MAAM,OAAO,GAC7B,WAAW,QAAQ,CACnB,OAAO,OAAO,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,CAC5C,kBAAkB;GAEpB,MAAM,cAAc,OAAO,WAAW,SAAS,EAAE,KAAK;GACtD,MAAM,OAAO,cAAc,aAAa,WAAW;GAGnD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO,WAAW;IAClB,MAAM,WAAW;IACjB;IACA,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAErD,WAAQ,IACP,qCAAqC,WAAW,MAAM,UAAU,KAAK,WAAW,YAAY,GAC5F;SACK;GAEN,MAAM,UAAmC,EAAE;GAC3C,IAAI;GACJ,IAAI;AAEJ,OAAI,eAAe,aAAa,SAAS,WAAW,QAAQ,KAAK,SAAS,WAAW,MAAM;AAC1F,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAIhB,OAAI,eAAe,aAAa,KAAK,SAAS,WAAW,MAAM;AAC9D,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAGhB,OAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,YAAQ,8BAAa,IAAI,MAAM,EAAC,aAAa;AAC7C,UAAM,OAAO,GAAG,YAAY,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,KAAK,GAAG,CAAC,SAAS;AAErF,WAAO;KACN,GAAG;KACH,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC;AAED,YAAQ,IACP,gCAAgC,WAAW,MAAM,IACjD,OAAO,KAAK,QAAQ,CAAC,QAAQ,MAAM,MAAM,aAAa,CACtD;;;AAIH,MAAI,CAAC,KAEJ,QAAO,IAAI,SAAS,4BAA4B;GAC/C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,MAAI,KAAK,SACR,QAAO,IAAI,SAAS,oBAAoB;GACvC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,SAAO,OAAO;EAId,MAAM,EAAE,YAAY;AACpB,WAAS,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAErC,SAAO,MAAM;UACL,OAAO;AACf,UAAQ,MAAM,+BAA+B,MAAM;AAEnD,SAAO,IAAI,SAAS,yBAAyB;GAC5C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;;;;;;;;;;;AAYJ,eAAe,iBACd,SACgD;CAChD,MAAM,aAAa,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB;AAC/D,KAAI,CAAC,YAAY,WAAW,UAAU,CAAE,QAAO;CAE/C,MAAM,QAAQ,WAAW,MAAM,EAAE;AACjC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,WAAW;AACnB,KAAI,CAAC,QAAQ,GAAI,QAAO;CAGxB,IAAI,WAAuC;AAE3C,KAAI,MAAM,WAAW,UAAU,CAC9B,YAAW,MAAM,gBAAgB,OAAO,IAAI,MAAM;UACxC,MAAM,WAAW,UAAU,CACrC,YAAW,MAAM,kBAAkB,OAAO,IAAI,MAAM;KAGpD,QAAO;AAGR,KAAI,CAAC,SAAU,QAAO;CAItB,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,SAAS,OAAO;AAEvD,KAAI,CAAC,QAAQ,KAAK,SAAU,QAAO;AAGnC,QAAO,OAAO;AACd,QAAO,cAAc,SAAS;AAC9B,QAAO,UAAU,SAAS;AAE1B,QAAO;;;;;AAMR,eAAe,kBACd,SACA,MACA,YACoB;CACpB,MAAM,EAAE,KAAK,QAAQ,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AAErD,MAAI,CAAC,aAAa,IAAI;AACrB,OAAI,WACH,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;GAE/D,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AAGtF,YAAS,aAAa,IAAI,YAAY,IAAI,WAAW,IAAI,OAAO;AAChE,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;EAK7C,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AAEtD,MAAI,CAAC,MAAM;AAEV,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,aAAa,kBAAkB,IAAI;GAEpD,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,MAAI,KAAK,UAAU;AAClB,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;GAE7D,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,YAAS,aAAa,IAAI,SAAS,mBAAmB;AACtD,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,SAAO,OAAO;UACN,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAE9C,SAAO,QAAQ,SAAS,uBAAuB;;AAGhD,QAAO,MAAM;;;;;;;;;AAcd,MAAM,cAA0F;CAE/F;EAAC;EAAwB;EAAO;EAAe;CAC/C;EAAC;EAAwB;EAAS;EAAgB;CAGlD;EAAC;EAA2B;EAAK;EAAa;CAC9C;EAAC;EAAsB;EAAO;EAAa;CAC3C;EAAC;EAAsB;EAAS;EAAc;CAG9C;EAAC;EAAuB;EAAO;EAAc;CAC7C;EAAC;EAAuB;EAAS;EAAe;CAOhD;EAAC;EAA2B;EAAO;EAAe;CAClD;EAAC;EAAoC;EAAS;EAAgB;CAC9D;EAAC;EAA2B;EAAS;EAAoB;CACzD;EAAC;EAAsB;EAAO;EAAe;CAC7C;EAAC;EAAsB;EAAS;EAAe;CAC/C;EAAC;EAAyB;EAAO;EAAe;CAChD;EAAC;EAAyB;EAAS;EAAgB;CACnD;EAAC;EAA6B;EAAO;EAAe;CACpD;EAAC;EAA6B;EAAS;EAAgB;CACvD;EAAC;EAA0B;EAAO;EAAe;CACjD;EAAC;EAA0B;EAAS;EAAgB;CAGpD;EAAC;EAAuB;EAAO;EAAe;CAC9C;EAAC;EAAuB;EAAS;EAAQ;CAIzC;EAAC;EAA+B;EAAK;EAAgB;CAGrD;EAAC;EAAuB;EAAK;EAAQ;CACrC;EAAC;EAAsB;EAAK;EAAQ;CACpC;EAAC;EAAwB;EAAK;EAAQ;CAItC;EAAC;EAAiC;EAAK;EAAQ;CAI/C;EAAC;EAAyB;EAAO;EAAgB;CACjD;EAAC;EAAyB;EAAS;EAAkB;CACrD;AAED,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;CAAS,CAAC;;;;;;;AAQjE,SAAS,kBACR,UACA,QACA,aACkB;AAElB,KAAI,CAAC,YAAa,QAAO;AAKzB,KAAI,aAAa,kBAAmB,QAAO;CAE3C,MAAM,UAAU,cAAc,IAAI,OAAO;AAEzC,MAAK,MAAM,CAAC,QAAQ,YAAY,UAAU,aAAa;AAEtD,MAAI,aAAa,UAAU,CAAC,SAAS,WAAW,SAAS,IAAI,CAAE;AAG/D,MAAI,eAAe,OAAQ,eAAe,WAAW,WAAY,eAAe,QAAQ;GACvF,MAAM,QAAQ,OAAO,UAAU,WAAW,CAAC,MAAM,GAAG;AACpD,OAAI,MAAM,MAAM,aAAa,SAAS,aAAa,SAAS,CAAC,CAAE,QAAO;AAEtE,UAAO,SACN,sBACA,+BAA+B,MAAM,KAAK,OAAO,IACjD,IACA;;;AAKH,KAAI,SAAS,aAAa,QAAQ,CAAE,QAAO;AAE3C,QAAO,SAAS,sBAAsB,qCAAqC,IAAI"}
+{"version":3,"file":"auth.mjs","names":["virtualAuthenticate"],"sources":["../../../src/api/csrf.ts","../../../src/astro/middleware/csp.ts","../../../src/astro/middleware/auth.ts"],"sourcesContent":["/**\n * CSRF protection utilities.\n *\n * Two mechanisms:\n * 1. Custom header check (X-EmDash-Request: 1) — used for authenticated API routes.\n *    Browsers block cross-origin custom headers, so presence proves same-origin.\n * 2. Origin check — used for public API routes that skip auth. Compares the Origin\n *    header against the request origin. Same approach as Astro's `checkOrigin`.\n */\n\nimport { apiError } from \"./error.js\";\n\n/**\n * Origin-based CSRF check for public API routes that skip auth.\n *\n * State-changing requests (POST/PUT/DELETE) to public endpoints must either:\n *   1. Include the X-EmDash-Request: 1 header (custom header blocked cross-origin), OR\n *   2. Have an Origin header matching the request origin (or the configured public origin)\n *\n * This prevents cross-origin form submissions (which can't set custom headers)\n * and cross-origin fetch (blocked by CORS unless allowed). Same-origin requests\n * always include a matching Origin header.\n *\n * Returns a 403 Response if the check fails, or null if allowed.\n *\n * @param request  The incoming request\n * @param url      The request URL (internal origin)\n * @param publicOrigin  The public-facing origin from config.siteUrl. Must be\n *        `undefined` when absent — never `null` or `\"\"` (security invariant H-1a).\n */\nexport function checkPublicCsrf(\n\trequest: Request,\n\turl: URL,\n\tpublicOrigin?: string,\n): Response | null {\n\t// Custom header present — browser blocks cross-origin custom headers\n\tconst csrfHeader = request.headers.get(\"X-EmDash-Request\");\n\tif (csrfHeader === \"1\") return null;\n\n\t// Check Origin header — present on all POST/PUT/DELETE from browsers\n\tconst origin = request.headers.get(\"Origin\");\n\tif (origin) {\n\t\ttry {\n\t\t\tconst originUrl = new URL(origin);\n\t\t\t// Accept if Origin matches either the internal or public origin\n\t\t\tif (originUrl.origin === url.origin) return null;\n\t\t\tif (publicOrigin && originUrl.origin === publicOrigin) return null;\n\t\t} catch {\n\t\t\t// Malformed Origin — fall through to reject\n\t\t}\n\n\t\treturn apiError(\"CSRF_REJECTED\", \"Cross-origin request blocked\", 403);\n\t}\n\n\t// No Origin header — non-browser client (curl, server-to-server).\n\t// Allow these through since CSRF is a browser-specific attack vector.\n\t// Server-to-server requests don't carry ambient credentials (cookies).\n\treturn null;\n}\n","/**\n * Strict Content-Security-Policy for /_emdash routes (admin + API).\n *\n * Applied via middleware header rather than Astro's built-in CSP because\n * Astro's auto-hashing defeats 'unsafe-inline' (CSP3 ignores 'unsafe-inline'\n * when hashes are present), which would break user-facing pages.\n *\n * img-src allows any HTTPS origin because the admin renders user content that\n * may reference external images (migrations, external hosting, embeds).\n * Plugin security does not rely on img-src -- plugins run in V8 isolates with\n * no DOM access. connect-src stays at 'self' unless the experimental registry\n * and/or the configured storage endpoint (for direct-to-S3 signed uploads)\n * are configured, in which case those origins are allowed too.\n */\nimport type { RegistryConfigInput } from \"../../registry/types.js\";\nimport type { Storage } from \"../../storage/types.js\";\nimport type { StorageDescriptor } from \"../storage/types.js\";\n\n/** Entrypoint constant used by the `s3()` adapter (see `astro/storage/adapters.ts`). */\nconst S3_ADAPTER_ENTRYPOINT = \"emdash/storage/s3\";\n\n/**\n * Storage entrypoints are free to shape their config however they like, so\n * `endpoint` isn't a known field on `StorageDescriptor[\"config\"]` -- only\n * S3-compatible adapters (R2, S3, Minio, ...) set it. Anything else (e.g.\n * local filesystem storage) simply has no `endpoint` to allow.\n *\n * The `s3()` adapter resolves any field omitted from its config -- including\n * `endpoint` -- from the matching `S3_*` env var at runtime (see\n * `storage/s3.ts`'s `resolveS3Config`). A site configured as `s3({ ... })`\n * with only `S3_ENDPOINT` set has no `endpoint` in the descriptor's config,\n * so fall back to that env var for S3-adapter storage. Custom adapters can\n * expose their runtime upload origin through `getClientUploadOrigin()`.\n */\nexport function getConfiguredStorageEndpoint(\n\tstorage: StorageDescriptor | undefined,\n\truntimeStorage?: Pick<Storage, \"getClientUploadOrigin\"> | null,\n): string | undefined {\n\tconst config = storage?.config;\n\tif (typeof config === \"object\" && config !== null && \"endpoint\" in config) {\n\t\tconst endpoint = config.endpoint;\n\t\tif (typeof endpoint === \"string\") return endpoint;\n\t}\n\n\tif (storage?.entrypoint === S3_ADAPTER_ENTRYPOINT) {\n\t\tconst envEndpoint =\n\t\t\ttypeof process !== \"undefined\" && process.env ? process.env.S3_ENDPOINT : undefined;\n\t\tif (envEndpoint) return envEndpoint;\n\t}\n\n\treturn runtimeStorage?.getClientUploadOrigin?.();\n}\n\nfunction getRegistryAggregatorOrigin(\n\tregistry: RegistryConfigInput | undefined,\n): string | undefined {\n\tconst aggregatorUrl = typeof registry === \"string\" ? registry : registry?.aggregatorUrl;\n\tif (!aggregatorUrl) return undefined;\n\n\ttry {\n\t\tconst url = new URL(aggregatorUrl);\n\t\tif (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n\t\treturn url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction getHttpOrigin(rawUrl: string | undefined): string | undefined {\n\tif (!rawUrl) return undefined;\n\n\ttry {\n\t\tconst url = new URL(rawUrl);\n\t\tif (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n\t\treturn url.origin;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function buildEmDashCsp(registry?: RegistryConfigInput, storageEndpoint?: string): string {\n\tconst connectSrc = [\"connect-src 'self'\"];\n\tconst origins = new Set<string>();\n\tconst registryAggregatorOrigin = getRegistryAggregatorOrigin(registry);\n\tif (registryAggregatorOrigin) origins.add(registryAggregatorOrigin);\n\tconst storageOrigin = getHttpOrigin(storageEndpoint);\n\tif (storageOrigin) origins.add(storageOrigin);\n\tconnectSrc.push(...origins);\n\n\treturn [\n\t\t\"default-src 'self'\",\n\t\t\"script-src 'self' 'unsafe-inline'\",\n\t\t\"style-src 'self' 'unsafe-inline'\",\n\t\tconnectSrc.join(\" \"),\n\t\t\"form-action 'self'\",\n\t\t\"frame-src 'self' https:\",\n\t\t\"frame-ancestors 'none'\",\n\t\t\"img-src 'self' https: data: blob:\",\n\t\t\"media-src 'self' blob: https:\",\n\t\t\"object-src 'none'\",\n\t\t\"base-uri 'self'\",\n\t].join(\"; \");\n}\n","/**\n * Auth middleware for admin routes\n *\n * Checks if the user is authenticated and has appropriate permissions.\n * Supports two auth modes:\n * - Passkey (default): Session-based auth with passkey login\n * - External providers: JWT-based auth (Cloudflare Access, etc.)\n *\n * This middleware runs AFTER the setup middleware - so if we get here,\n * we know setup is complete and users exist.\n */\n\nimport type { User, RoleLevel } from \"@emdash-cms/auth\";\nimport { createKyselyAdapter } from \"@emdash-cms/auth/adapters/kysely\";\nimport { defineMiddleware } from \"astro:middleware\";\nimport { ulid } from \"ulidx\";\n// Import auth provider via virtual module (statically bundled)\n// This avoids dynamic import issues in Cloudflare Workers\nimport { authenticate as virtualAuthenticate } from \"virtual:emdash/auth\";\n// @ts-ignore - virtual module\nimport virtualConfig from \"virtual:emdash/config\";\n\nimport { checkPublicCsrf } from \"../../api/csrf.js\";\nimport { apiError } from \"../../api/error.js\";\nimport { getPublicOrigin } from \"../../api/public-url.js\";\n\n/** Cache headers for middleware error responses (matches API_CACHE_HEADERS in api/error.ts) */\nconst MW_CACHE_HEADERS = {\n\t\"Cache-Control\": \"private, no-store\",\n} as const;\nimport {\n\tresolveApiToken,\n\tresolveOAuthToken,\n\ttype ResolvedBearerToken,\n} from \"../../api/handlers/api-tokens.js\";\nimport { hasScope, TRANSFER_SCOPES } from \"../../auth/api-tokens.js\";\nimport { getAuthMode, type ExternalAuthMode } from \"../../auth/mode.js\";\nimport type { ExternalAuthConfig } from \"../../auth/types.js\";\nimport { getRegistryConfigInput } from \"../../registry/config.js\";\nimport { resolveSessionUser } from \"../session-user.js\";\nimport type { EmDashHandlers } from \"../types.js\";\nimport { buildEmDashCsp, getConfiguredStorageEndpoint } from \"./csp.js\";\n\ndeclare global {\n\tnamespace App {\n\t\tinterface Locals {\n\t\t\tuser?: User;\n\t\t\t/** Token scopes when authenticated via API token or OAuth token. Undefined for session auth. */\n\t\t\ttokenScopes?: string[];\n\t\t\t/** Id of the API or OAuth token the request authenticated with. Undefined for session auth. */\n\t\t\ttokenId?: string;\n\t\t\temdash?: EmDashHandlers;\n\t\t}\n\t\tinterface SessionData {\n\t\t\tuser: { id: string };\n\t\t\thasSeenWelcome: boolean;\n\t\t}\n\t}\n}\n\n// Role level constants (matching @emdash-cms/auth)\nconst ROLE_ADMIN = 50;\nconst MCP_ENDPOINT_PATH = \"/_emdash/api/mcp\";\nconst COMMENT_SUBMISSION_PATH = /^\\/_emdash\\/api\\/comments\\/[^/]+\\/[^/]+\\/?$/;\n\nfunction isUnsafeMethod(method: string): boolean {\n\treturn method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\";\n}\n\nfunction csrfRejectedResponse(): Response {\n\treturn apiError(\"CSRF_REJECTED\", \"Missing required header\", 403);\n}\n\nfunction mcpUnauthorizedResponse(\n\turl: URL,\n\tconfig?: Parameters<typeof getPublicOrigin>[1],\n): Response {\n\tconst origin = getPublicOrigin(url, config);\n\tconst response = apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t// Preserve the OAuth discovery header so MCP clients can find the auth server.\n\tresponse.headers.set(\n\t\t\"WWW-Authenticate\",\n\t\t`Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`,\n\t);\n\treturn response;\n}\n\n/**\n * API routes that skip auth — each handles its own access control.\n *\n * Prefix entries match any path starting with that prefix.\n * Exact entries (no trailing slash or wildcard) match that path only.\n */\nconst PUBLIC_API_PREFIXES = [\n\t\"/_emdash/api/setup\",\n\t\"/_emdash/api/auth/login\",\n\t\"/_emdash/api/auth/register\",\n\t\"/_emdash/api/auth/dev-bypass\",\n\t\"/_emdash/api/auth/signup/\",\n\t\"/_emdash/api/auth/magic-link/\",\n\t\"/_emdash/api/auth/invite/\",\n\t\"/_emdash/api/auth/oauth/\",\n\t\"/_emdash/api/oauth/device/token\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/comments/\",\n\t\"/_emdash/api/media/file/\",\n\t\"/_emdash/.well-known/\",\n];\n\nconst PUBLIC_API_EXACT = new Set([\n\t\"/_emdash/api/auth/passkey/options\",\n\t\"/_emdash/api/auth/passkey/verify\",\n\t\"/_emdash/api/auth/mode\",\n\t\"/_emdash/api/health\",\n\t\"/_emdash/api/site/domain-proof\",\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/snapshot\",\n\t\"/_emdash/api/visual-editing/toolbar-labels\",\n\t// Public site search — read-only. Unauthenticated callers only see\n\t// published content: /search forces status='published' without the\n\t// content:read_drafts permission and /suggest hardcodes it. Admin endpoints\n\t// (/enable, /rebuild, /stats) remain private because they're not in this set.\n\t\"/_emdash/api/search\",\n\t\"/_emdash/api/search/suggest\",\n]);\n\nconst DEV_PUBLIC_API_EXACT = new Set([\"/_emdash/api/typegen\", \"/_emdash/api/dev/scheduled-tasks\"]);\n\n// Build merged public routes at module load from auth provider descriptors.\n// Routes ending with \"/\" are treated as prefixes; all others are exact matches.\nconst { exact: _providerExactRoutes, prefixes: _providerPrefixRoutes } = (() => {\n\tconst exact = new Set<string>();\n\tconst prefixes: string[] = [];\n\tif (!virtualConfig?.authProviders) return { exact, prefixes };\n\tfor (const route of virtualConfig.authProviders.flatMap((p) => p.publicRoutes ?? [])) {\n\t\tif (route.endsWith(\"/\")) {\n\t\t\tprefixes.push(route);\n\t\t} else {\n\t\t\texact.add(route);\n\t\t}\n\t}\n\treturn { exact, prefixes };\n})();\n\n/**\n * OAuth protocol endpoints that are CSRF-exempt by design.\n *\n * These are RFC-defined endpoints (RFC 6749 §3.2, RFC 7591 §3, RFC 8628 §3.1/§3.4)\n * specified to be called cross-origin by external clients (MCP clients, CLIs,\n * native apps). They authenticate each request on its own merits:\n *\n * - /oauth/token: requires PKCE code_verifier, device_code, or refresh_token\n * - /oauth/register: RFC 7591 dynamic client registration — anonymous by design\n * - /oauth/device/code: RFC 8628 device flow initiation — anonymous by design\n * - /oauth/device/token: requires device_code the client already holds\n *\n * None of these rely on ambient cookie credentials, so browser-based CSRF\n * attacks have nothing to exploit. The endpoints themselves advertise\n * `Access-Control-Allow-Origin: *`. Note: /oauth/device/authorize (the user\n * consent step) is NOT in this list — it is session-authenticated.\n */\nconst CSRF_EXEMPT_PUBLIC_ROUTES = new Set([\n\t\"/_emdash/api/oauth/token\",\n\t\"/_emdash/api/oauth/register\",\n\t\"/_emdash/api/oauth/device/code\",\n\t\"/_emdash/api/oauth/device/token\",\n]);\n\nfunction isPublicEmDashRoute(pathname: string): boolean {\n\tif (PUBLIC_API_EXACT.has(pathname)) return true;\n\tif (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;\n\tif (_providerExactRoutes.has(pathname)) return true;\n\tif (_providerPrefixRoutes.some((p) => pathname.startsWith(p))) return true;\n\tif (import.meta.env.DEV && DEV_PUBLIC_API_EXACT.has(pathname)) return true;\n\treturn false;\n}\n\nfunction isCsrfExemptPublicRoute(pathname: string): boolean {\n\treturn CSRF_EXEMPT_PUBLIC_ROUTES.has(pathname);\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { url } = context;\n\n\t// Only check auth on admin routes and API routes\n\tconst isAdminRoute = url.pathname.startsWith(\"/_emdash/admin\");\n\tconst isSetupRoute = url.pathname.startsWith(\"/_emdash/admin/setup\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\tconst isPublicApiRoute = isPublicEmDashRoute(url.pathname);\n\n\tconst isPublicRoute = !isAdminRoute && !isApiRoute;\n\n\t// Public API routes skip auth but still need CSRF protection on state-changing methods.\n\t// We check Origin header against the request host (same approach as Astro's checkOrigin).\n\t// This prevents cross-origin form submissions and fetch requests from malicious sites.\n\tif (isPublicApiRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (\n\t\t\tisUnsafeMethod(method) &&\n\t\t\t!isCsrfExemptPublicRoute(url.pathname) // OAuth protocol endpoints — cross-origin by design\n\t\t) {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\tif (method === \"POST\" && COMMENT_SUBMISSION_PATH.test(url.pathname)) {\n\t\t\treturn handlePublicRouteAuth(context, next);\n\t\t}\n\t\t// Search filters drafts by permission, so resolve the session user when\n\t\t// one exists; anonymous callers skip the user DB lookup. Bearer tokens\n\t\t// are not resolved on public routes; token callers continue to receive\n\t\t// published results only.\n\t\tif (url.pathname === \"/_emdash/api/search\") {\n\t\t\treturn handlePublicRouteAuth(context, next);\n\t\t}\n\t\treturn next();\n\t}\n\n\t// Plugin routes: soft auth (resolve user if credentials present, but never block).\n\t// The catch-all handler decides per-route whether auth is required (public vs private).\n\t// Public plugin routes that accept POST are vulnerable to cross-origin form submissions,\n\t// so we apply the same Origin-based CSRF check as other public routes.\n\tconst isPluginRoute = url.pathname.startsWith(\"/_emdash/api/plugins/\");\n\tif (isPluginRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst publicOrigin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tconst csrfError = checkPublicCsrf(context.request, url, publicOrigin);\n\t\t\tif (csrfError) return csrfError;\n\t\t}\n\t\treturn handlePluginRouteAuth(context, next);\n\t}\n\n\t// Setup routes: skip auth but still enforce CSRF on state-changing methods\n\tif (isSetupRoute) {\n\t\tconst method = context.request.method.toUpperCase();\n\t\tif (method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\") {\n\t\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\t\tif (csrfHeader !== \"1\") {\n\t\t\t\treturn apiError(\"CSRF_REJECTED\", \"Missing required header\", 403);\n\t\t\t}\n\t\t}\n\t\tconst response = await next();\n\t\tif (!import.meta.env.DEV) {\n\t\t\tresponse.headers.set(\n\t\t\t\t\"Content-Security-Policy\",\n\t\t\t\tbuildEmDashCsp(\n\t\t\t\t\tgetRegistryConfigInput(context.locals.emdash?.config.registry),\n\t\t\t\t\tgetConfiguredStorageEndpoint(\n\t\t\t\t\t\tcontext.locals.emdash?.config.storage,\n\t\t\t\t\t\tcontext.locals.emdash?.storage,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\t// For public routes: soft auth check (set locals.user if session exists, but never block)\n\tif (isPublicRoute) {\n\t\treturn handlePublicRouteAuth(context, next);\n\t}\n\n\t// --- Everything below is /_emdash (admin + API) ---\n\n\t// Try Bearer token auth first (API tokens and OAuth tokens).\n\t// If successful, skip CSRF (tokens aren't ambient credentials like cookies).\n\tconst bearerResult = await handleBearerAuth(context);\n\n\tif (bearerResult === \"invalid\") {\n\t\tconst response = apiError(\"INVALID_TOKEN\", \"Invalid or expired token\", 401);\n\t\t// Add WWW-Authenticate header on MCP endpoint 401s to trigger OAuth discovery\n\t\tif (url.pathname === \"/_emdash/api/mcp\") {\n\t\t\tconst origin = getPublicOrigin(url, context.locals.emdash?.config);\n\t\t\tresponse.headers.set(\n\t\t\t\t\"WWW-Authenticate\",\n\t\t\t\t`Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\"`,\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\tconst isTokenAuth = bearerResult === \"authenticated\";\n\n\t// MCP discovery/tooling is bearer-only. Session/external auth should never\n\t// be consulted for this endpoint, and unauthenticated requests must return\n\t// the OAuth discovery-style 401 response.\n\tconst method = context.request.method.toUpperCase();\n\tconst isMcpEndpoint = url.pathname === MCP_ENDPOINT_PATH;\n\tif (isMcpEndpoint && !isTokenAuth) {\n\t\treturn mcpUnauthorizedResponse(url, context.locals.emdash?.config);\n\t}\n\n\t// CSRF protection: require X-EmDash-Request header on state-changing requests.\n\t// Skip for token-authenticated requests (tokens aren't ambient credentials).\n\t// Browsers block cross-origin custom headers, so this prevents CSRF without tokens.\n\t// OAuth authorize consent is exempt: it's a standard HTML form POST that can't\n\t// include custom headers. The consent flow is protected by session + single-use codes.\n\tconst isOAuthConsent = url.pathname.startsWith(\"/_emdash/oauth/authorize\");\n\tif (\n\t\tisApiRoute &&\n\t\t!isTokenAuth &&\n\t\t!isOAuthConsent &&\n\t\tisUnsafeMethod(method) &&\n\t\t!isPublicApiRoute\n\t) {\n\t\tconst csrfHeader = context.request.headers.get(\"X-EmDash-Request\");\n\t\tif (csrfHeader !== \"1\") {\n\t\t\treturn csrfRejectedResponse();\n\t\t}\n\t}\n\n\t// If already authenticated via Bearer token, enforce scope then skip session/external auth\n\tif (isTokenAuth) {\n\t\t// Enforce API token scopes based on URL pattern + HTTP method\n\t\tconst scopeError = enforceTokenScope(url.pathname, method, context.locals.tokenScopes);\n\t\tif (scopeError) return scopeError;\n\n\t\tconst response = await next();\n\t\tif (!import.meta.env.DEV) {\n\t\t\tresponse.headers.set(\n\t\t\t\t\"Content-Security-Policy\",\n\t\t\t\tbuildEmDashCsp(\n\t\t\t\t\tgetRegistryConfigInput(context.locals.emdash?.config.registry),\n\t\t\t\t\tgetConfiguredStorageEndpoint(\n\t\t\t\t\t\tcontext.locals.emdash?.config.storage,\n\t\t\t\t\t\tcontext.locals.emdash?.storage,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn response;\n\t}\n\n\tconst response = await handleEmDashAuth(context, next);\n\n\t// Set strict CSP on all /_emdash responses (prod only)\n\tif (!import.meta.env.DEV) {\n\t\tresponse.headers.set(\n\t\t\t\"Content-Security-Policy\",\n\t\t\tbuildEmDashCsp(\n\t\t\t\tgetRegistryConfigInput(context.locals.emdash?.config.registry),\n\t\t\t\tgetConfiguredStorageEndpoint(\n\t\t\t\t\tcontext.locals.emdash?.config.storage,\n\t\t\t\t\tcontext.locals.emdash?.storage,\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t}\n\n\treturn response;\n});\n\n/**\n * Auth handling for /_emdash routes. Returns a Response from either\n * an auth error/redirect or the downstream route handler.\n */\nasync function handleEmDashAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { url, locals } = context;\n\tconst { emdash } = locals;\n\n\t// Pages an anonymous visitor must be able to reach: login itself, and the\n\t// two token-bearing pages that emails link to.\n\tconst isPublicAdminRoute =\n\t\turl.pathname.startsWith(\"/_emdash/admin/login\") ||\n\t\turl.pathname.startsWith(\"/_emdash/admin/signup\") ||\n\t\turl.pathname.startsWith(\"/_emdash/admin/invite/accept\");\n\tconst isApiRoute = url.pathname.startsWith(\"/_emdash/api\");\n\n\tif (!emdash?.db) {\n\t\t// No database - let the admin handle this error\n\t\treturn next();\n\t}\n\n\t// Determine auth mode from config\n\tconst authMode = getAuthMode(emdash.config);\n\n\tif (authMode.type === \"external\") {\n\t\t// In dev mode, fall back to passkey auth since external JWT won't be present\n\t\tif (import.meta.env.DEV) {\n\t\t\tif (isPublicAdminRoute) {\n\t\t\t\treturn next();\n\t\t\t}\n\n\t\t\treturn handlePasskeyAuth(context, next, isApiRoute);\n\t\t}\n\n\t\t// External auth provider (Cloudflare Access, etc.)\n\t\treturn handleExternalAuth(context, next, authMode, isApiRoute);\n\t}\n\n\t// Passkey authentication (default)\n\tif (isPublicAdminRoute) {\n\t\treturn next();\n\t}\n\n\treturn handlePasskeyAuth(context, next, isApiRoute);\n}\n\n/**\n * Plugin-route auth. Resolves the user in three steps, stopping at the first that\n * applies:\n *\n * 1. Bearer token (all modes). A valid token authenticates; an invalid/expired one\n *    returns 401 (we never silently downgrade a bad token to anonymous).\n * 2. External provider — only for a *private* route in production external-auth\n *    mode. Here `handleExternalAuth` is the sole authority: the provider (e.g.\n *    Cloudflare Access) is re-verified on every request, so it hard-blocks with\n *    401 on failure. It does persist an EmDash session (so public pages can\n *    identify the user), but on these routes that session is deliberately NOT\n *    consulted as a fallback — the provider check is authoritative every time.\n * 3. Session — everything else (non-external mode, DEV, and all public routes).\n *    This is soft: it sets `locals.user` if a session exists but never blocks.\n *\n * Public routes are always allowed through. The catch-all handler still enforces\n * the `plugins:manage` permission and CSRF for private invocations.\n */\nasync function handlePluginRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals, url } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Try Bearer token auth first (API tokens and OAuth tokens)\n\t\tconst bearerResult = await handleBearerAuth(context);\n\t\tif (bearerResult === \"authenticated\") {\n\t\t\t// User and tokenScopes are set on locals by handleBearerAuth\n\t\t\treturn next();\n\t\t}\n\t\tif (bearerResult === \"invalid\") {\n\t\t\t// A token was presented but is invalid/expired — return 401 so the\n\t\t\t// caller knows their token is bad (don't silently downgrade to no-auth).\n\t\t\treturn apiError(\"INVALID_TOKEN\", \"Invalid or expired token\", 401);\n\t\t}\n\t\t// \"none\" — no token presented, try external/session auth below.\n\t} catch (error) {\n\t\tconsole.error(\"Plugin route bearer auth error:\", error);\n\t}\n\n\tconst authMode = getAuthMode(emdash?.config);\n\tif (\n\t\tauthMode.type === \"external\" &&\n\t\t!import.meta.env.DEV &&\n\t\t!isPublicPluginApiRoute(url.pathname, emdash)\n\t) {\n\t\treturn handleExternalAuth(context, next, authMode, true);\n\t}\n\n\ttry {\n\t\t// Try session auth (sets locals.user if session exists)\n\t\tconst { session } = context;\n\t\tconst sessionUser = await resolveSessionUser(session);\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch (error) {\n\t\t// Log but don't block — public routes should still work without session\n\t\tconsole.error(\"Plugin route session auth error:\", error);\n\t}\n\n\treturn next();\n}\n\nfunction isPublicPluginApiRoute(pathname: string, emdash: EmDashHandlers | undefined): boolean {\n\tconst prefix = \"/_emdash/api/plugins/\";\n\tconst route = pathname.slice(prefix.length);\n\tconst slashIndex = route.indexOf(\"/\");\n\tif (slashIndex <= 0 || !emdash?.getPluginRouteMeta) return false;\n\n\treturn (\n\t\temdash.getPluginRouteMeta(route.slice(0, slashIndex), route.slice(slashIndex))?.public === true\n\t);\n}\n\n/**\n * Soft auth check for public routes with edit mode cookie.\n * Checks the session and sets locals.user if valid, but never blocks the request.\n */\nasync function handlePublicRouteAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n): Promise<Response> {\n\tconst { locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\tconst sessionUser = await resolveSessionUser(session);\n\t\tif (sessionUser?.id && emdash?.db) {\n\t\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\t\tconst user = await adapter.getUserById(sessionUser.id);\n\t\t\tif (user && !user.disabled) {\n\t\t\t\tlocals.user = user;\n\t\t\t}\n\t\t}\n\t} catch {\n\t\t// Silently continue — public page should render normally\n\t}\n\n\treturn next();\n}\n\n/**\n * Handle external auth provider authentication (Cloudflare Access, etc.)\n */\nasync function handleExternalAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tauthMode: ExternalAuthMode,\n\t_isApiRoute: boolean,\n): Promise<Response> {\n\tconst { locals, request } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Use the authenticate function from the virtual module\n\t\t// (statically imported at build time to work with Cloudflare Workers)\n\t\tif (typeof virtualAuthenticate !== \"function\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Auth provider ${authMode.entrypoint} does not export an authenticate function`,\n\t\t\t);\n\t\t}\n\n\t\t// Authenticate via the provider\n\t\tconst authResult = await virtualAuthenticate(request, authMode.config);\n\n\t\t// Get external auth config for auto-provision settings\n\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowing AuthModeConfig to ExternalAuthConfig after provider check\n\t\tconst externalConfig = authMode.config as ExternalAuthConfig;\n\n\t\t// Find or create user\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tlet user = await adapter.getUserByEmail(authResult.email);\n\n\t\tif (!user) {\n\t\t\t// User doesn't exist\n\t\t\tif (externalConfig.autoProvision === false) {\n\t\t\t\treturn new Response(\"User not authorized\", {\n\t\t\t\t\tstatus: 403,\n\t\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Check if this is the first user (they become admin)\n\t\t\tconst userCount = await emdash.db\n\t\t\t\t.selectFrom(\"users\")\n\t\t\t\t.select(emdash.db.fn.count(\"id\").as(\"count\"))\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tconst isFirstUser = Number(userCount?.count ?? 0) === 0;\n\t\t\tconst role = isFirstUser ? ROLE_ADMIN : authResult.role;\n\n\t\t\t// Create user\n\t\t\tconst now = new Date().toISOString();\n\t\t\tconst newUser = {\n\t\t\t\tid: ulid(),\n\t\t\t\temail: authResult.email,\n\t\t\t\tname: authResult.name,\n\t\t\t\trole,\n\t\t\t\temail_verified: 1,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t};\n\n\t\t\tawait emdash.db.insertInto(\"users\").values(newUser).execute();\n\n\t\t\tuser = await adapter.getUserByEmail(authResult.email);\n\n\t\t\tconsole.log(\n\t\t\t\t`[external-auth] Provisioned user: ${authResult.email} (role: ${role}, first: ${isFirstUser})`,\n\t\t\t);\n\t\t} else {\n\t\t\t// User exists - check if we need to sync anything\n\t\t\tconst updates: Record<string, unknown> = {};\n\t\t\tlet newName: string | undefined;\n\t\t\tlet newRole: RoleLevel | undefined;\n\n\t\t\tif (externalConfig.syncName !== false && authResult.name && user.name !== authResult.name) {\n\t\t\t\tnewName = authResult.name;\n\t\t\t\tupdates.name = newName;\n\t\t\t}\n\n\t\t\t// Sync role if enabled\n\t\t\tif (externalConfig.syncRoles && user.role !== authResult.role) {\n\t\t\t\tnewRole = authResult.role;\n\t\t\t\tupdates.role = newRole;\n\t\t\t}\n\n\t\t\tif (Object.keys(updates).length > 0) {\n\t\t\t\tupdates.updated_at = new Date().toISOString();\n\t\t\t\tawait emdash.db.updateTable(\"users\").set(updates).where(\"id\", \"=\", user.id).execute();\n\n\t\t\t\tuser = {\n\t\t\t\t\t...user,\n\t\t\t\t\t...(newName ? { name: newName } : {}),\n\t\t\t\t\t...(newRole ? { role: newRole } : {}),\n\t\t\t\t};\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`[external-auth] Updated user ${authResult.email}:`,\n\t\t\t\t\tObject.keys(updates).filter((k) => k !== \"updated_at\"),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (!user) {\n\t\t\t// This shouldn't happen, but handle it gracefully\n\t\t\treturn new Response(\"Failed to provision user\", {\n\t\t\t\tstatus: 500,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Check if user is disabled locally\n\t\tif (user.disabled) {\n\t\t\treturn new Response(\"Account disabled\", {\n\t\t\t\tstatus: 403,\n\t\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t\t});\n\t\t}\n\n\t\t// Set user in locals\n\t\tlocals.user = user;\n\n\t\t// Persist to session so public pages can identify the user\n\t\t// (external auth headers are only verified on /_emdash routes)\n\t\tconst { session } = context;\n\t\tsession?.set(\"user\", { id: user.id });\n\n\t\treturn next();\n\t} catch (error) {\n\t\tconsole.error(\"[external-auth] Auth error:\", error);\n\n\t\treturn new Response(\"Authentication failed\", {\n\t\t\tstatus: 401,\n\t\t\theaders: { \"Content-Type\": \"text/plain\", ...MW_CACHE_HEADERS },\n\t\t});\n\t}\n}\n\n/**\n * Try to authenticate via Bearer token (API token or OAuth token).\n *\n * Returns:\n * - \"authenticated\" if token is valid and user is resolved\n * - \"invalid\" if a token was provided but is invalid/expired\n * - \"none\" if no Bearer token was provided\n */\nasync function handleBearerAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n): Promise<\"authenticated\" | \"invalid\" | \"none\"> {\n\tconst authHeader = context.request.headers.get(\"Authorization\");\n\tif (!authHeader?.startsWith(\"Bearer \")) return \"none\";\n\n\tconst token = authHeader.slice(7);\n\tif (!token) return \"none\";\n\n\tconst { locals } = context;\n\tconst { emdash } = locals;\n\tif (!emdash?.db) return \"none\";\n\n\t// Resolve token based on prefix\n\tlet resolved: ResolvedBearerToken | null = null;\n\n\tif (token.startsWith(\"ec_pat_\")) {\n\t\tresolved = await resolveApiToken(emdash.db, token);\n\t} else if (token.startsWith(\"ec_oat_\")) {\n\t\tresolved = await resolveOAuthToken(emdash.db, token);\n\t} else {\n\t\t// Unknown token format\n\t\treturn \"invalid\";\n\t}\n\n\tif (!resolved) return \"invalid\";\n\n\t// Look up the user\n\tconst adapter = createKyselyAdapter(emdash.db);\n\tconst user = await adapter.getUserById(resolved.userId);\n\n\tif (!user || user.disabled) return \"invalid\";\n\n\t// Set user and scopes on locals\n\tlocals.user = user;\n\tlocals.tokenScopes = resolved.scopes;\n\tlocals.tokenId = resolved.tokenId;\n\n\treturn \"authenticated\";\n}\n\n/**\n * Handle passkey (session-based) authentication\n */\nasync function handlePasskeyAuth(\n\tcontext: Parameters<Parameters<typeof defineMiddleware>[0]>[0],\n\tnext: Parameters<Parameters<typeof defineMiddleware>[0]>[1],\n\tisApiRoute: boolean,\n): Promise<Response> {\n\tconst { url, locals, session } = context;\n\tconst { emdash } = locals;\n\n\ttry {\n\t\t// Check session for user (session.get returns a Promise)\n\t\tconst sessionUser = await resolveSessionUser(session);\n\n\t\tif (!sessionUser?.id) {\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"NOT_AUTHENTICATED\", \"Not authenticated\", 401);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\t// Keep the query string: a token-bearing link that lands here must\n\t\t\t// still carry its token after login.\n\t\t\tloginUrl.searchParams.set(\"redirect\", url.pathname + url.search);\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Get full user from database\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tconst user = await adapter.getUserById(sessionUser.id);\n\n\t\tif (!user) {\n\t\t\t// User no longer exists - clear session\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 401);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Check if user is disabled\n\t\tif (user.disabled) {\n\t\t\tsession?.destroy();\n\t\t\tif (isApiRoute) {\n\t\t\t\treturn apiError(\"ACCOUNT_DISABLED\", \"Account disabled\", 403);\n\t\t\t}\n\t\t\tconst loginUrl = new URL(\"/_emdash/admin/login\", getPublicOrigin(url, emdash?.config));\n\t\t\tloginUrl.searchParams.set(\"error\", \"account_disabled\");\n\t\t\treturn context.redirect(loginUrl.toString());\n\t\t}\n\n\t\t// Set user in locals for use by routes\n\t\tlocals.user = user;\n\t} catch (error) {\n\t\tconsole.error(\"Auth middleware error:\", error);\n\t\t// On error, redirect to login\n\t\treturn context.redirect(\"/_emdash/admin/login\");\n\t}\n\n\treturn next();\n}\n\n// =============================================================================\n// Token scope enforcement\n// =============================================================================\n\n/**\n * Scope rules: ordered list of (pathPrefix, method, requiredScope) tuples.\n * First matching rule wins. Methods: \"*\" = any, \"WRITE\" = POST/PUT/PATCH/DELETE.\n * A list of scopes is satisfied by holding any one of them.\n *\n * Routes not matched by any rule default to \"admin\" scope (fail-closed).\n */\nconst SCOPE_RULES: Array<[prefix: string, method: string, scope: string | readonly string[]]> = [\n\t// Content routes\n\t[\"/_emdash/api/content\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/content\", \"WRITE\", \"content:write\"],\n\n\t// Media routes (excluding /file/ which is public)\n\t[\"/_emdash/api/media/file\", \"*\", \"media:read\"], // public anyway, but scope if token-authed\n\t[\"/_emdash/api/media\", \"GET\", \"media:read\"],\n\t[\"/_emdash/api/media\", \"WRITE\", \"media:write\"],\n\n\t// Schema routes\n\t[\"/_emdash/api/schema\", \"GET\", \"schema:read\"],\n\t[\"/_emdash/api/schema\", \"WRITE\", \"schema:write\"],\n\n\t// Taxonomy, menu, section, widget, revision — all content domain\n\t// GET uses content:read (implicit from taxonomies:read / menus:read via role).\n\t// WRITE uses the granular scope so tokens with only taxonomies:manage or\n\t// menus:manage are not rejected. content:write implicitly grants these via\n\t// IMPLICIT_SCOPE_GRANTS in @emdash-cms/auth.\n\t[\"/_emdash/api/taxonomies\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/taxonomies/bulk-tag\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/taxonomies\", \"WRITE\", \"taxonomies:manage\"],\n\t[\"/_emdash/api/menus\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/menus\", \"WRITE\", \"menus:manage\"],\n\t[\"/_emdash/api/sections\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/sections\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/widget-areas\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/widget-areas\", \"WRITE\", \"content:write\"],\n\t[\"/_emdash/api/revisions\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/revisions\", \"WRITE\", \"content:write\"],\n\n\t// Search\n\t[\"/_emdash/api/search\", \"GET\", \"content:read\"],\n\t[\"/_emdash/api/search\", \"WRITE\", \"admin\"],\n\n\t// Site transfer — must precede the generic /admin rule so a token holding\n\t// only a transfer scope reaches the route, which requires its specific one.\n\t[\"/_emdash/api/admin/transfer\", \"*\", TRANSFER_SCOPES],\n\n\t// Import, admin, plugins — all require admin scope\n\t[\"/_emdash/api/import\", \"*\", \"admin\"],\n\t[\"/_emdash/api/admin\", \"*\", \"admin\"],\n\t[\"/_emdash/api/plugins\", \"*\", \"admin\"],\n\n\t// Backups are a full-site content export and must precede the generic\n\t// settings rules, which would otherwise let a settings:read token through.\n\t[\"/_emdash/api/settings/backups\", \"*\", \"admin\"],\n\n\t// Settings — use granular scopes so tokens with settings:read or\n\t// settings:manage are not rejected at the middleware level.\n\t[\"/_emdash/api/settings\", \"GET\", \"settings:read\"],\n\t[\"/_emdash/api/settings\", \"WRITE\", \"settings:manage\"],\n];\n\nconst WRITE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Enforce API token scopes based on the request URL and HTTP method.\n * Returns a 403 Response if the scope is insufficient, or null if allowed.\n *\n * Session-authenticated requests (tokenScopes === undefined) are never checked.\n */\nfunction enforceTokenScope(\n\tpathname: string,\n\tmethod: string,\n\ttokenScopes: string[] | undefined,\n): Response | null {\n\t// Session auth — implicit full access, no scope restrictions\n\tif (!tokenScopes) return null;\n\n\t// MCP is authenticated here, but each tool enforces its own scope. A\n\t// blanket content:read/admin requirement would prevent plugin-scoped tokens\n\t// from reaching `mcp/server.ts`, where the actual tool policy lives.\n\tif (pathname === MCP_ENDPOINT_PATH) return null;\n\n\tconst isWrite = WRITE_METHODS.has(method);\n\n\tfor (const [prefix, ruleMethod, scope] of SCOPE_RULES) {\n\t\t// Match exact prefix or prefix followed by /\n\t\tif (pathname !== prefix && !pathname.startsWith(prefix + \"/\")) continue;\n\n\t\t// Check method match\n\t\tif (ruleMethod === \"*\" || (ruleMethod === \"WRITE\" && isWrite) || ruleMethod === method) {\n\t\t\tconst anyOf = typeof scope === \"string\" ? [scope] : scope;\n\t\t\tif (anyOf.some((required) => hasScope(tokenScopes, required))) return null;\n\n\t\t\treturn apiError(\n\t\t\t\t\"INSUFFICIENT_SCOPE\",\n\t\t\t\t`Token lacks required scope: ${anyOf.join(\" or \")}`,\n\t\t\t\t403,\n\t\t\t);\n\t\t}\n\t}\n\n\t// No rule matched — default to admin scope (fail-closed)\n\tif (hasScope(tokenScopes, \"admin\")) return null;\n\n\treturn apiError(\"INSUFFICIENT_SCOPE\", \"Token lacks required scope: admin\", 403);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,gBACf,SACA,KACA,cACkB;AAGlB,KADmB,QAAQ,QAAQ,IAAI,mBAAmB,KACvC,IAAK,QAAO;CAG/B,MAAM,SAAS,QAAQ,QAAQ,IAAI,SAAS;AAC5C,KAAI,QAAQ;AACX,MAAI;GACH,MAAM,YAAY,IAAI,IAAI,OAAO;AAEjC,OAAI,UAAU,WAAW,IAAI,OAAQ,QAAO;AAC5C,OAAI,gBAAgB,UAAU,WAAW,aAAc,QAAO;UACvD;AAIR,SAAO,SAAS,iBAAiB,gCAAgC,IAAI;;AAMtE,QAAO;;;;;;ACtCR,MAAM,wBAAwB;;;;;;;;;;;;;;AAe9B,SAAgB,6BACf,SACA,gBACqB;CACrB,MAAM,SAAS,SAAS;AACxB,KAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,cAAc,QAAQ;EAC1E,MAAM,WAAW,OAAO;AACxB,MAAI,OAAO,aAAa,SAAU,QAAO;;AAG1C,KAAI,SAAS,eAAe,uBAAuB;EAClD,MAAM,cACL,OAAO,YAAY,eAAe,QAAQ,MAAM,QAAQ,IAAI,cAAc;AAC3E,MAAI,YAAa,QAAO;;AAGzB,QAAO,gBAAgB,yBAAyB;;AAGjD,SAAS,4BACR,UACqB;CACrB,MAAM,gBAAgB,OAAO,aAAa,WAAW,WAAW,UAAU;AAC1E,KAAI,CAAC,cAAe,QAAO;AAE3B,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,cAAc;AAClC,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,SAAO,IAAI;SACJ;AACP;;;AAIF,SAAS,cAAc,QAAgD;AACtE,KAAI,CAAC,OAAQ,QAAO;AAEpB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,OAAO;AAC3B,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,SAAO,IAAI;SACJ;AACP;;;AAIF,SAAgB,eAAe,UAAgC,iBAAkC;CAChG,MAAM,aAAa,CAAC,qBAAqB;CACzC,MAAM,0BAAU,IAAI,KAAa;CACjC,MAAM,2BAA2B,4BAA4B,SAAS;AACtE,KAAI,yBAA0B,SAAQ,IAAI,yBAAyB;CACnE,MAAM,gBAAgB,cAAc,gBAAgB;AACpD,KAAI,cAAe,SAAQ,IAAI,cAAc;AAC7C,YAAW,KAAK,GAAG,QAAQ;AAE3B,QAAO;EACN;EACA;EACA;EACA,WAAW,KAAK,IAAI;EACpB;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,KAAK,KAAK;;;;;;AC1Eb,MAAM,mBAAmB,EACxB,iBAAiB,qBACjB;AAgCD,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,0BAA0B;AAEhC,SAAS,eAAe,QAAyB;AAChD,QAAO,WAAW,SAAS,WAAW,UAAU,WAAW;;AAG5D,SAAS,uBAAiC;AACzC,QAAO,SAAS,iBAAiB,2BAA2B,IAAI;;AAGjE,SAAS,wBACR,KACA,QACW;CACX,MAAM,SAAS,gBAAgB,KAAK,OAAO;CAC3C,MAAM,WAAW,SAAS,qBAAqB,qBAAqB,IAAI;AAExE,UAAS,QAAQ,IAChB,oBACA,6BAA6B,OAAO,wCACpC;AACD,QAAO;;;;;;;;AASR,MAAM,sBAAsB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAM,mBAAmB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAKA;CACA;CACA,CAAC;AAEF,MAAM,uBAAuB,IAAI,IAAI,CAAC,wBAAwB,mCAAmC,CAAC;AAIlG,MAAM,EAAE,OAAO,sBAAsB,UAAU,iCAAiC;CAC/E,MAAM,wBAAQ,IAAI,KAAa;CAC/B,MAAM,WAAqB,EAAE;AAC7B,KAAI,CAAC,eAAe,cAAe,QAAO;EAAE;EAAO;EAAU;AAC7D,MAAK,MAAM,SAAS,cAAc,cAAc,SAAS,MAAM,EAAE,gBAAgB,EAAE,CAAC,CACnF,KAAI,MAAM,SAAS,IAAI,CACtB,UAAS,KAAK,MAAM;KAEpB,OAAM,IAAI,MAAM;AAGlB,QAAO;EAAE;EAAO;EAAU;IACvB;;;;;;;;;;;;;;;;;;AAmBJ,MAAM,4BAA4B,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,oBAAoB,UAA2B;AACvD,KAAI,iBAAiB,IAAI,SAAS,CAAE,QAAO;AAC3C,KAAI,oBAAoB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACpE,KAAI,qBAAqB,IAAI,SAAS,CAAE,QAAO;AAC/C,KAAI,sBAAsB,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC,CAAE,QAAO;AACtE,KAAI,OAAO,KAAK,IAAI,OAAO,qBAAqB,IAAI,SAAS,CAAE,QAAO;AACtE,QAAO;;AAGR,SAAS,wBAAwB,UAA2B;AAC3D,QAAO,0BAA0B,IAAI,SAAS;;AAG/C,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,QAAQ;CAGhB,MAAM,eAAe,IAAI,SAAS,WAAW,iBAAiB;CAC9D,MAAM,eAAe,IAAI,SAAS,WAAW,uBAAuB;CACpE,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;CAC1D,MAAM,mBAAmB,oBAAoB,IAAI,SAAS;CAE1D,MAAM,gBAAgB,CAAC,gBAAgB,CAAC;AAKxC,KAAI,kBAAkB;EACrB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MACC,eAAe,OAAO,IACtB,CAAC,wBAAwB,IAAI,SAAS,EACrC;GACD,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,MAAI,WAAW,UAAU,wBAAwB,KAAK,IAAI,SAAS,CAClE,QAAO,sBAAsB,SAAS,KAAK;AAM5C,MAAI,IAAI,aAAa,sBACpB,QAAO,sBAAsB,SAAS,KAAK;AAE5C,SAAO,MAAM;;AAQd,KADsB,IAAI,SAAS,WAAW,wBAAwB,EACnD;EAClB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;GAClE,MAAM,eAAe,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;GACxE,MAAM,YAAY,gBAAgB,QAAQ,SAAS,KAAK,aAAa;AACrE,OAAI,UAAW,QAAO;;AAEvB,SAAO,sBAAsB,SAAS,KAAK;;AAI5C,KAAI,cAAc;EACjB,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AACnD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAEvD;OADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,SAAS,iBAAiB,2BAA2B,IAAI;;EAGlE,MAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eACC,uBAAuB,QAAQ,OAAO,QAAQ,OAAO,SAAS,EAC9D,6BACC,QAAQ,OAAO,QAAQ,OAAO,SAC9B,QAAQ,OAAO,QAAQ,QACvB,CACD,CACD;AAEF,SAAO;;AAIR,KAAI,cACH,QAAO,sBAAsB,SAAS,KAAK;CAO5C,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AAEpD,KAAI,iBAAiB,WAAW;EAC/B,MAAM,WAAW,SAAS,iBAAiB,4BAA4B,IAAI;AAE3E,MAAI,IAAI,aAAa,oBAAoB;GACxC,MAAM,SAAS,gBAAgB,KAAK,QAAQ,OAAO,QAAQ,OAAO;AAClE,YAAS,QAAQ,IAChB,oBACA,6BAA6B,OAAO,wCACpC;;AAEF,SAAO;;CAGR,MAAM,cAAc,iBAAiB;CAKrC,MAAM,SAAS,QAAQ,QAAQ,OAAO,aAAa;AAEnD,KADsB,IAAI,aAAa,qBAClB,CAAC,YACrB,QAAO,wBAAwB,KAAK,QAAQ,OAAO,QAAQ,OAAO;CAQnE,MAAM,iBAAiB,IAAI,SAAS,WAAW,2BAA2B;AAC1E,KACC,cACA,CAAC,eACD,CAAC,kBACD,eAAe,OAAO,IACtB,CAAC,kBAGD;MADmB,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,KAC/C,IAClB,QAAO,sBAAsB;;AAK/B,KAAI,aAAa;EAEhB,MAAM,aAAa,kBAAkB,IAAI,UAAU,QAAQ,QAAQ,OAAO,YAAY;AACtF,MAAI,WAAY,QAAO;EAEvB,MAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eACC,uBAAuB,QAAQ,OAAO,QAAQ,OAAO,SAAS,EAC9D,6BACC,QAAQ,OAAO,QAAQ,OAAO,SAC9B,QAAQ,OAAO,QAAQ,QACvB,CACD,CACD;AAEF,SAAO;;CAGR,MAAM,WAAW,MAAM,iBAAiB,SAAS,KAAK;AAGtD,KAAI,CAAC,OAAO,KAAK,IAAI,IACpB,UAAS,QAAQ,IAChB,2BACA,eACC,uBAAuB,QAAQ,OAAO,QAAQ,OAAO,SAAS,EAC9D,6BACC,QAAQ,OAAO,QAAQ,OAAO,SAC9B,QAAQ,OAAO,QAAQ,QACvB,CACD,CACD;AAGF,QAAO;EACN;;;;;AAMF,eAAe,iBACd,SACA,MACoB;CACpB,MAAM,EAAE,KAAK,WAAW;CACxB,MAAM,EAAE,WAAW;CAInB,MAAM,qBACL,IAAI,SAAS,WAAW,uBAAuB,IAC/C,IAAI,SAAS,WAAW,wBAAwB,IAChD,IAAI,SAAS,WAAW,+BAA+B;CACxD,MAAM,aAAa,IAAI,SAAS,WAAW,eAAe;AAE1D,KAAI,CAAC,QAAQ,GAEZ,QAAO,MAAM;CAId,MAAM,WAAW,YAAY,OAAO,OAAO;AAE3C,KAAI,SAAS,SAAS,YAAY;AAEjC,MAAI,OAAO,KAAK,IAAI,KAAK;AACxB,OAAI,mBACH,QAAO,MAAM;AAGd,UAAO,kBAAkB,SAAS,MAAM,WAAW;;AAIpD,SAAO,mBAAmB,SAAS,MAAM,UAAU,WAAW;;AAI/D,KAAI,mBACH,QAAO,MAAM;AAGd,QAAO,kBAAkB,SAAS,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;AAqBpD,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,QAAQ,QAAQ;CACxB,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,eAAe,MAAM,iBAAiB,QAAQ;AACpD,MAAI,iBAAiB,gBAEpB,QAAO,MAAM;AAEd,MAAI,iBAAiB,UAGpB,QAAO,SAAS,iBAAiB,4BAA4B,IAAI;UAG1D,OAAO;AACf,UAAQ,MAAM,mCAAmC,MAAM;;CAGxD,MAAM,WAAW,YAAY,QAAQ,OAAO;AAC5C,KACC,SAAS,SAAS,cAClB,CAAC,OAAO,KAAK,IAAI,OACjB,CAAC,uBAAuB,IAAI,UAAU,OAAO,CAE7C,QAAO,mBAAmB,SAAS,MAAM,UAAU,KAAK;AAGzD,KAAI;EAEH,MAAM,EAAE,YAAY;EACpB,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;UAGR,OAAO;AAEf,UAAQ,MAAM,oCAAoC,MAAM;;AAGzD,QAAO,MAAM;;AAGd,SAAS,uBAAuB,UAAkB,QAA6C;CAE9F,MAAM,QAAQ,SAAS,MAAM,GAAc;CAC3C,MAAM,aAAa,MAAM,QAAQ,IAAI;AACrC,KAAI,cAAc,KAAK,CAAC,QAAQ,mBAAoB,QAAO;AAE3D,QACC,OAAO,mBAAmB,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,MAAM,WAAW,CAAC,EAAE,WAAW;;;;;;AAQ7F,eAAe,sBACd,SACA,MACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;EACH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,MAAI,aAAa,MAAM,QAAQ,IAAI;GAElC,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AACtD,OAAI,QAAQ,CAAC,KAAK,SACjB,QAAO,OAAO;;SAGT;AAIR,QAAO,MAAM;;;;;AAMd,eAAe,mBACd,SACA,MACA,UACA,aACoB;CACpB,MAAM,EAAE,QAAQ,YAAY;CAC5B,MAAM,EAAE,WAAW;AAEnB,KAAI;AAGH,MAAI,OAAOA,iBAAwB,WAClC,OAAM,IAAI,MACT,iBAAiB,SAAS,WAAW,2CACrC;EAIF,MAAM,aAAa,MAAMA,aAAoB,SAAS,SAAS,OAAO;EAItE,MAAM,iBAAiB,SAAS;EAGhC,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC9C,IAAI,OAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAEzD,MAAI,CAAC,MAAM;AAEV,OAAI,eAAe,kBAAkB,MACpC,QAAO,IAAI,SAAS,uBAAuB;IAC1C,QAAQ;IACR,SAAS;KAAE,gBAAgB;KAAc,GAAG;KAAkB;IAC9D,CAAC;GAIH,MAAM,YAAY,MAAM,OAAO,GAC7B,WAAW,QAAQ,CACnB,OAAO,OAAO,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,CAC5C,kBAAkB;GAEpB,MAAM,cAAc,OAAO,WAAW,SAAS,EAAE,KAAK;GACtD,MAAM,OAAO,cAAc,aAAa,WAAW;GAGnD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,UAAU;IACf,IAAI,MAAM;IACV,OAAO,WAAW;IAClB,MAAM,WAAW;IACjB;IACA,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ;AAED,SAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,OAAO,QAAQ,CAAC,SAAS;AAE7D,UAAO,MAAM,QAAQ,eAAe,WAAW,MAAM;AAErD,WAAQ,IACP,qCAAqC,WAAW,MAAM,UAAU,KAAK,WAAW,YAAY,GAC5F;SACK;GAEN,MAAM,UAAmC,EAAE;GAC3C,IAAI;GACJ,IAAI;AAEJ,OAAI,eAAe,aAAa,SAAS,WAAW,QAAQ,KAAK,SAAS,WAAW,MAAM;AAC1F,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAIhB,OAAI,eAAe,aAAa,KAAK,SAAS,WAAW,MAAM;AAC9D,cAAU,WAAW;AACrB,YAAQ,OAAO;;AAGhB,OAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,YAAQ,8BAAa,IAAI,MAAM,EAAC,aAAa;AAC7C,UAAM,OAAO,GAAG,YAAY,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,MAAM,KAAK,KAAK,GAAG,CAAC,SAAS;AAErF,WAAO;KACN,GAAG;KACH,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC,GAAI,UAAU,EAAE,MAAM,SAAS,GAAG,EAAE;KACpC;AAED,YAAQ,IACP,gCAAgC,WAAW,MAAM,IACjD,OAAO,KAAK,QAAQ,CAAC,QAAQ,MAAM,MAAM,aAAa,CACtD;;;AAIH,MAAI,CAAC,KAEJ,QAAO,IAAI,SAAS,4BAA4B;GAC/C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,MAAI,KAAK,SACR,QAAO,IAAI,SAAS,oBAAoB;GACvC,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;AAIH,SAAO,OAAO;EAId,MAAM,EAAE,YAAY;AACpB,WAAS,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAErC,SAAO,MAAM;UACL,OAAO;AACf,UAAQ,MAAM,+BAA+B,MAAM;AAEnD,SAAO,IAAI,SAAS,yBAAyB;GAC5C,QAAQ;GACR,SAAS;IAAE,gBAAgB;IAAc,GAAG;IAAkB;GAC9D,CAAC;;;;;;;;;;;AAYJ,eAAe,iBACd,SACgD;CAChD,MAAM,aAAa,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB;AAC/D,KAAI,CAAC,YAAY,WAAW,UAAU,CAAE,QAAO;CAE/C,MAAM,QAAQ,WAAW,MAAM,EAAE;AACjC,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,EAAE,WAAW;CACnB,MAAM,EAAE,WAAW;AACnB,KAAI,CAAC,QAAQ,GAAI,QAAO;CAGxB,IAAI,WAAuC;AAE3C,KAAI,MAAM,WAAW,UAAU,CAC9B,YAAW,MAAM,gBAAgB,OAAO,IAAI,MAAM;UACxC,MAAM,WAAW,UAAU,CACrC,YAAW,MAAM,kBAAkB,OAAO,IAAI,MAAM;KAGpD,QAAO;AAGR,KAAI,CAAC,SAAU,QAAO;CAItB,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,SAAS,OAAO;AAEvD,KAAI,CAAC,QAAQ,KAAK,SAAU,QAAO;AAGnC,QAAO,OAAO;AACd,QAAO,cAAc,SAAS;AAC9B,QAAO,UAAU,SAAS;AAE1B,QAAO;;;;;AAMR,eAAe,kBACd,SACA,MACA,YACoB;CACpB,MAAM,EAAE,KAAK,QAAQ,YAAY;CACjC,MAAM,EAAE,WAAW;AAEnB,KAAI;EAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AAErD,MAAI,CAAC,aAAa,IAAI;AACrB,OAAI,WACH,QAAO,SAAS,qBAAqB,qBAAqB,IAAI;GAE/D,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AAGtF,YAAS,aAAa,IAAI,YAAY,IAAI,WAAW,IAAI,OAAO;AAChE,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;EAK7C,MAAM,OAAO,MADG,oBAAoB,OAAO,GAAG,CACnB,YAAY,YAAY,GAAG;AAEtD,MAAI,CAAC,MAAM;AAEV,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,aAAa,kBAAkB,IAAI;GAEpD,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,MAAI,KAAK,UAAU;AAClB,YAAS,SAAS;AAClB,OAAI,WACH,QAAO,SAAS,oBAAoB,oBAAoB,IAAI;GAE7D,MAAM,WAAW,IAAI,IAAI,wBAAwB,gBAAgB,KAAK,QAAQ,OAAO,CAAC;AACtF,YAAS,aAAa,IAAI,SAAS,mBAAmB;AACtD,UAAO,QAAQ,SAAS,SAAS,UAAU,CAAC;;AAI7C,SAAO,OAAO;UACN,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAE9C,SAAO,QAAQ,SAAS,uBAAuB;;AAGhD,QAAO,MAAM;;;;;;;;;AAcd,MAAM,cAA0F;CAE/F;EAAC;EAAwB;EAAO;EAAe;CAC/C;EAAC;EAAwB;EAAS;EAAgB;CAGlD;EAAC;EAA2B;EAAK;EAAa;CAC9C;EAAC;EAAsB;EAAO;EAAa;CAC3C;EAAC;EAAsB;EAAS;EAAc;CAG9C;EAAC;EAAuB;EAAO;EAAc;CAC7C;EAAC;EAAuB;EAAS;EAAe;CAOhD;EAAC;EAA2B;EAAO;EAAe;CAClD;EAAC;EAAoC;EAAS;EAAgB;CAC9D;EAAC;EAA2B;EAAS;EAAoB;CACzD;EAAC;EAAsB;EAAO;EAAe;CAC7C;EAAC;EAAsB;EAAS;EAAe;CAC/C;EAAC;EAAyB;EAAO;EAAe;CAChD;EAAC;EAAyB;EAAS;EAAgB;CACnD;EAAC;EAA6B;EAAO;EAAe;CACpD;EAAC;EAA6B;EAAS;EAAgB;CACvD;EAAC;EAA0B;EAAO;EAAe;CACjD;EAAC;EAA0B;EAAS;EAAgB;CAGpD;EAAC;EAAuB;EAAO;EAAe;CAC9C;EAAC;EAAuB;EAAS;EAAQ;CAIzC;EAAC;EAA+B;EAAK;EAAgB;CAGrD;EAAC;EAAuB;EAAK;EAAQ;CACrC;EAAC;EAAsB;EAAK;EAAQ;CACpC;EAAC;EAAwB;EAAK;EAAQ;CAItC;EAAC;EAAiC;EAAK;EAAQ;CAI/C;EAAC;EAAyB;EAAO;EAAgB;CACjD;EAAC;EAAyB;EAAS;EAAkB;CACrD;AAED,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;CAAS,CAAC;;;;;;;AAQjE,SAAS,kBACR,UACA,QACA,aACkB;AAElB,KAAI,CAAC,YAAa,QAAO;AAKzB,KAAI,aAAa,kBAAmB,QAAO;CAE3C,MAAM,UAAU,cAAc,IAAI,OAAO;AAEzC,MAAK,MAAM,CAAC,QAAQ,YAAY,UAAU,aAAa;AAEtD,MAAI,aAAa,UAAU,CAAC,SAAS,WAAW,SAAS,IAAI,CAAE;AAG/D,MAAI,eAAe,OAAQ,eAAe,WAAW,WAAY,eAAe,QAAQ;GACvF,MAAM,QAAQ,OAAO,UAAU,WAAW,CAAC,MAAM,GAAG;AACpD,OAAI,MAAM,MAAM,aAAa,SAAS,aAAa,SAAS,CAAC,CAAE,QAAO;AAEtE,UAAO,SACN,sBACA,+BAA+B,MAAM,KAAK,OAAO,IACjD,IACA;;;AAKH,KAAI,SAAS,aAAa,QAAQ,CAAE,QAAO;AAE3C,QAAO,SAAS,sBAAsB,qCAAqC,IAAI"}

package/dist/astro/middleware/media-usage-write-fence.mjs

@@ -1,10 +1,10 @@
 import "../../dialect-helpers-7_IqPdh9.mjs";
 import "../../base64-BQBZwXCx.mjs";
-import "../../types-C-Xp0CcN.mjs";
-import "../../errors-CjtE5aWF.mjs";
-import "../../errors-hskQ0C8G.mjs";
-import { t as apiError } from "../../error-DxgQdaZ_.mjs";
-import { a as readSiteWriteFence, o as recordSiteWrite } from "../../fence-vc3aHgRA.mjs";
+import "../../types-D2NEXtgB.mjs";
+import "../../errors-B4f4It-2.mjs";
+import "../../errors-BOYNdIo3.mjs";
+import { t as apiError } from "../../error-CVWeIOku.mjs";
+import { a as readSiteWriteFence, o as recordSiteWrite } from "../../fence-C3MUitUN.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/media-usage-write-fence.ts

package/dist/astro/middleware/redirect.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.mts","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"mappings":";;;;;;AAuDA;;;;;;;;;;;;cAAa,SAAA,EAsHX,KAAA,CAtHoB,iBAAA"}
+{"version":3,"file":"redirect.d.mts","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"mappings":";;;;;;AAoGA;;;;;;;;;;;;cAAa,SAAA,EAsGX,KAAA,CAtGoB,iBAAA"}

package/dist/astro/middleware/redirect.mjs

@@ -3,14 +3,15 @@ import "../../config-CvmjJcVw.mjs";
 import { t as after } from "../../after-PcEvMY_6.mjs";
 import "../../base64-BQBZwXCx.mjs";
 import "../../request-cache-C4CIo5ad.mjs";
-import "../../types-C-Xp0CcN.mjs";
+import "../../types-D2NEXtgB.mjs";
 import "../../resolve-D-kqyKns.mjs";
 import { t as isSiteRelativeDestination } from "../../destination-r2zIAZ2S.mjs";
-import { t as RedirectRepository } from "../../redirect-B39kTQ_0.mjs";
-import { i as matchCachedPatterns, r as loadCachedRedirects } from "../../cache-x0z8t_m9.mjs";
-import { n as createRedirectSource } from "../../artifacts-D-O-qj9C.mjs";
-import { c as getDb } from "../../loader-CetY659y.mjs";
-import { n as isTerminalStatus } from "../../status-Dl85BK39.mjs";
+import { t as RedirectRepository } from "../../redirect-DiS_3mA4.mjs";
+import { i as matchCachedPatterns, r as loadCachedRedirects } from "../../cache-CEU9wo_h.mjs";
+import { n as createRedirectSource } from "../../artifacts-htGyfCSt.mjs";
+import { c as getDb } from "../../loader-CswroUbe.mjs";
+import "../../json-recordset-BUjxhr77.mjs";
+import { n as isTerminalStatus } from "../../status-BFNdxzKc.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/redirect.ts
@@ -33,6 +34,39 @@ function recordHitInBackground(repo, id) {
 		}
 	});
 }
+/** Exact rules first, with or without a trailing slash, then patterns in precedence order. */
+function matchRedirect(cached, pathname) {
+	let exact = cached.exact.get(pathname);
+	if (!exact && pathname.length > 1) {
+		const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
+		exact = cached.exact.get(alt);
+	}
+	if (exact) return {
+		redirect: exact,
+		destination: exact.destination
+	};
+	return matchCachedPatterns(cached.patterns, pathname);
+}
+/** The response for a matched rule, or null when its destination is not safe to send. */
+function redirectResponse(context, repo, { redirect, destination }) {
+	if (isTerminalStatus(redirect.type)) {
+		recordHitInBackground(repo, redirect.id);
+		return new Response(null, { status: redirect.type });
+	}
+	if (!isSiteRelativeDestination(destination)) {
+		warnUnsafeDestination(redirect.id);
+		return null;
+	}
+	recordHitInBackground(repo, redirect.id);
+	const code = isRedirectCode(redirect.type) ? redirect.type : 301;
+	return context.redirect(destination, code);
+}
+/** Whether Astro's route cache will store the response: it does once a max age or a tag is set. */
+function routeCacheStores(cache) {
+	if (!cache?.enabled) return false;
+	const { maxAge, tags } = cache.options;
+	return maxAge !== void 0 || (tags?.length ?? 0) > 0;
+}
 const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 	if (SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix))) return next();
@@ -45,43 +79,29 @@ const onRequest = defineMiddleware(async (context, next) => {
 	}
 	try {
 		const repo = new RedirectRepository(db);
-		const cached = await loadCachedRedirects(createRedirectSource(db));
-		let exact = cached.exact.get(pathname);
-		if (!exact && pathname.length > 1) {
-			const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
-			exact = cached.exact.get(alt);
+		const source = createRedirectSource(db);
+		const routeCache = context.cache;
+		let cached = await loadCachedRedirects(source);
+		let match = matchRedirect(cached, pathname);
+		let verified = false;
+		if (match && routeCacheStores(routeCache)) {
+			cached = await loadCachedRedirects(source, { verify: true });
+			verified = true;
+			match = matchRedirect(cached, pathname);
 		}
-		if (exact) {
-			if (isTerminalStatus(exact.type)) {
-				recordHitInBackground(repo, exact.id);
-				return new Response(null, { status: exact.type });
-			}
-			const dest = exact.destination;
-			if (!isSiteRelativeDestination(dest)) {
-				warnUnsafeDestination(exact.id);
-				return next();
-			}
-			recordHitInBackground(repo, exact.id);
-			const code = isRedirectCode(exact.type) ? exact.type : 301;
-			return context.redirect(dest, code);
-		}
-		const patternMatch = matchCachedPatterns(cached.patterns, pathname);
-		if (patternMatch) {
-			const { redirect, destination } = patternMatch;
-			if (isTerminalStatus(redirect.type)) {
-				recordHitInBackground(repo, redirect.id);
-				return new Response(null, { status: redirect.type });
-			}
-			if (!isSiteRelativeDestination(destination)) {
-				warnUnsafeDestination(redirect.id);
-				return next();
+		if (match) return redirectResponse(context, repo, match) ?? next();
+		const response = await next();
+		if (response.status === 404) routeCache?.set(false);
+		if (!verified && routeCacheStores(routeCache)) {
+			const current = await loadCachedRedirects(source, { verify: true }).catch(() => cached);
+			const late = current === cached ? null : matchRedirect(current, pathname);
+			const redirected = late && redirectResponse(context, repo, late);
+			if (redirected) {
+				routeCache?.set(false);
+				after(() => response.body?.pipeTo(new WritableStream()));
+				return redirected;
 			}
-			recordHitInBackground(repo, redirect.id);
-			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
-			return context.redirect(destination, code);
 		}
-		const response = await next();
-		if (response.status === 404) context.cache?.set(false);
 		const location = response.headers.get("location");
 		const missedByRedirect = isRedirectCode(response.status) && (location === "/404" || location === "/404/");
 		if (response.status === 404 && pathname !== "/404" && pathname !== "/404/" || missedByRedirect) {

package/dist/astro/middleware/redirect.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.mjs","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"sourcesContent":["/**\n * Redirect middleware\n *\n * Intercepts incoming requests and checks for matching redirect rules.\n * Runs after runtime init (needs db) but before setup/auth (should handle\n * ALL routes, including public ones, and should be fast).\n *\n * Skip paths:\n * - /_emdash/* (admin UI, API routes, auth endpoints)\n * - /_image (Astro image optimization)\n * - Static assets (files with extensions)\n *\n * 404 logging happens post-response: if next() returns 404 and the path\n * wasn't already matched by a redirect, log it.\n */\n\nimport type { APIContext } from \"astro\";\nimport { defineMiddleware } from \"astro:middleware\";\n\nimport { after } from \"../../after.js\";\nimport { RedirectRepository } from \"../../database/repositories/redirect.js\";\nimport { getDb } from \"../../loader.js\";\nimport { createRedirectSource } from \"../../redirects/artifacts.js\";\nimport { loadCachedRedirects, matchCachedPatterns } from \"../../redirects/cache.js\";\nimport { isSiteRelativeDestination } from \"../../redirects/destination.js\";\nimport { isTerminalStatus } from \"../../redirects/status.js\";\n\n/** Paths that should never be intercepted by redirects */\nconst SKIP_PREFIXES = [\"/_emdash\", \"/_image\"];\n\n/** Static asset extensions -- don't redirect file requests */\nconst ASSET_EXTENSION = /\\.\\w{1,10}$/;\n\ntype RedirectCode = 301 | 302 | 303 | 307 | 308;\n\nfunction isRedirectCode(code: number): code is RedirectCode {\n\treturn code === 301 || code === 302 || code === 303 || code === 307 || code === 308;\n}\n\nfunction warnUnsafeDestination(id: string): void {\n\tconsole.warn(\n\t\t`[emdash:redirects] Skipping redirect ${id}: destination is not a site-relative path`,\n\t);\n}\n\nfunction recordHitInBackground(repo: RedirectRepository, id: string): void {\n\tafter(async () => {\n\t\ttry {\n\t\t\tawait repo.recordHit(id);\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[emdash:redirects] failed to record redirect hit:\", error);\n\t\t}\n\t});\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { pathname } = context.url;\n\n\t// Skip internal paths and static assets\n\tif (SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {\n\t\treturn next();\n\t}\n\tif (ASSET_EXTENSION.test(pathname)) {\n\t\treturn next();\n\t}\n\n\t// Public visitors hit the runtime's anonymous fast path, which intentionally\n\t// omits `db` from `locals.emdash` to keep the public render boundary minimal\n\t// (issue #808). Fall back to `getDb()`, which transparently returns the\n\t// per-request scoped db (set in ALS by the runtime middleware) or the\n\t// singleton — same path the loader and template helpers use.\n\tlet db = context.locals.emdash?.db;\n\tif (!db) {\n\t\ttry {\n\t\t\tdb = await getDb();\n\t\t} catch {\n\t\t\treturn next();\n\t\t}\n\t}\n\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\n\t\t// One query loads the published rules into the cache; warm requests\n\t\t// issue zero queries, and an expired cache checks the published version\n\t\t// in the background. Empty-redirect sites cache an empty Map + array.\n\t\tconst cached = await loadCachedRedirects(createRedirectSource(db));\n\n\t\t// 1. Exact match (O(1) Map lookup)\n\t\tlet exact = cached.exact.get(pathname);\n\t\tif (!exact && pathname.length > 1) {\n\t\t\tconst alt = pathname.endsWith(\"/\") ? pathname.slice(0, -1) : `${pathname}/`;\n\t\t\texact = cached.exact.get(alt);\n\t\t}\n\t\tif (exact) {\n\t\t\t// Terminal statuses (410 Gone / 451): serve the status directly,\n\t\t\t// with no Location header.\n\t\t\tif (isTerminalStatus(exact.type)) {\n\t\t\t\trecordHitInBackground(repo, exact.id);\n\t\t\t\treturn new Response(null, { status: exact.type });\n\t\t\t}\n\t\t\tconst dest = exact.destination;\n\t\t\tif (!isSiteRelativeDestination(dest)) {\n\t\t\t\twarnUnsafeDestination(exact.id);\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\trecordHitInBackground(repo, exact.id);\n\t\t\tconst code = isRedirectCode(exact.type) ? exact.type : 301;\n\t\t\treturn context.redirect(dest, code);\n\t\t}\n\n\t\t// 2. Pattern match (compile once, match every request)\n\t\tconst patternMatch = matchCachedPatterns(cached.patterns, pathname);\n\t\tif (patternMatch) {\n\t\t\tconst { redirect, destination } = patternMatch;\n\t\t\t// Terminal statuses (410 Gone / 451): serve the status directly.\n\t\t\tif (isTerminalStatus(redirect.type)) {\n\t\t\t\trecordHitInBackground(repo, redirect.id);\n\t\t\t\treturn new Response(null, { status: redirect.type });\n\t\t\t}\n\t\t\tif (!isSiteRelativeDestination(destination)) {\n\t\t\t\twarnUnsafeDestination(redirect.id);\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\trecordHitInBackground(repo, redirect.id);\n\t\t\tconst code = isRedirectCode(redirect.type) ? redirect.type : 301;\n\t\t\treturn context.redirect(destination, code);\n\t\t}\n\n\t\t// No redirect matched -- proceed and check for 404\n\t\tconst response = await next();\n\n\t\t// Keep a 404 out of the route cache: publishing the missing entry later\n\t\t// purges content tags, not the missed path, so a cached 404 would outlive\n\t\t// the fix. Astro has no cache handle for URLs that match no route, but a\n\t\t// page answering a content miss with Astro.rewrite(\"/404\") has one.\n\t\tif (response.status === 404) {\n\t\t\tconst routeCache: APIContext[\"cache\"] | undefined = context.cache;\n\t\t\trouteCache?.set(false);\n\t\t}\n\n\t\t// Log misses under the path the visitor requested.\n\t\t// Two shapes count as a miss: a 404 response (an unmatched route, or a\n\t\t// page answering a content miss with Astro.rewrite(\"/404\")), and a\n\t\t// matched route answering a content miss with a redirect to /404 —\n\t\t// there the missed path exists only on this first pass, before the\n\t\t// browser follows the redirect. The error page itself is never logged: /404\n\t\t// answers 404 by design and carries no path information.\n\t\tconst location = response.headers.get(\"location\");\n\t\tconst missedByRedirect =\n\t\t\tisRedirectCode(response.status) && (location === \"/404\" || location === \"/404/\");\n\t\tconst missedDirectly = response.status === 404 && pathname !== \"/404\" && pathname !== \"/404/\";\n\t\tif (missedDirectly || missedByRedirect) {\n\t\t\tconst referrer = context.request.headers.get(\"referer\") ?? null;\n\t\t\tconst userAgent = context.request.headers.get(\"user-agent\") ?? null;\n\t\t\tafter(async () => {\n\t\t\t\ttry {\n\t\t\t\t\tawait repo.log404({\n\t\t\t\t\t\tpath: pathname,\n\t\t\t\t\t\treferrer,\n\t\t\t\t\t\tuserAgent,\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconsole.error(\"[emdash:redirects] failed to log 404:\", error);\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\n\t\treturn response;\n\t} catch {\n\t\t// If the redirects table doesn't exist yet (pre-migration), skip silently\n\t\treturn next();\n\t}\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,MAAM,gBAAgB,CAAC,YAAY,UAAU;;AAG7C,MAAM,kBAAkB;AAIxB,SAAS,eAAe,MAAoC;AAC3D,QAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;;AAGjF,SAAS,sBAAsB,IAAkB;AAChD,SAAQ,KACP,wCAAwC,GAAG,2CAC3C;;AAGF,SAAS,sBAAsB,MAA0B,IAAkB;AAC1E,OAAM,YAAY;AACjB,MAAI;AACH,SAAM,KAAK,UAAU,GAAG;WAChB,OAAO;AACf,WAAQ,MAAM,qDAAqD,MAAM;;GAEzE;;AAGH,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,aAAa,QAAQ;AAG7B,KAAI,cAAc,MAAM,WAAW,SAAS,WAAW,OAAO,CAAC,CAC9D,QAAO,MAAM;AAEd,KAAI,gBAAgB,KAAK,SAAS,CACjC,QAAO,MAAM;CAQd,IAAI,KAAK,QAAQ,OAAO,QAAQ;AAChC,KAAI,CAAC,GACJ,KAAI;AACH,OAAK,MAAM,OAAO;SACX;AACP,SAAO,MAAM;;AAIf,KAAI;EACH,MAAM,OAAO,IAAI,mBAAmB,GAAG;EAKvC,MAAM,SAAS,MAAM,oBAAoB,qBAAqB,GAAG,CAAC;EAGlE,IAAI,QAAQ,OAAO,MAAM,IAAI,SAAS;AACtC,MAAI,CAAC,SAAS,SAAS,SAAS,GAAG;GAClC,MAAM,MAAM,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS;AACzE,WAAQ,OAAO,MAAM,IAAI,IAAI;;AAE9B,MAAI,OAAO;AAGV,OAAI,iBAAiB,MAAM,KAAK,EAAE;AACjC,0BAAsB,MAAM,MAAM,GAAG;AACrC,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,MAAM,CAAC;;GAElD,MAAM,OAAO,MAAM;AACnB,OAAI,CAAC,0BAA0B,KAAK,EAAE;AACrC,0BAAsB,MAAM,GAAG;AAC/B,WAAO,MAAM;;AAEd,yBAAsB,MAAM,MAAM,GAAG;GACrC,MAAM,OAAO,eAAe,MAAM,KAAK,GAAG,MAAM,OAAO;AACvD,UAAO,QAAQ,SAAS,MAAM,KAAK;;EAIpC,MAAM,eAAe,oBAAoB,OAAO,UAAU,SAAS;AACnE,MAAI,cAAc;GACjB,MAAM,EAAE,UAAU,gBAAgB;AAElC,OAAI,iBAAiB,SAAS,KAAK,EAAE;AACpC,0BAAsB,MAAM,SAAS,GAAG;AACxC,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,SAAS,MAAM,CAAC;;AAErD,OAAI,CAAC,0BAA0B,YAAY,EAAE;AAC5C,0BAAsB,SAAS,GAAG;AAClC,WAAO,MAAM;;AAEd,yBAAsB,MAAM,SAAS,GAAG;GACxC,MAAM,OAAO,eAAe,SAAS,KAAK,GAAG,SAAS,OAAO;AAC7D,UAAO,QAAQ,SAAS,aAAa,KAAK;;EAI3C,MAAM,WAAW,MAAM,MAAM;AAM7B,MAAI,SAAS,WAAW,IAEvB,CADoD,QAAQ,OAChD,IAAI,MAAM;EAUvB,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;EACjD,MAAM,mBACL,eAAe,SAAS,OAAO,KAAK,aAAa,UAAU,aAAa;AAEzE,MADuB,SAAS,WAAW,OAAO,aAAa,UAAU,aAAa,WAChE,kBAAkB;GACvC,MAAM,WAAW,QAAQ,QAAQ,QAAQ,IAAI,UAAU,IAAI;GAC3D,MAAM,YAAY,QAAQ,QAAQ,QAAQ,IAAI,aAAa,IAAI;AAC/D,SAAM,YAAY;AACjB,QAAI;AACH,WAAM,KAAK,OAAO;MACjB,MAAM;MACN;MACA;MACA,CAAC;aACM,OAAO;AACf,aAAQ,MAAM,yCAAyC,MAAM;;KAE7D;;AAGH,SAAO;SACA;AAEP,SAAO,MAAM;;EAEb"}
+{"version":3,"file":"redirect.mjs","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"sourcesContent":["/**\n * Redirect middleware\n *\n * Intercepts incoming requests and checks for matching redirect rules.\n * Runs after runtime init (needs db) but before setup/auth (should handle\n * ALL routes, including public ones, and should be fast).\n *\n * Skip paths:\n * - /_emdash/* (admin UI, API routes, auth endpoints)\n * - /_image (Astro image optimization)\n * - Static assets (files with extensions)\n *\n * 404 logging happens post-response: if next() returns 404 and the path\n * wasn't already matched by a redirect, log it.\n */\n\nimport type { APIContext } from \"astro\";\nimport { defineMiddleware } from \"astro:middleware\";\n\nimport { after } from \"../../after.js\";\nimport { RedirectRepository } from \"../../database/repositories/redirect.js\";\nimport { getDb } from \"../../loader.js\";\nimport { createRedirectSource } from \"../../redirects/artifacts.js\";\nimport type { CachedRedirects, RedirectRule } from \"../../redirects/cache.js\";\nimport { loadCachedRedirects, matchCachedPatterns } from \"../../redirects/cache.js\";\nimport { isSiteRelativeDestination } from \"../../redirects/destination.js\";\nimport { isTerminalStatus } from \"../../redirects/status.js\";\n\n/** Paths that should never be intercepted by redirects */\nconst SKIP_PREFIXES = [\"/_emdash\", \"/_image\"];\n\n/** Static asset extensions -- don't redirect file requests */\nconst ASSET_EXTENSION = /\\.\\w{1,10}$/;\n\ntype RedirectCode = 301 | 302 | 303 | 307 | 308;\n\nfunction isRedirectCode(code: number): code is RedirectCode {\n\treturn code === 301 || code === 302 || code === 303 || code === 307 || code === 308;\n}\n\nfunction warnUnsafeDestination(id: string): void {\n\tconsole.warn(\n\t\t`[emdash:redirects] Skipping redirect ${id}: destination is not a site-relative path`,\n\t);\n}\n\nfunction recordHitInBackground(repo: RedirectRepository, id: string): void {\n\tafter(async () => {\n\t\ttry {\n\t\t\tawait repo.recordHit(id);\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[emdash:redirects] failed to record redirect hit:\", error);\n\t\t}\n\t});\n}\n\ninterface RedirectMatch {\n\tredirect: RedirectRule;\n\tdestination: string;\n}\n\n/** Exact rules first, with or without a trailing slash, then patterns in precedence order. */\nfunction matchRedirect(cached: CachedRedirects, pathname: string): RedirectMatch | null {\n\tlet exact = cached.exact.get(pathname);\n\tif (!exact && pathname.length > 1) {\n\t\tconst alt = pathname.endsWith(\"/\") ? pathname.slice(0, -1) : `${pathname}/`;\n\t\texact = cached.exact.get(alt);\n\t}\n\tif (exact) return { redirect: exact, destination: exact.destination };\n\treturn matchCachedPatterns(cached.patterns, pathname);\n}\n\n/** The response for a matched rule, or null when its destination is not safe to send. */\nfunction redirectResponse(\n\tcontext: APIContext,\n\trepo: RedirectRepository,\n\t{ redirect, destination }: RedirectMatch,\n): Response | null {\n\t// Terminal statuses (410 Gone / 451): serve the status directly,\n\t// with no Location header.\n\tif (isTerminalStatus(redirect.type)) {\n\t\trecordHitInBackground(repo, redirect.id);\n\t\treturn new Response(null, { status: redirect.type });\n\t}\n\tif (!isSiteRelativeDestination(destination)) {\n\t\twarnUnsafeDestination(redirect.id);\n\t\treturn null;\n\t}\n\trecordHitInBackground(repo, redirect.id);\n\tconst code = isRedirectCode(redirect.type) ? redirect.type : 301;\n\treturn context.redirect(destination, code);\n}\n\n/** Whether Astro's route cache will store the response: it does once a max age or a tag is set. */\nfunction routeCacheStores(cache: APIContext[\"cache\"] | undefined): boolean {\n\tif (!cache?.enabled) return false;\n\tconst { maxAge, tags } = cache.options;\n\treturn maxAge !== undefined || (tags?.length ?? 0) > 0;\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { pathname } = context.url;\n\n\t// Skip internal paths and static assets\n\tif (SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {\n\t\treturn next();\n\t}\n\tif (ASSET_EXTENSION.test(pathname)) {\n\t\treturn next();\n\t}\n\n\t// Public visitors hit the runtime's anonymous fast path, which intentionally\n\t// omits `db` from `locals.emdash` to keep the public render boundary minimal\n\t// (issue #808). Fall back to `getDb()`, which transparently returns the\n\t// per-request scoped db (set in ALS by the runtime middleware) or the\n\t// singleton — same path the loader and template helpers use.\n\tlet db = context.locals.emdash?.db;\n\tif (!db) {\n\t\ttry {\n\t\t\tdb = await getDb();\n\t\t} catch {\n\t\t\treturn next();\n\t\t}\n\t}\n\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\t\tconst source = createRedirectSource(db);\n\t\tconst routeCache: APIContext[\"cache\"] | undefined = context.cache;\n\n\t\t// One query loads the published rules into the cache; warm requests\n\t\t// issue zero queries, and an expired cache checks the published version\n\t\t// in the background. Empty-redirect sites cache an empty Map + array.\n\t\t// A response the route cache stores is served to every visitor until it\n\t\t// is purged, so before one is returned the rules are verified current.\n\t\tlet cached = await loadCachedRedirects(source);\n\t\tlet match = matchRedirect(cached, pathname);\n\t\tlet verified = false;\n\t\tif (match && routeCacheStores(routeCache)) {\n\t\t\tcached = await loadCachedRedirects(source, { verify: true });\n\t\t\tverified = true;\n\t\t\tmatch = matchRedirect(cached, pathname);\n\t\t}\n\t\tif (match) return redirectResponse(context, repo, match) ?? next();\n\n\t\t// No redirect matched -- proceed and check for 404\n\t\tconst response = await next();\n\n\t\t// Keep a 404 out of the route cache: publishing the missing entry later\n\t\t// purges content tags, not the missed path, so a cached 404 would outlive\n\t\t// the fix. Astro has no cache handle for URLs that match no route, but a\n\t\t// page answering a content miss with Astro.rewrite(\"/404\") has one.\n\t\tif (response.status === 404) {\n\t\t\trouteCache?.set(false);\n\t\t}\n\n\t\tif (!verified && routeCacheStores(routeCache)) {\n\t\t\tconst current = await loadCachedRedirects(source, { verify: true }).catch(() => cached);\n\t\t\tconst late = current === cached ? null : matchRedirect(current, pathname);\n\t\t\tconst redirected = late && redirectResponse(context, repo, late);\n\t\t\tif (redirected) {\n\t\t\t\trouteCache?.set(false);\n\t\t\t\t// Finish the discarded render instead of cancelling it: a render cut off\n\t\t\t\t// with its request never settles an isolate-wide fetch it started, and\n\t\t\t\t// every later render awaiting that fetch hangs.\n\t\t\t\tafter(() => response.body?.pipeTo(new WritableStream()));\n\t\t\t\treturn redirected;\n\t\t\t}\n\t\t}\n\n\t\t// Log misses under the path the visitor requested.\n\t\t// Two shapes count as a miss: a 404 response (an unmatched route, or a\n\t\t// page answering a content miss with Astro.rewrite(\"/404\")), and a\n\t\t// matched route answering a content miss with a redirect to /404 —\n\t\t// there the missed path exists only on this first pass, before the\n\t\t// browser follows the redirect. The error page itself is never logged: /404\n\t\t// answers 404 by design and carries no path information.\n\t\tconst location = response.headers.get(\"location\");\n\t\tconst missedByRedirect =\n\t\t\tisRedirectCode(response.status) && (location === \"/404\" || location === \"/404/\");\n\t\tconst missedDirectly = response.status === 404 && pathname !== \"/404\" && pathname !== \"/404/\";\n\t\tif (missedDirectly || missedByRedirect) {\n\t\t\tconst referrer = context.request.headers.get(\"referer\") ?? null;\n\t\t\tconst userAgent = context.request.headers.get(\"user-agent\") ?? null;\n\t\t\tafter(async () => {\n\t\t\t\ttry {\n\t\t\t\t\tawait repo.log404({\n\t\t\t\t\t\tpath: pathname,\n\t\t\t\t\t\treferrer,\n\t\t\t\t\t\tuserAgent,\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconsole.error(\"[emdash:redirects] failed to log 404:\", error);\n\t\t\t\t}\n\t\t\t});\n\t\t}\n\n\t\treturn response;\n\t} catch {\n\t\t// If the redirects table doesn't exist yet (pre-migration), skip silently\n\t\treturn next();\n\t}\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;AA6BA,MAAM,gBAAgB,CAAC,YAAY,UAAU;;AAG7C,MAAM,kBAAkB;AAIxB,SAAS,eAAe,MAAoC;AAC3D,QAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;;AAGjF,SAAS,sBAAsB,IAAkB;AAChD,SAAQ,KACP,wCAAwC,GAAG,2CAC3C;;AAGF,SAAS,sBAAsB,MAA0B,IAAkB;AAC1E,OAAM,YAAY;AACjB,MAAI;AACH,SAAM,KAAK,UAAU,GAAG;WAChB,OAAO;AACf,WAAQ,MAAM,qDAAqD,MAAM;;GAEzE;;;AASH,SAAS,cAAc,QAAyB,UAAwC;CACvF,IAAI,QAAQ,OAAO,MAAM,IAAI,SAAS;AACtC,KAAI,CAAC,SAAS,SAAS,SAAS,GAAG;EAClC,MAAM,MAAM,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS;AACzE,UAAQ,OAAO,MAAM,IAAI,IAAI;;AAE9B,KAAI,MAAO,QAAO;EAAE,UAAU;EAAO,aAAa,MAAM;EAAa;AACrE,QAAO,oBAAoB,OAAO,UAAU,SAAS;;;AAItD,SAAS,iBACR,SACA,MACA,EAAE,UAAU,eACM;AAGlB,KAAI,iBAAiB,SAAS,KAAK,EAAE;AACpC,wBAAsB,MAAM,SAAS,GAAG;AACxC,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,SAAS,MAAM,CAAC;;AAErD,KAAI,CAAC,0BAA0B,YAAY,EAAE;AAC5C,wBAAsB,SAAS,GAAG;AAClC,SAAO;;AAER,uBAAsB,MAAM,SAAS,GAAG;CACxC,MAAM,OAAO,eAAe,SAAS,KAAK,GAAG,SAAS,OAAO;AAC7D,QAAO,QAAQ,SAAS,aAAa,KAAK;;;AAI3C,SAAS,iBAAiB,OAAiD;AAC1E,KAAI,CAAC,OAAO,QAAS,QAAO;CAC5B,MAAM,EAAE,QAAQ,SAAS,MAAM;AAC/B,QAAO,WAAW,WAAc,MAAM,UAAU,KAAK;;AAGtD,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,aAAa,QAAQ;AAG7B,KAAI,cAAc,MAAM,WAAW,SAAS,WAAW,OAAO,CAAC,CAC9D,QAAO,MAAM;AAEd,KAAI,gBAAgB,KAAK,SAAS,CACjC,QAAO,MAAM;CAQd,IAAI,KAAK,QAAQ,OAAO,QAAQ;AAChC,KAAI,CAAC,GACJ,KAAI;AACH,OAAK,MAAM,OAAO;SACX;AACP,SAAO,MAAM;;AAIf,KAAI;EACH,MAAM,OAAO,IAAI,mBAAmB,GAAG;EACvC,MAAM,SAAS,qBAAqB,GAAG;EACvC,MAAM,aAA8C,QAAQ;EAO5D,IAAI,SAAS,MAAM,oBAAoB,OAAO;EAC9C,IAAI,QAAQ,cAAc,QAAQ,SAAS;EAC3C,IAAI,WAAW;AACf,MAAI,SAAS,iBAAiB,WAAW,EAAE;AAC1C,YAAS,MAAM,oBAAoB,QAAQ,EAAE,QAAQ,MAAM,CAAC;AAC5D,cAAW;AACX,WAAQ,cAAc,QAAQ,SAAS;;AAExC,MAAI,MAAO,QAAO,iBAAiB,SAAS,MAAM,MAAM,IAAI,MAAM;EAGlE,MAAM,WAAW,MAAM,MAAM;AAM7B,MAAI,SAAS,WAAW,IACvB,aAAY,IAAI,MAAM;AAGvB,MAAI,CAAC,YAAY,iBAAiB,WAAW,EAAE;GAC9C,MAAM,UAAU,MAAM,oBAAoB,QAAQ,EAAE,QAAQ,MAAM,CAAC,CAAC,YAAY,OAAO;GACvF,MAAM,OAAO,YAAY,SAAS,OAAO,cAAc,SAAS,SAAS;GACzE,MAAM,aAAa,QAAQ,iBAAiB,SAAS,MAAM,KAAK;AAChE,OAAI,YAAY;AACf,gBAAY,IAAI,MAAM;AAItB,gBAAY,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,CAAC;AACxD,WAAO;;;EAWT,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;EACjD,MAAM,mBACL,eAAe,SAAS,OAAO,KAAK,aAAa,UAAU,aAAa;AAEzE,MADuB,SAAS,WAAW,OAAO,aAAa,UAAU,aAAa,WAChE,kBAAkB;GACvC,MAAM,WAAW,QAAQ,QAAQ,QAAQ,IAAI,UAAU,IAAI;GAC3D,MAAM,YAAY,QAAQ,QAAQ,QAAQ,IAAI,aAAa,IAAI;AAC/D,SAAM,YAAY;AACjB,QAAI;AACH,WAAM,KAAK,OAAO;MACjB,MAAM;MACN;MACA;MACA,CAAC;aACM,OAAO;AACf,aAAQ,MAAM,yCAAyC,MAAM;;KAE7D;;AAGH,SAAO;SACA;AAEP,SAAO,MAAM;;EAEb"}