qarpeo 0.0.0-alpha.10

package/dist/runtime/server/routes/atom.xml.get.mjs

@@ -0,0 +1,76 @@
+import { defineEventHandler } from "nuxt/server";
+import { getCloudflareEnv } from "../../bindings.mjs";
+import { buildAtomXml, formatISO8601, rowToFeedEntry } from "../utils/feed.mjs";
+export default defineEventHandler(async (event) => {
+  const runtimeConfig = globalThis.__NUXT_RUNTIME_CONFIG__ || {};
+  const site = runtimeConfig.public?.qarpeo?.site || {};
+  if (site.feed === false) {
+    return new Response(
+      `<?xml version="1.0" encoding="UTF-8"?><feed xmlns="http://www.w3.org/2005/Atom"><title>Feed Disabled</title></feed>`,
+      {
+        headers: {
+          "Content-Type": "application/atom+xml; charset=UTF-8"
+        }
+      }
+    );
+  }
+  const feedConfig = typeof site.feed === "object" ? site.feed : {};
+  const baseUrl = (site.url || "").replace(/\/$/, "");
+  const maxItems = feedConfig.maxItems || 50;
+  const cacheMaxAge = feedConfig.cacheMaxAge || 3600;
+  const siteName = site.name || "Site Feed";
+  const siteDescription = site.description || "";
+  const atomFeedUrl = `${baseUrl}/atom.xml`;
+  let xmlBody = "";
+  try {
+    const env = getCloudflareEnv(event);
+    const d1Binding = env.DB || env.DATABASE || env.d1;
+    if (d1Binding && typeof d1Binding.prepare === "function") {
+      let query = "SELECT id, slug, path, collection, title, description, tags, published_at, created_at, updated_at, author_id FROM _qarpeo_cms_entries WHERE status = 'published' AND visibility = 'public'";
+      const params = [];
+      if (feedConfig.collections?.length) {
+        const placeholders = feedConfig.collections.map(() => "?").join(", ");
+        query += ` AND collection IN (${placeholders})`;
+        params.push(...feedConfig.collections);
+      }
+      query += " ORDER BY published_at DESC, created_at DESC LIMIT ?";
+      params.push(maxItems);
+      const stmt = d1Binding.prepare(query);
+      const res = await (params.length > 1 ? stmt.bind(...params) : stmt.bind(maxItems)).all();
+      const rows = res?.results || [];
+      const entries = rows.map((row) => rowToFeedEntry(row, baseUrl));
+      const latestUpdated = entries[0]?.updated || formatISO8601(null);
+      xmlBody = buildAtomXml(entries, {
+        title: siteName,
+        id: atomFeedUrl,
+        link: baseUrl || "/",
+        updated: latestUpdated,
+        description: siteDescription,
+        language: site.defaultLocale || "en"
+      });
+    } else {
+      xmlBody = buildAtomXml([], {
+        title: siteName,
+        id: atomFeedUrl,
+        link: baseUrl || "/",
+        updated: formatISO8601(null),
+        description: siteDescription
+      });
+    }
+  } catch {
+    xmlBody = buildAtomXml([], {
+      title: siteName,
+      id: atomFeedUrl,
+      link: baseUrl || "/",
+      updated: formatISO8601(null),
+      description: siteDescription
+    });
+  }
+  return new Response(xmlBody, {
+    headers: {
+      "Content-Type": "application/atom+xml; charset=UTF-8",
+      "Cache-Control": `public, max-age=${cacheMaxAge}, s-maxage=86400`,
+      "X-Content-Type-Options": "nosniff"
+    }
+  });
+});

package/dist/runtime/server/routes/auth/2fa/disable.post.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    disabled: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/2fa/disable.post.mjs

@@ -0,0 +1,44 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getD1Binding } from "../../../../db.mjs";
+import { requireAuthSession } from "../../../utils/session.mjs";
+import { verifyTOTPCode } from "../../../utils/totp.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const user = session?.user;
+  if (!user || !user.id) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  const body = await readBody(event);
+  const code = body?.code;
+  if (!code || typeof code !== "string") {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Current TOTP code is required to disable 2FA"
+    });
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const twoFactorRecord = await d1.prepare("SELECT secret FROM _qarpeo_two_factor WHERE user_id = ? LIMIT 1").bind(user.id).first();
+  if (!twoFactorRecord?.secret) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "2FA is not enabled for this account"
+    });
+  }
+  const isValid = await verifyTOTPCode(twoFactorRecord.secret, code);
+  if (!isValid) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Invalid TOTP code"
+    });
+  }
+  try {
+    await d1.prepare("DELETE FROM _qarpeo_two_factor WHERE user_id = ?").bind(user.id).run();
+  } catch (err) {
+    console.warn("[qarpeo] Failed to disable 2FA in D1:", err.message);
+  }
+  return { disabled: true };
+});

package/dist/runtime/server/routes/auth/2fa/setup.post.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    secret: string;
+    otpauthUrl: string;
+    backupCodes: string[];
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/2fa/setup.post.mjs

@@ -0,0 +1,32 @@
+import { defineEventHandler, createError, useRuntimeConfig } from "nuxt/server";
+import { getKVBinding } from "../../../../kv.mjs";
+import { requireAuthSession } from "../../../utils/session.mjs";
+import { generateBase32Secret, generateBackupCodes, generateTOTPUrl } from "../../../utils/totp.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const user = session?.user;
+  if (!user || !user.id) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  const runtimeConfig = useRuntimeConfig();
+  const appName = runtimeConfig.public?.qarpeo?.site?.name || process.env.CLOUDFLARE_PROJECT_NAME || "Qarpeo App";
+  const secret = generateBase32Secret(20);
+  const { rawCodes, hashedCodes } = await generateBackupCodes(8);
+  const otpauthUrl = generateTOTPUrl({
+    issuer: appName,
+    accountName: user.email || user.name || "User",
+    secret
+  });
+  try {
+    const kv = getKVBinding("KV", event);
+    await kv.put(`2fa:setup:${user.id}`, JSON.stringify({ secret, backupCodes: hashedCodes }), {
+      expirationTtl: 600
+    });
+  } catch {
+  }
+  return {
+    secret,
+    otpauthUrl,
+    backupCodes: rawCodes
+  };
+});

package/dist/runtime/server/routes/auth/2fa/verify.post.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    enabled: boolean;
+    mfaVerified: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/2fa/verify.post.mjs

@@ -0,0 +1,92 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getD1Binding } from "../../../../db.mjs";
+import { getKVBinding } from "../../../../kv.mjs";
+import { requireAuthSession, setAuthSession } from "../../../utils/session.mjs";
+import { hashBackupCode, verifyTOTPCode } from "../../../utils/totp.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const user = session?.user;
+  if (!user || !user.id) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  const body = await readBody(event);
+  const code = body?.code;
+  if (!code || typeof code !== "string") {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "6-digit TOTP code or backup code is required"
+    });
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  let secret = body?.secret;
+  let backupCodes = body?.backupCodes || [];
+  let isExisting = false;
+  if (!secret) {
+    try {
+      const kv = getKVBinding("KV", event);
+      const setupData = await kv.get(`2fa:setup:${user.id}`, { type: "json" });
+      if (setupData?.secret) {
+        secret = setupData.secret;
+        backupCodes = setupData.backupCodes || [];
+      }
+    } catch {
+    }
+  }
+  if (!secret && d1) {
+    try {
+      const existing = await d1.prepare("SELECT * FROM _qarpeo_two_factor WHERE user_id = ? AND enabled = 1 LIMIT 1").bind(user.id).first();
+      if (existing?.secret) {
+        secret = existing.secret;
+        isExisting = true;
+      }
+    } catch {
+    }
+  }
+  if (!secret) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "No active 2FA configuration found. Please call /api/auth/2fa/setup first."
+    });
+  }
+  const isValid = await verifyTOTPCode(secret, code);
+  if (!isValid) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Invalid TOTP verification code"
+    });
+  }
+  if (!isExisting && d1) {
+    try {
+      const id = crypto.randomUUID();
+      const now = Date.now();
+      const hashedBackupCodes = await Promise.all(
+        backupCodes.map(async (c) => c.length === 64 ? c : await hashBackupCode(c))
+      );
+      await d1.prepare(`
+          INSERT INTO _qarpeo_two_factor (id, user_id, secret, backup_codes, enabled, created_at)
+          VALUES (?, ?, ?, ?, 1, ?)
+          ON CONFLICT(user_id) DO UPDATE SET secret = excluded.secret, backup_codes = excluded.backup_codes, enabled = 1
+        `).bind(id, user.id, secret, JSON.stringify(hashedBackupCodes), now).run();
+      try {
+        const kv = getKVBinding("KV", event);
+        await kv.delete(`2fa:setup:${user.id}`);
+      } catch {
+      }
+    } catch (err) {
+      console.warn("[qarpeo] Failed to save 2FA into D1:", err.message);
+    }
+  }
+  await setAuthSession(event, {
+    ...session,
+    mfaVerified: true
+  });
+  return {
+    success: true,
+    enabled: true,
+    mfaVerified: true
+  };
+});

package/dist/runtime/server/routes/auth/[provider]/callback.d.ts

@@ -0,0 +1 @@
+export { default } from "../[provider]";

package/dist/runtime/server/routes/auth/[provider]/callback.mjs

@@ -0,0 +1 @@
+export { default } from "../[provider].mjs";

package/dist/runtime/server/routes/auth/[provider].d.ts

@@ -0,0 +1,3 @@
+export declare function getOAuthProviderFactory(provider: string): any;
+declare const _default: import("nuxt/server").EventHandler<Promise<any>>;
+export default _default;

package/dist/runtime/server/routes/auth/[provider].mjs

@@ -0,0 +1,95 @@
+import {
+  defineEventHandler,
+  getRouterParam,
+  sendRedirect,
+  createError,
+  useRuntimeConfig
+} from "nuxt/server";
+import { handleOAuthSuccess } from "../../utils/auth.mjs";
+const PROVIDER_NAME_MAP = {
+  apple: "defineOAuthAppleEventHandler",
+  atlassian: "defineOAuthAtlassianEventHandler",
+  auth0: "defineOAuthAuth0EventHandler",
+  authentik: "defineOAuthAuthentikEventHandler",
+  azureb2c: "defineOAuthAzureB2CEventHandler",
+  battledotnet: "defineOAuthBattleDotNetEventHandler",
+  box: "defineOAuthBoxEventHandler",
+  cloudflare: "defineOAuthCloudflareEventHandler",
+  cognito: "defineOAuthCognitoEventHandler",
+  discord: "defineOAuthDiscordEventHandler",
+  dropbox: "defineOAuthDropboxEventHandler",
+  facebook: "defineOAuthFacebookEventHandler",
+  gitea: "defineOAuthGiteaEventHandler",
+  github: "defineOAuthGitHubEventHandler",
+  gitlab: "defineOAuthGitLabEventHandler",
+  google: "defineOAuthGoogleEventHandler",
+  heroku: "defineOAuthHerokuEventHandler",
+  hubspot: "defineOAuthHubspotEventHandler",
+  instagram: "defineOAuthInstagramEventHandler",
+  keycloak: "defineOAuthKeycloakEventHandler",
+  kick: "defineOAuthKickEventHandler",
+  line: "defineOAuthLineEventHandler",
+  linear: "defineOAuthLinearEventHandler",
+  linkedin: "defineOAuthLinkedInEventHandler",
+  livechat: "defineOAuthLivechatEventHandler",
+  mastodon: "defineOAuthMastodonEventHandler",
+  microsoft: "defineOAuthMicrosoftEventHandler",
+  okta: "defineOAuthOktaEventHandler",
+  paypal: "defineOAuthPaypalEventHandler",
+  polar: "defineOAuthPolarEventHandler",
+  roblox: "defineOAuthRobloxEventHandler",
+  salesforce: "defineOAuthSalesforceEventHandler",
+  slack: "defineOAuthSlackEventHandler",
+  spotify: "defineOAuthSpotifyEventHandler",
+  steam: "defineOAuthSteamEventHandler",
+  strava: "defineOAuthStravaEventHandler",
+  tiktok: "defineOAuthTikTokEventHandler",
+  twitch: "defineOAuthTwitchEventHandler",
+  vk: "defineOAuthVKEventHandler",
+  wechat: "defineOAuthWechatEventHandler",
+  workos: "defineOAuthWorkOSEventHandler",
+  x: "defineOAuthXEventHandler",
+  yandex: "defineOAuthYandexEventHandler",
+  zitadel: "defineOAuthZitadelEventHandler"
+};
+export function getOAuthProviderFactory(provider) {
+  const normalized = provider.toLowerCase();
+  const handlerFnName = PROVIDER_NAME_MAP[normalized] || `defineOAuth${provider.charAt(0).toUpperCase() + provider.slice(1)}EventHandler`;
+  return globalThis[handlerFnName];
+}
+export default defineEventHandler(async (event) => {
+  const provider = getRouterParam(event, "provider");
+  if (!provider) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Missing OAuth provider parameter"
+    });
+  }
+  const factory = getOAuthProviderFactory(provider);
+  if (!factory || typeof factory !== "function") {
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Not Found",
+      message: `Unknown or unsupported auth provider: "${provider}"`
+    });
+  }
+  const handler = factory({
+    async onSuccess(event2, { user, tokens }) {
+      await handleOAuthSuccess({ event: event2, provider, user, tokens });
+      const runtimeConfig = useRuntimeConfig();
+      const successRedirect = runtimeConfig?.qarpeo?.auth?.redirect?.success || "/dashboard";
+      return sendRedirect(event2, successRedirect);
+    },
+    async onError(event2, error) {
+      console.error(`[qarpeo] OAuth error for ${provider}:`, error);
+      throw createError({
+        statusCode: 401,
+        statusMessage: "Unauthorized",
+        message: `Authentication failed with ${provider}`,
+        data: error
+      });
+    }
+  });
+  return handler(event);
+});

package/dist/runtime/server/routes/auth/account.delete.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    message: string;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/account.delete.mjs

@@ -0,0 +1,52 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getQarpeoConfig } from "../../utils/config.mjs";
+import { requireAuthSession, clearAuthSession } from "../../utils/session.mjs";
+import { deleteUserAccount } from "../../utils/auth.mjs";
+import { requireTurnstile } from "../../utils/turnstile.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const user = session?.user;
+  if (!user || !user.id) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  const authConfig = getQarpeoConfig(event).auth || {};
+  const deletionConfig = typeof authConfig.accountDeletion === "object" ? authConfig.accountDeletion : {};
+  if (deletionConfig.enabled === false) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Self-serve account deletion is disabled on this server."
+    });
+  }
+  const body = await readBody(event).catch(() => ({})) || {};
+  const turnstileProtect = typeof authConfig.turnstile === "object" ? authConfig.turnstile.protect?.accountDelete : false;
+  if (deletionConfig.requireTurnstile || turnstileProtect) {
+    await requireTurnstile(event, body.turnstileToken);
+  }
+  if (deletionConfig.requireConfirmationPhrase) {
+    const requiredPhrase = deletionConfig.confirmationPhrase || "DELETE";
+    if (body.phrase !== requiredPhrase) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: "Bad Request",
+        message: `Account deletion requires confirmation phrase: "${requiredPhrase}".`
+      });
+    }
+  }
+  try {
+    await deleteUserAccount(event, user.id, {
+      cascadeOrg: Boolean(body.cascadeOrg || deletionConfig.allowOrgCascade && body.confirm)
+    });
+  } catch (err) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: err.message
+    });
+  }
+  await clearAuthSession(event);
+  return {
+    success: true,
+    message: "Your account and all associated data have been permanently deleted."
+  };
+});

package/dist/runtime/server/routes/auth/impersonate/start.post.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    user: import("../../../..").QarpeoUser;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/impersonate/start.post.mjs

@@ -0,0 +1,14 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { startImpersonation } from "../../../utils/impersonation.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event) || {};
+  const targetUserId = body.userId || body.targetUserId;
+  if (!targetUserId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "userId is required"
+    });
+  }
+  return await startImpersonation(event, targetUserId);
+});

package/dist/runtime/server/routes/auth/impersonate/stop.post.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    user: import("../../../..").QarpeoUser;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/impersonate/stop.post.mjs

@@ -0,0 +1,5 @@
+import { defineEventHandler } from "nuxt/server";
+import { stopImpersonation } from "../../../utils/impersonation.mjs";
+export default defineEventHandler(async (event) => {
+  return await stopImpersonation(event);
+});

package/dist/runtime/server/routes/auth/logout-all.post.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<string | {
+    loggedIn: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/logout-all.post.mjs

@@ -0,0 +1,16 @@
+import { defineEventHandler, sendRedirect } from "nuxt/server";
+import { getQarpeoConfig } from "../../utils/config.mjs";
+import { revokeAllDeviceSessions, requireAuthSession, clearAuthSession } from "../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const userId = session.user?.id;
+  if (userId) {
+    await revokeAllDeviceSessions(event, userId);
+  }
+  await clearAuthSession(event);
+  const redirect = getQarpeoConfig(event).auth?.redirect?.logout;
+  if (redirect) {
+    return sendRedirect(event, redirect);
+  }
+  return { loggedIn: false };
+});

package/dist/runtime/server/routes/auth/logout-others.post.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    revokedOthers: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/logout-others.post.mjs

@@ -0,0 +1,11 @@
+import { defineEventHandler } from "nuxt/server";
+import { revokeOtherDeviceSessions, requireAuthSession } from "../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const userId = session.user?.id;
+  const currentSessionId = session?.sessionId;
+  if (userId) {
+    await revokeOtherDeviceSessions(event, userId, currentSessionId);
+  }
+  return { revokedOthers: true };
+});

package/dist/runtime/server/routes/auth/logout.post.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<string | {
+    loggedIn: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/logout.post.mjs

@@ -0,0 +1,17 @@
+import { defineEventHandler, sendRedirect } from "nuxt/server";
+import { getQarpeoConfig } from "../../utils/config.mjs";
+import { revokeDeviceSession, getAuthSession, clearAuthSession } from "../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await getAuthSession(event).catch(() => null);
+  const userId = session?.user?.id;
+  const sessionId = session?.sessionId;
+  if (userId && sessionId) {
+    await revokeDeviceSession(event, userId, sessionId);
+  }
+  await clearAuthSession(event);
+  const redirect = getQarpeoConfig(event).auth?.redirect?.logout;
+  if (redirect) {
+    return sendRedirect(event, redirect);
+  }
+  return { loggedIn: false };
+});

package/dist/runtime/server/routes/auth/magic-link/send.post.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    sent: boolean;
+    expiresAt: number;
+    error: string;
+} | {
+    sent: boolean;
+    expiresAt: number;
+    error?: undefined;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/magic-link/send.post.mjs

@@ -0,0 +1,29 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getQarpeoConfig } from "../../../utils/config.mjs";
+import { sendMagicLink } from "../../../utils/passwordless.mjs";
+import { requireTurnstile } from "../../../utils/turnstile.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const email = body?.email;
+  if (!email || typeof email !== "string" || !email.includes("@")) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "A valid email address is required"
+    });
+  }
+  const authConfig = getQarpeoConfig(event).auth || {};
+  const turnstileProtect = typeof authConfig.turnstile === "object" ? authConfig.turnstile.protect?.magicLink : false;
+  if (turnstileProtect) {
+    await requireTurnstile(event, body?.turnstileToken);
+  }
+  const result = await sendMagicLink(event, email);
+  if (!result.sent) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: result.error || "Failed to send magic link"
+    });
+  }
+  return result;
+});

package/dist/runtime/server/routes/auth/magic-link/verify.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<string>>;
+export default _default;

package/dist/runtime/server/routes/auth/magic-link/verify.get.mjs

@@ -0,0 +1,81 @@
+import { defineEventHandler, getQuery, sendRedirect } from "nuxt/server";
+import { getQarpeoConfig } from "../../../utils/config.mjs";
+import { getD1Binding } from "../../../../db.mjs";
+import { ensureAuthTables } from "../../../utils/auth.mjs";
+import { verifyMagicLinkToken } from "../../../utils/passwordless.mjs";
+import { createDeviceSession, setAuthSession } from "../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const token = query?.token;
+  const authConfig = getQarpeoConfig(event).auth;
+  const loginRedirect = authConfig.redirect?.login || "/login";
+  const successRedirect = authConfig.redirect?.success || "/dashboard";
+  if (!token || typeof token !== "string") {
+    return sendRedirect(event, `${loginRedirect}?error=invalid_magic_link`);
+  }
+  const result = await verifyMagicLinkToken(event, token);
+  if (!result.valid || !result.email) {
+    return sendRedirect(event, `${loginRedirect}?error=expired_magic_link`);
+  }
+  const cleanEmail = result.email.trim().toLowerCase();
+  const now = Date.now();
+  let dbUser = null;
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    const d1 = getD1Binding(bindingName, event);
+    await ensureAuthTables(d1);
+    dbUser = await d1.prepare("SELECT * FROM _qarpeo_users WHERE email = ? LIMIT 1").bind(cleanEmail).first();
+    if (!dbUser) {
+      const userId = crypto.randomUUID();
+      await d1.prepare(`
+          INSERT INTO _qarpeo_users (id, email, email_verified, name, avatar_url, role, created_at, updated_at)
+          VALUES (?, ?, 1, ?, NULL, 'user', ?, ?)
+        `).bind(userId, cleanEmail, cleanEmail.split("@")[0], now, now).run();
+      dbUser = {
+        id: userId,
+        email: cleanEmail,
+        email_verified: 1,
+        name: cleanEmail.split("@")[0],
+        role: "user"
+      };
+    } else if (!dbUser.email_verified) {
+      await d1.prepare("UPDATE _qarpeo_users SET email_verified = 1, updated_at = ? WHERE id = ?").bind(now, dbUser.id).run();
+    }
+  } catch {
+  }
+  const finalUser = dbUser ? {
+    id: dbUser.id,
+    email: dbUser.email,
+    name: dbUser.name,
+    avatarUrl: dbUser.avatar_url,
+    emailVerified: true,
+    role: dbUser.role || "user"
+  } : {
+    id: crypto.randomUUID(),
+    email: cleanEmail,
+    name: cleanEmail.split("@")[0],
+    emailVerified: true,
+    role: "user"
+  };
+  const sessionConfig = authConfig.session || {};
+  let sessionId;
+  try {
+    const deviceSession = await createDeviceSession(event, finalUser, {
+      provider: "magic-link",
+      maxAge: sessionConfig.maxAge || 604800,
+      maxSessionsPerUser: sessionConfig.maxSessionsPerUser ?? 5,
+      backend: sessionConfig.backend || "cookie"
+    });
+    sessionId = deviceSession.sessionId;
+  } catch {
+  }
+  const sessionData = {
+    user: finalUser,
+    provider: "magic-link",
+    sessionId,
+    loggedInAt: now,
+    tenantId: event?.context?.tenant?.id ?? void 0
+  };
+  await setAuthSession(event, sessionData);
+  return sendRedirect(event, successRedirect);
+});