{"version":3,"file":"allowed-origins-PB5EndN-.mjs","names":[],"sources":["../src/auth/allowed-origins.ts"],"sourcesContent":["/**\n * Resolution and validation of multi-origin passkey verification.\n *\n * `allowedOrigins` lets one EmDash deployment accept passkey assertions from\n * several hostnames sharing the same `rpId` (e.g. apex + preview/staging\n * subdomains under one registrable parent). Origins come from two sources:\n *\n *   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)\n *   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)\n *\n * Sources are merged (union of permissions, deduplicated). Each entry is\n * validated against `siteUrl` to fail loud on dead config the browser would\n * never honor.\n */\n\nimport { getEnvAllowedOrigins } from \"../api/public-url.js\";\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\nexport type AllowedOriginSource = \"config.allowedOrigins\" | \"EMDASH_ALLOWED_ORIGINS\";\n\nexport interface TaggedOrigin {\n\t/** Raw entry as declared by the operator. */\n\torigin: string;\n\t/** Where the entry came from (used for source-attributed errors). */\n\tsource: AllowedOriginSource;\n}\n\n/**\n * Collect raw allowedOrigins from config and env, source-tagged.\n *\n * Returns raw values — the caller is expected to pass the result through\n * `validateAllowedOrigins()` before use in passkey verification.\n */\nexport function getConfiguredAllowedOrigins(config?: EmDashConfig): TaggedOrigin[] {\n\tconst tagged: TaggedOrigin[] = [];\n\tif (config?.allowedOrigins) {\n\t\tfor (const origin of config.allowedOrigins) {\n\t\t\tif (origin) tagged.push({ origin, source: \"config.allowedOrigins\" });\n\t\t}\n\t}\n\tfor (const origin of getEnvAllowedOrigins()) {\n\t\ttagged.push({ origin, source: \"EMDASH_ALLOWED_ORIGINS\" });\n\t}\n\treturn tagged;\n}\n\n/**\n * Validate per-entry shape rules (no `siteUrl` needed):\n *   - parses as `URL`\n *   - protocol is `http:` or `https:`\n *   - hostname has no trailing dot (`example.com.` rejected)\n *   - hostname has no empty labels (`foo..example.com` rejected)\n *\n * Returns the deduplicated, normalized origin form (`URL.origin`) of every\n * input, in input order. Throws on the first violation with a source-tagged\n * error message.\n */\nexport function validateOriginShape(tagged: TaggedOrigin[]): string[] {\n\tconst normalized: string[] = [];\n\tconst seen = new Set<string>();\n\tfor (const { origin, source } of tagged) {\n\t\tlet parsed: URL;\n\t\ttry {\n\t\t\tparsed = new URL(origin);\n\t\t} catch (e) {\n\t\t\tthrow configError(source, `invalid URL: \"${origin}\"`, e);\n\t\t}\n\t\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`origin must be http or https: \"${origin}\" (got ${parsed.protocol})`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.endsWith(\".\")) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`hostname has a trailing dot: \"${origin}\". Remove the trailing dot — assertion origins from the browser do not include it.`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.split(\".\").includes(\"\")) {\n\t\t\tthrow configError(source, `hostname has empty labels: \"${origin}\"`);\n\t\t}\n\t\tif (!seen.has(parsed.origin)) {\n\t\t\tseen.add(parsed.origin);\n\t\t\tnormalized.push(parsed.origin);\n\t\t}\n\t}\n\treturn normalized;\n}\n\n/**\n * Validate the effective merged allowedOrigins set against `siteUrl`.\n *\n * Performs `validateOriginShape()` plus the siteUrl-dependent rules:\n *   - Rule A: non-empty origins ⇒ `siteUrl` is set\n *   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)\n *   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)\n *   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain\n *\n * Throws on first violation. Returns the deduplicated normalized origins.\n *\n * Use this at the runtime chokepoint (where config + env are merged into the\n * effective set). At Astro integration init, prefer `validateOriginShape()`\n * for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be\n * supplied at runtime via `EMDASH_SITE_URL`.\n */\nexport function validateAllowedOrigins(\n\tsiteUrl: string | undefined,\n\ttagged: TaggedOrigin[],\n): string[] {\n\tconst normalized = validateOriginShape(tagged);\n\tif (normalized.length === 0) return normalized;\n\n\tif (!siteUrl) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: allowedOrigins is set (${normalized.length} ${\n\t\t\t\tnormalized.length === 1 ? \"entry\" : \"entries\"\n\t\t\t}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`,\n\t\t);\n\t}\n\n\tlet siteHost: string;\n\ttry {\n\t\tsiteHost = new URL(siteUrl).hostname;\n\t} catch (e) {\n\t\tthrow new Error(`EmDash config error: siteUrl is not a valid URL: \"${siteUrl}\"`, {\n\t\t\tcause: e,\n\t\t});\n\t}\n\n\tif (siteHost.endsWith(\".\")) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`,\n\t\t);\n\t}\n\tif (isIPLiteralHostname(siteHost)) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`,\n\t\t);\n\t}\n\n\tfor (const { origin, source } of tagged) {\n\t\tconst h = new URL(origin).hostname;\n\t\tif (h !== siteHost && !h.endsWith(\".\" + siteHost)) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`\"${origin}\" is not a subdomain of siteUrl \"${siteUrl}\". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`,\n\t\t\t);\n\t\t}\n\t}\n\n\treturn normalized;\n}\n\nfunction configError(source: AllowedOriginSource, detail: string, cause?: unknown): Error {\n\tconst err = new Error(`EmDash config error in ${source}: ${detail}`);\n\tif (cause !== undefined) (err as Error & { cause?: unknown }).cause = cause;\n\treturn err;\n}\n\nconst IPV4_DOTTED_DECIMAL_RE = /^\\d+(\\.\\d+){3}$/;\n\nfunction isIPLiteralHostname(h: string): boolean {\n\t// IPv6 hostnames are bracketed by URL.hostname, e.g. \"[::1]\"\n\tif (h.startsWith(\"[\")) return true;\n\t// IPv4 dotted-decimal\n\treturn IPV4_DOTTED_DECIMAL_RE.test(h);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,4BAA4B,QAAuC;CAClF,MAAM,SAAyB,EAAE;AACjC,KAAI,QAAQ,gBACX;OAAK,MAAM,UAAU,OAAO,eAC3B,KAAI,OAAQ,QAAO,KAAK;GAAE;GAAQ,QAAQ;GAAyB,CAAC;;AAGtE,MAAK,MAAM,UAAU,sBAAsB,CAC1C,QAAO,KAAK;EAAE;EAAQ,QAAQ;EAA0B,CAAC;AAE1D,QAAO;;;;;;;;;;;;;AAcR,SAAgB,oBAAoB,QAAkC;CACrE,MAAM,aAAuB,EAAE;CAC/B,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,IAAI;AACJ,MAAI;AACH,YAAS,IAAI,IAAI,OAAO;WAChB,GAAG;AACX,SAAM,YAAY,QAAQ,iBAAiB,OAAO,IAAI,EAAE;;AAEzD,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,YACL,QACA,kCAAkC,OAAO,SAAS,OAAO,SAAS,GAClE;AAEF,MAAI,OAAO,SAAS,SAAS,IAAI,CAChC,OAAM,YACL,QACA,iCAAiC,OAAO,oFACxC;AAEF,MAAI,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,CAC1C,OAAM,YAAY,QAAQ,+BAA+B,OAAO,GAAG;AAEpE,MAAI,CAAC,KAAK,IAAI,OAAO,OAAO,EAAE;AAC7B,QAAK,IAAI,OAAO,OAAO;AACvB,cAAW,KAAK,OAAO,OAAO;;;AAGhC,QAAO;;;;;;;;;;;;;;;;;;AAmBR,SAAgB,uBACf,SACA,QACW;CACX,MAAM,aAAa,oBAAoB,OAAO;AAC9C,KAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,KAAI,CAAC,QACJ,OAAM,IAAI,MACT,+CAA+C,WAAW,OAAO,GAChE,WAAW,WAAW,IAAI,UAAU,UACpC,wLACD;CAGF,IAAI;AACJ,KAAI;AACH,aAAW,IAAI,IAAI,QAAQ,CAAC;UACpB,GAAG;AACX,QAAM,IAAI,MAAM,qDAAqD,QAAQ,IAAI,EAChF,OAAO,GACP,CAAC;;AAGH,KAAI,SAAS,SAAS,IAAI,CACzB,OAAM,IAAI,MACT,iCAAiC,QAAQ,yHACzC;AAEF,KAAI,oBAAoB,SAAS,CAChC,OAAM,IAAI,MACT,iCAAiC,QAAQ,oJACzC;AAGF,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC;AAC1B,MAAI,MAAM,YAAY,CAAC,EAAE,SAAS,MAAM,SAAS,CAChD,OAAM,YACL,QACA,IAAI,OAAO,mCAAmC,QAAQ,+EACtD;;AAIH,QAAO;;AAGR,SAAS,YAAY,QAA6B,QAAgB,OAAwB;CACzF,MAAM,sBAAM,IAAI,MAAM,0BAA0B,OAAO,IAAI,SAAS;AACpE,KAAI,UAAU,OAAW,CAAC,IAAoC,QAAQ;AACtE,QAAO;;AAGR,MAAM,yBAAyB;AAE/B,SAAS,oBAAoB,GAAoB;AAEhD,KAAI,EAAE,WAAW,IAAI,CAAE,QAAO;AAE9B,QAAO,uBAAuB,KAAK,EAAE"}