{"version":3,"file":"send.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/auth/magic-link/send.ts"],"sourcesContent":["/**\n * POST /_emdash/api/auth/magic-link/send\n *\n * Send a magic link email for passwordless authentication.\n * Always returns success to avoid revealing whether email exists.\n *\n * Rate limited: 3 requests per 5 minutes per IP.\n */\n\nimport type { APIRoute } from \"astro\";\n\nexport const prerender = false;\n\nimport { sendMagicLink, type MagicLinkConfig } from \"@premium-cms/auth\";\nimport { createKyselyAdapter } from \"@premium-cms/auth/adapters/kysely\";\n\nimport { apiError, apiSuccess } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { magicLinkSendBody } from \"#api/schemas.js\";\nimport { getSiteBaseUrl } from \"#api/site-url.js\";\nimport { checkRateLimit, getClientIp } from \"#auth/rate-limit.js\";\nimport { getTrustedProxyHeaders } from \"#auth/trusted-proxy.js\";\nimport { OptionsRepository } from \"#db/repositories/options.js\";\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\ttry {\n\t\t// Parse request body first — avoids consuming rate limit slots on\n\t\t// malformed requests and normalizes timing between rate-limited\n\t\t// and real paths (parse cost evens out the response time).\n\t\tconst body = await parseBody(request, magicLinkSendBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Rate limit: 3 requests per 300 seconds (5 minutes) per IP\n\t\tconst ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));\n\t\tconst rateLimit = await checkRateLimit(emdash.db, ip, \"magic-link/send\", 3, 300);\n\t\tif (!rateLimit.allowed) {\n\t\t\t// Return success-shaped response to avoid revealing rate limit\n\t\t\t// (which could leak information about email enumeration attempts)\n\t\t\treturn apiSuccess({\n\t\t\t\tsuccess: true,\n\t\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t\t});\n\t\t}\n\n\t\t// Check if email pipeline is available\n\t\tif (!emdash.email?.isAvailable()) {\n\t\t\treturn apiError(\n\t\t\t\t\"EMAIL_NOT_CONFIGURED\",\n\t\t\t\t\"Email is not configured. Magic link authentication requires an email provider.\",\n\t\t\t\t503,\n\t\t\t);\n\t\t}\n\n\t\t// Build magic link config using the configured site URL, stored option as fallback (not request Host header)\n\t\tconst options = new OptionsRepository(emdash.db);\n\t\tconst baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);\n\t\tconst siteName = (await options.get<string>(\"emdash:site_title\")) ?? \"EmDash\";\n\n\t\tconst config: MagicLinkConfig = {\n\t\t\tbaseUrl,\n\t\t\tsiteName,\n\t\t\temail: (message) => emdash.email!.send(message, \"system\"),\n\t\t};\n\n\t\t// Send magic link (silently fails if user doesn't exist)\n\t\tconst adapter = createKyselyAdapter(emdash.db);\n\t\tawait sendMagicLink(config, adapter, body.email.toLowerCase());\n\n\t\t// Always return success to avoid revealing if email exists\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t} catch (error) {\n\t\tconsole.error(\"Magic link send error:\", error);\n\n\t\t// Still return success to avoid revealing information\n\t\t// Log the error but don't expose it to the client\n\t\treturn apiSuccess({\n\t\t\tsuccess: true,\n\t\t\tmessage: \"If an account exists for this email, a magic link has been sent.\",\n\t\t});\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAazB,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,WAAW;AAEnB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;AAGpE,KAAI;EAIH,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAG/B,MAAM,KAAK,YAAY,SAAS,uBAAuB,OAAO,OAAO,CAAC;AAEtE,MAAI,EADc,MAAM,eAAe,OAAO,IAAI,IAAI,mBAAmB,GAAG,IAAI,EACjE,QAGd,QAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;AAIH,MAAI,CAAC,OAAO,OAAO,aAAa,CAC/B,QAAO,SACN,wBACA,kFACA,IACA;EAIF,MAAM,UAAU,IAAI,kBAAkB,OAAO,GAAG;AAYhD,QAAM,cAR0B;GAC/B,SAJe,MAAM,eAAe,OAAO,IAAI,SAAS,OAAO,OAAO;GAKtE,UAJiB,MAAM,QAAQ,IAAY,oBAAoB,IAAK;GAKpE,QAAQ,YAAY,OAAO,MAAO,KAAK,SAAS,SAAS;GACzD,EAGe,oBAAoB,OAAO,GAAG,EACT,KAAK,MAAM,aAAa,CAAC;AAG9D,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC;UACM,OAAO;AACf,UAAQ,MAAM,0BAA0B,MAAM;AAI9C,SAAO,WAAW;GACjB,SAAS;GACT,SAAS;GACT,CAAC"}