{"version":3,"file":"public-url-CtaYiikU.mjs","names":[],"sources":["../src/api/public-url.ts"],"sourcesContent":["/**\n * Public URL helpers for reverse-proxy deployments.\n *\n * Behind a TLS-terminating proxy the internal request URL\n * (`http://localhost:4321`) differs from the browser-facing origin\n * (`https://mysite.example.com`). These pure helpers resolve the\n * correct public origin from config, falling back to the request URL.\n *\n * Workers-safe: no Node.js imports.\n */\n\n/** Minimal config shape — avoids importing the full EmDashConfig type tree. */\nexport interface SiteUrlConfig {\n\tsiteUrl?: string;\n}\n\n/**\n * Resolve siteUrl from runtime environment variables.\n *\n * Uses process.env (not import.meta.env) because Vite statically replaces\n * import.meta.env at build time, baking out any env vars not present during\n * the build. Container deployments set env vars at runtime, so we must read\n * process.env which Vite leaves untouched.\n *\n * On Cloudflare Workers process.env is empty by default, so the fallback\n * chain continues to url.origin — unless the Worker enables the\n * `nodejs_compat_populate_process_env` compatibility flag, in which case\n * `vars`/secrets (e.g. EMDASH_SITE_URL) are readable here too.\n *\n * Caches after first call.\n */\nlet _envSiteUrl: string | undefined | null = null;\n\n/** @internal Reset cached env values — test-only. */\nexport function _resetEnvCache(): void {\n\t_envSiteUrl = null;\n\t_envAllowedOrigins = null;\n}\n\nfunction getEnvSiteUrl(): string | undefined {\n\tif (_envSiteUrl !== null) return _envSiteUrl || undefined;\n\ttry {\n\t\t// process.env is available on Node.js; undefined on Workers\n\t\tconst value =\n\t\t\t(typeof process !== \"undefined\" && process.env?.EMDASH_SITE_URL) ||\n\t\t\t(typeof process !== \"undefined\" && process.env?.SITE_URL) ||\n\t\t\t\"\";\n\t\tif (value) {\n\t\t\tconst parsed = new URL(value);\n\t\t\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\t\t\t_envSiteUrl = \"\";\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t_envSiteUrl = parsed.origin;\n\t\t} else {\n\t\t\t_envSiteUrl = \"\";\n\t\t}\n\t} catch {\n\t\t_envSiteUrl = \"\";\n\t}\n\treturn _envSiteUrl || undefined;\n}\n\n/**\n * Return the public-facing origin for the site.\n *\n * Resolution order:\n *   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)\n *   2. `EMDASH_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)\n *   3. `url.origin` (internal request URL — correct when no proxy)\n *\n * @param url  The request URL (`new URL(request.url)` or `Astro.url`)\n * @param config  The EmDash config (from `locals.emdash?.config`)\n * @returns Origin string, e.g. `\"https://mysite.example.com\"`\n */\nexport function getPublicOrigin(url: URL, config?: SiteUrlConfig): string {\n\treturn getConfiguredOrigin(config) || url.origin;\n}\n\n/**\n * Return the operator-configured public origin, if any.\n *\n * The first two steps of {@link getPublicOrigin}'s resolution —\n * `config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars — without\n * the request-URL fallback. For callers that have a more trustworthy fallback\n * than the request (e.g. the stored setup origin used for outbound emails).\n */\nexport function getConfiguredOrigin(config?: SiteUrlConfig): string | undefined {\n\treturn config?.siteUrl || getEnvSiteUrl() || undefined;\n}\n\n/**\n * Resolve additional accepted passkey origins from runtime environment.\n *\n * Reads `EMDASH_ALLOWED_ORIGINS` (comma-separated list of origins) for\n * multi-origin deployments where the same RP is reachable under several\n * hostnames sharing the registrable parent domain (e.g. apex + preview).\n *\n * Each entry is parsed via `new URL()` and reduced to its `origin`. Unlike\n * `getEnvSiteUrl` (which silently falls back to `url.origin` on bad input),\n * this throws on any unparseable or non-http(s) entry — `EMDASH_ALLOWED_ORIGINS`\n * is an allowlist for passkey verification, so silently dropping a typo would\n * surface as \"I can't authenticate on this origin\" with no diagnostic. Fail\n * loud at first read.\n *\n * Uses `process.env` (Vite leaves it untouched at runtime). Result is cached\n * on success.\n */\nlet _envAllowedOrigins: string[] | null = null;\n\nexport function getEnvAllowedOrigins(): string[] {\n\tif (_envAllowedOrigins !== null) return _envAllowedOrigins;\n\tconst raw = typeof process !== \"undefined\" ? process.env?.EMDASH_ALLOWED_ORIGINS || \"\" : \"\";\n\tconst parsed: string[] = [];\n\tfor (const entry of raw.split(\",\")) {\n\t\tconst trimmed = entry.trim();\n\t\tif (!trimmed) continue;\n\t\tlet u: URL;\n\t\ttry {\n\t\t\tu = new URL(trimmed);\n\t\t} catch (e) {\n\t\t\tthrow new Error(`EmDash config error in EMDASH_ALLOWED_ORIGINS: invalid URL: \"${trimmed}\"`, {\n\t\t\t\tcause: e,\n\t\t\t});\n\t\t}\n\t\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") {\n\t\t\tthrow new Error(\n\t\t\t\t`EmDash config error in EMDASH_ALLOWED_ORIGINS: origin must be http or https: \"${trimmed}\" (got ${u.protocol})`,\n\t\t\t);\n\t\t}\n\t\tparsed.push(u.origin);\n\t}\n\t_envAllowedOrigins = parsed;\n\treturn parsed;\n}\n\n/**\n * Build a full public URL by appending a path to the public origin.\n *\n * @param url  The request URL\n * @param config  The EmDash config\n * @param path  Path to append (must start with `/`)\n * @returns Full URL string, e.g. `\"https://mysite.example.com/_emdash/admin/login\"`\n */\nexport function getPublicUrl(url: URL, config: SiteUrlConfig | undefined, path: string): string {\n\treturn `${getPublicOrigin(url, config)}${path}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,IAAI,cAAyC;AAQ7C,SAAS,gBAAoC;AAC5C,KAAI,gBAAgB,KAAM,QAAO,eAAe;AAChD,KAAI;EAEH,MAAM,QACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,mBAC/C,OAAO,YAAY,eAAe,QAAQ,KAAK,YAChD;AACD,MAAI,OAAO;GACV,MAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,OAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAChE,kBAAc;AACd;;AAED,iBAAc,OAAO;QAErB,eAAc;SAER;AACP,gBAAc;;AAEf,QAAO,eAAe;;;;;;;;;;;;;;AAevB,SAAgB,gBAAgB,KAAU,QAAgC;AACzE,QAAO,oBAAoB,OAAO,IAAI,IAAI;;;;;;;;;;AAW3C,SAAgB,oBAAoB,QAA4C;AAC/E,QAAO,QAAQ,WAAW,eAAe,IAAI;;;;;;;;;;;;;;;;;;;AAoB9C,IAAI,qBAAsC;AAE1C,SAAgB,uBAAiC;AAChD,KAAI,uBAAuB,KAAM,QAAO;CACxC,MAAM,MAAM,OAAO,YAAY,cAAc,QAAQ,KAAK,0BAA0B,KAAK;CACzF,MAAM,SAAmB,EAAE;AAC3B,MAAK,MAAM,SAAS,IAAI,MAAM,IAAI,EAAE;EACnC,MAAM,UAAU,MAAM,MAAM;AAC5B,MAAI,CAAC,QAAS;EACd,IAAI;AACJ,MAAI;AACH,OAAI,IAAI,IAAI,QAAQ;WACZ,GAAG;AACX,SAAM,IAAI,MAAM,gEAAgE,QAAQ,IAAI,EAC3F,OAAO,GACP,CAAC;;AAEH,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAC5C,OAAM,IAAI,MACT,iFAAiF,QAAQ,SAAS,EAAE,SAAS,GAC7G;AAEF,SAAO,KAAK,EAAE,OAAO;;AAEtB,sBAAqB;AACrB,QAAO"}