import { s as shareStore, v as verifyPassword } from './share-store-B9jMpVg0.js';
import { j as json } from './index-CoD1IJuy.js';
import 'better-sqlite3';
import 'crypto';
import 'fs';
import 'path';

const RATE_LIMIT_WINDOW_MS = 6e4;
const RATE_LIMIT_MAX = 10;
const attempts = /* @__PURE__ */ new Map();
function checkRateLimit(key) {
  const now = Date.now();
  const recent = (attempts.get(key) ?? []).filter((t) => t > now - RATE_LIMIT_WINDOW_MS);
  attempts.set(key, recent);
  if (recent.length >= RATE_LIMIT_MAX) {
    return false;
  }
  recent.push(now);
  return true;
}
setInterval(() => {
  const cutoff = Date.now() - RATE_LIMIT_WINDOW_MS;
  for (const [key, timestamps] of attempts) {
    const recent = timestamps.filter((t) => t > cutoff);
    if (recent.length === 0) {
      attempts.delete(key);
    } else {
      attempts.set(key, recent);
    }
  }
}, 3e5).unref();
const POST = async (event) => {
  const { params, request } = event;
  const share = shareStore.getShare(params.id);
  if (!share) {
    return json({ error: "Not shared" }, { status: 404 });
  }
  let ip = "unknown";
  const cfIp = request.headers.get("cf-connecting-ip");
  const fwd = request.headers.get("x-forwarded-for");
  if (cfIp) {
    ip = cfIp;
  } else if (fwd) {
    ip = fwd.split(",")[0].trim();
  } else {
    try {
      ip = event.getClientAddress();
    } catch {
    }
  }
  if (!checkRateLimit(`${ip}:${params.id}`)) {
    return json({ error: "Too many attempts. Try again in a minute." }, { status: 429 });
  }
  let body;
  try {
    body = await request.json();
  } catch {
    return json({ error: "Invalid JSON" }, { status: 400 });
  }
  if (typeof body.password !== "string" || !verifyPassword(body.password, share.passwordHash)) {
    return json({ error: "Invalid password" }, { status: 401 });
  }
  const { expiresAt, token } = shareStore.createSession(params.id);
  return json({ expiresAt, mode: share.mode, token });
};

export { POST };
//# sourceMappingURL=_server.ts-DpRr0Tfh.js.map
