import { d as getRequestId, e as errorResponse, f as getUiLoginPassword, s as safeTokenCompare, b as createSession } from './helpers-kzwksNq1.js';
import { s as sessionCookieHeader } from './session-cookie-CHgIES2p.js';
import './src-CidJbygh.js';
import './chunk-CLZ62Ad-.js';
import 'node:module';
import './provider-constants-DPrj3yBX.js';
import './dist-DOFcG0Zp.js';
import 'node:fs';
import 'node:path';
import 'buffer';
import 'fs';
import 'path';
import 'node:child_process';
import 'node:url';
import 'node:crypto';
import 'events';
import 'node:events';
import 'node:stream';
import 'node:string_decoder';
import 'assert';
import 'zlib';
import 'node:assert';
import 'node:fs/promises';
import 'node:os';
import './endpoints-UdQGgKsR.js';
import './state-fxN45gBp.js';

//#region src/routes/admin/auth/session/+server.ts
/**
* POST /admin/auth/session
*
* Issues an `op_session` cookie after verifying the operator-supplied password
* against `process.env.OP_UI_LOGIN_PASSWORD`.
*
* The cookie value is a random UUID session token — NOT the plaintext password.
* Kept alongside `/admin/auth/login` as an alias; both verify the same
* `password` body field and issue the `op_session` cookie.
*/
var POST = async (event) => {
	const requestId = getRequestId(event);
	let body;
	try {
		body = await event.request.json();
	} catch {
		return errorResponse(400, "bad_request", "Invalid JSON body", {}, requestId);
	}
	const password = typeof body.password === "string" ? body.password : "";
	if (!password) return errorResponse(400, "bad_request", "password is required", {}, requestId);
	const configured = getUiLoginPassword();
	if (!configured) return errorResponse(503, "admin_not_configured", "OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.", {}, requestId);
	if (!safeTokenCompare(password, configured)) return errorResponse(401, "unauthorized", "Invalid password", {}, requestId);
	const sessionToken = createSession();
	return new Response(JSON.stringify({ ok: true }), {
		status: 200,
		headers: {
			"content-type": "application/json",
			"set-cookie": sessionCookieHeader(sessionToken, event.request),
			"x-request-id": requestId
		}
	});
};

export { POST };
//# sourceMappingURL=_server.ts-C4OpgCAn.js.map
