import "../../../../base64-CmWvODNW.mjs";
import "../../../../types-CuW0zWDA.mjs";
import { t as OptionsRepository } from "../../../../options-DTTML-Tx.mjs";
import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CkAseSqZ.mjs";
import { n as parseBody, t as isParseError } from "../../../../parse-GmjecGct.mjs";
import "../../../../redirects-DXEXBAII.mjs";
import { l as setupAdminVerifyBody } from "../../../../byline-fields-2Lp5Hbgf.mjs";
import "../../../../status-CqJQX1QN.mjs";
import "../../../../api/schemas/index.mjs";
import { n as getPublicOrigin } from "../../../../public-url-Danv47cS.mjs";
import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../allowed-origins-CRsJ6BPM.mjs";
import { n as createChallengeStore } from "../../../../challenge-store-anhwVER0.mjs";
import { t as getPasskeyConfig } from "../../../../passkey-config-De0ahnRg.mjs";
import { t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-Z8x0tHf8.mjs";
import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
import { Role, secureCompare } from "@emdash-cms/auth";
import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

//#region src/astro/routes/api/setup/admin-verify.ts
const prerender = false;
const POST = async ({ cookies, request, locals }) => {
	const { emdash } = locals;
	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
	try {
		const options = new OptionsRepository(emdash.db);
		const setupComplete = await options.get("emdash:setup_complete");
		if (setupComplete === true || setupComplete === "true") return apiError("SETUP_COMPLETE", "Setup already complete", 400);
		const adapter = createKyselyAdapter(emdash.db);
		if (await adapter.countUsers() > 0) return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
		const setupState = await options.get("emdash:setup_state");
		if (!setupState || setupState.step !== "admin") return apiError("INVALID_STATE", "Invalid setup state. Please restart setup.", 400);
		const cookieNonce = cookies.get(SETUP_NONCE_COOKIE)?.value;
		if (!setupState.nonce || !cookieNonce || !secureCompare(cookieNonce, setupState.nonce)) return apiError("INVALID_STATE", "Setup session expired or tampered with. Please restart the admin step.", 400);
		if (!setupState.email) return apiError("INVALID_STATE", "Invalid setup state. Please restart setup.", 400);
		const body = await parseBody(request, setupAdminVerifyBody);
		if (isParseError(body)) return body;
		const url = new URL(request.url);
		const siteName = await options.get("emdash:site_title") ?? void 0;
		const siteUrl = getPublicOrigin(url, emdash?.config);
		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, validateAllowedOrigins(siteUrl, getConfiguredAllowedOrigins(emdash?.config)));
		const challengeStore = createChallengeStore(emdash.db);
		const verified = await verifyRegistrationResponse(passkeyConfig, body.credential, challengeStore);
		const user = await adapter.createUser({
			email: setupState.email,
			name: setupState.name ?? null,
			role: Role.ADMIN,
			emailVerified: false
		});
		await registerPasskey(adapter, user.id, verified, "Setup passkey");
		await options.set("emdash:setup_complete", true);
		await options.delete("emdash:setup_state");
		cookies.delete(SETUP_NONCE_COOKIE, { path: "/_emdash/" });
		return apiSuccess({
			success: true,
			user: {
				id: user.id,
				email: user.email,
				name: user.name,
				role: user.role
			}
		});
	} catch (error) {
		return handleError(error, "Failed to verify admin setup", "SETUP_VERIFY_ERROR");
	}
};

//#endregion
export { POST, prerender };
//# sourceMappingURL=admin-verify.mjs.map