import "../../../../../../base64-CmWvODNW.mjs";
import "../../../../../../types-CuW0zWDA.mjs";
import { t as OptionsRepository } from "../../../../../../options-DTTML-Tx.mjs";
import { n as apiSuccess, t as apiError } from "../../../../../../error-CkAseSqZ.mjs";
import { n as parseBody, t as isParseError } from "../../../../../../parse-GmjecGct.mjs";
import "../../../../../../redirects-DXEXBAII.mjs";
import { T as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-2Lp5Hbgf.mjs";
import "../../../../../../status-CqJQX1QN.mjs";
import "../../../../../../api/schemas/index.mjs";
import { n as getPublicOrigin } from "../../../../../../public-url-Danv47cS.mjs";
import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-CRsJ6BPM.mjs";
import { n as createChallengeStore } from "../../../../../../challenge-store-anhwVER0.mjs";
import { t as getPasskeyConfig } from "../../../../../../passkey-config-De0ahnRg.mjs";
import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

//#region src/astro/routes/api/auth/passkey/register/verify.ts
const prerender = false;
const MAX_PASSKEYS = 10;
const POST = async ({ request, locals }) => {
	const { emdash, user } = locals;
	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
	if (!user) return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
	try {
		const adapter = createKyselyAdapter(emdash.db);
		if (await adapter.countCredentialsByUserId(user.id) >= MAX_PASSKEYS) return apiError("PASSKEY_LIMIT", `Maximum of ${MAX_PASSKEYS} passkeys allowed`, 400);
		const body = await parseBody(request, passkeyRegisterVerifyBody);
		if (isParseError(body)) return body;
		const url = new URL(request.url);
		const optionsRepo = new OptionsRepository(emdash.db);
		const siteName = await optionsRepo.get("emdash:site_title") ?? void 0;
		const siteUrl = getPublicOrigin(url, emdash?.config);
		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, validateAllowedOrigins(siteUrl, getConfiguredAllowedOrigins(emdash?.config)));
		const challengeStore = createChallengeStore(emdash.db);
		const verified = await verifyRegistrationResponse(passkeyConfig, body.credential, challengeStore);
		let passKeyName = body.name ?? void 0;
		if (!passKeyName) {
			const pending = await optionsRepo.get(`emdash:passkey_pending:${user.id}`);
			if (pending?.name) passKeyName = pending.name;
		}
		await optionsRepo.delete(`emdash:passkey_pending:${user.id}`);
		const credential = await registerPasskey(adapter, user.id, verified, passKeyName);
		return apiSuccess({ passkey: {
			id: credential.id,
			name: credential.name,
			deviceType: credential.deviceType,
			backedUp: credential.backedUp,
			createdAt: credential.createdAt.toISOString(),
			lastUsedAt: credential.lastUsedAt.toISOString()
		} });
	} catch (error) {
		console.error("Passkey registration verify error:", error);
		const message = error instanceof Error ? error.message : "";
		if (message.includes("credential_exists") || message.includes("already")) return apiError("CREDENTIAL_EXISTS", "This passkey is already registered", 400);
		if (message.includes("challenge") || message.includes("expired")) return apiError("CHALLENGE_EXPIRED", "Registration expired. Please try again.", 400);
		return apiError("PASSKEY_REGISTER_ERROR", "Registration failed", 500);
	}
};

//#endregion
export { POST, prerender };
//# sourceMappingURL=verify.mjs.map