globalThis.process ??= {};
globalThis.process.env ??= {};
import { r as __exportAll } from "./rolldown-runtime_-UtK6b3T.mjs";
import { W as ContentValidationError, d as mapContentError, u as jsonOk } from "./crypto_CY2zBtG3.mjs";
import { r as buildAuthEngine } from "./admin-engine_Cqzo5vQB.mjs";
import { c as assertCsrf, i as requireAdmin } from "./auth_B0DWM0G6.mjs";
import { env } from "cloudflare:workers";
//#region src/pages/api/admin/users.ts
var users_exports = /* @__PURE__ */ __exportAll({
	GET: () => GET,
	POST: () => POST,
	prerender: () => false
});
var ROLE_OPTIONS = [
	"viewer",
	"editor",
	"admin"
];
function parseRoles(raw) {
	if (!Array.isArray(raw) || raw.length === 0) throw new ContentValidationError("roles", "must be a non-empty array");
	for (const role of raw) if (typeof role !== "string" || !ROLE_OPTIONS.includes(role)) throw new ContentValidationError("roles", "invalid role value");
	return raw;
}
var GET = async ({ request, cookies, url }) => {
	try {
		await requireAdmin(request, env, cookies);
		const engine = buildAuthEngine(env);
		const limitRaw = url.searchParams.get("limit");
		const offsetRaw = url.searchParams.get("offset");
		const limit = limitRaw ? Number(limitRaw) : void 0;
		const offset = offsetRaw ? Number(offsetRaw) : void 0;
		const result = await engine.listUsers({
			...Number.isFinite(limit) ? { limit } : {},
			...Number.isFinite(offset) ? { offset } : {}
		});
		return jsonOk(result);
	} catch (error) {
		return mapContentError(error);
	}
};
var POST = async ({ request, cookies }) => {
	try {
		const { authMode } = await requireAdmin(request, env, cookies);
		assertCsrf(request, {
			authMode,
			siteOrigin: env.SITE_ORIGIN
		});
		const data = await request.json();
		if (typeof data !== "object" || data === null) throw new ContentValidationError("input", "must be an object");
		const raw = data;
		if (typeof raw.email !== "string" || !raw.email.trim()) throw new ContentValidationError("email", "required string");
		if (typeof raw.password !== "string" || raw.password.length < 8) throw new ContentValidationError("password", "must be at least 8 characters");
		const roles = raw.roles === void 0 ? ["editor"] : parseRoles(raw.roles);
		const created = await buildAuthEngine(env).createUser({
			email: raw.email.trim(),
			password: raw.password,
			roles
		});
		return jsonOk({ userId: created.userId }, 201);
	} catch (error) {
		return mapContentError(error);
	}
};
//#endregion
//#region \0virtual:astro:page:src/pages/api/admin/users@_@ts
var page = () => users_exports;
//#endregion
export { page };
