globalThis.process ??= {};
globalThis.process.env ??= {};
import { r as __exportAll } from "./rolldown-runtime_-UtK6b3T.mjs";
import { c as isEntityId } from "./crypto_CY2zBtG3.mjs";
import { o as unlockContentEntry, t as CONTENT_PROOF_COOKIE } from "./content-model-routes_D5ryGYw4.mjs";
import { env } from "cloudflare:workers";
//#region src/pages/api/content/unlock.ts
var unlock_exports = /* @__PURE__ */ __exportAll({
	POST: () => POST,
	prerender: () => false,
	safeReturnTo: () => safeReturnTo
});
function safeReturnTo(value) {
	if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes(String.fromCharCode(92)) || /[\u0000-\u001f\u007f]/.test(value) || value.length > 2048) return "/";
	return value;
}
var POST = async ({ request, cookies }) => {
	const type = request.headers.get("content-type") ?? "";
	if (!type.includes("application/x-www-form-urlencoded") && !type.includes("multipart/form-data")) return new Response(null, { status: 415 });
	const form = await request.formData(), entryId = form.get("entryId"), password = form.get("password"), returnTo = safeReturnTo(form.get("returnTo"));
	if (!isEntityId(entryId) || typeof password !== "string" || password.length < 1 || password.length > 4096) return new Response(null, { status: 403 });
	const proof = await unlockContentEntry(env, entryId, password);
	if (!proof) return new Response(null, { status: 403 });
	cookies.set(CONTENT_PROOF_COOKIE, proof, {
		httpOnly: true,
		secure: true,
		sameSite: "lax",
		path: "/",
		maxAge: 3600
	});
	return new Response(null, {
		status: 303,
		headers: { Location: returnTo }
	});
};
//#endregion
//#region \0virtual:astro:page:src/pages/api/content/unlock@_@ts
var page = () => unlock_exports;
//#endregion
export { page };
