globalThis.process ??= {};
globalThis.process.env ??= {};
import { r as __exportAll } from "./rolldown-runtime_-UtK6b3T.mjs";
import { b as parseDiscussionConfig, d as mapContentError, g as getSetting, l as jsonError, m as SETTINGS_KEYS } from "./crypto_CY2zBtG3.mjs";
import { n as enforcePublicCommentRateLimit } from "./rate-limit_CABs9jHB.mjs";
import { n as getFullDb, x as post } from "./db_DZJ1iBSP.mjs";
import { r as buildAuthEngine } from "./admin-engine_Cqzo5vQB.mjs";
import { c as assertCsrf, s as resolveSession } from "./auth_B0DWM0G6.mjs";
import { t as sanitizeContentBody } from "./sanitize_CLHlWQbC.mjs";
import { a as moderatorActorFromPrincipal, i as mapCommentError, n as getCommentsDb, o as safeAuthorUrl, r as guestAuthorFromForm, s as userAuthorFromPrincipal } from "./comments_D1h5giZi.mjs";
import { i as notifyAdmins, t as COMMENT_CREATED_EVENT } from "./notifications_FIu0X52O.mjs";
import { env } from "cloudflare:workers";
//#region src/pages/api/comments.ts
var comments_exports = /* @__PURE__ */ __exportAll({
	POST: () => POST,
	prerender: () => false
});
var MAX_NAME_LEN = 80;
var MAX_EMAIL_LEN = 254;
var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
var ENTITY_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
var ALLOWED_TARGET_TYPES = /* @__PURE__ */ new Set(["content_entry"]);
var POST = async ({ request, cookies }) => {
	try {
		const limited = await enforcePublicCommentRateLimit(env, request);
		if (limited) return limited;
		const form = await request.formData();
		if (form.get("website")?.toString().trim()) return new Response(null, { status: 200 });
		const targetType = form.get("target_type")?.toString().trim() ?? "";
		const targetId = form.get("target_id")?.toString().trim() ?? "";
		const body = form.get("body")?.toString() ?? "";
		const parentId = form.get("parent_id")?.toString().trim() || void 0;
		const name = form.get("name")?.toString().trim() ?? "";
		const email = form.get("email")?.toString().trim() ?? "";
		const rawUrl = form.get("url")?.toString().trim() ?? "";
		if (!targetType || !ALLOWED_TARGET_TYPES.has(targetType) || !targetId || !ENTITY_ID_RE.test(targetId)) return jsonError(422, "validation_error", "Target is required.");
		if (!body.trim()) return jsonError(422, "validation_error", "Comment body is required.");
		const { db: mainDb } = getFullDb(env);
		const rawDiscussion = await getSetting(mainDb, SETTINGS_KEYS.discussion);
		const discussionConfig = parseDiscussionConfig(rawDiscussion);
		if (!discussionConfig.enabled) return jsonError(422, "validation_error", "Comments are not enabled.");
		let principal = null;
		let authMode = "session";
		try {
			const resolved = await resolveSession(request, buildAuthEngine(env), cookies);
			principal = resolved.principal;
			authMode = resolved.authMode;
		} catch {}
		if (discussionConfig.whoCanComment === "registered" && !principal) return jsonError(422, "validation_error", "You must be signed in to comment.");
		const bodyLower = body.trim().toLowerCase();
		if (discussionConfig.blocklist.length > 0 && discussionConfig.blocklist.some((term) => bodyLower.includes(term))) return jsonError(422, "validation_error", "Comment contains disallowed terms.");
		if (!principal) {
			if (!name) return jsonError(422, "validation_error", "Name is required.");
			if (name.length > MAX_NAME_LEN) return jsonError(422, "validation_error", "Name is too long.");
			if (email && (email.length > MAX_EMAIL_LEN || !EMAIL_RE.test(email))) return jsonError(422, "validation_error", "That email is not valid.");
			const url = rawUrl ? safeAuthorUrl(rawUrl) : void 0;
			if (rawUrl && !url) return jsonError(422, "validation_error", "That URL is not allowed.");
			const db = getCommentsDb(env);
			await post(db, {
				target: {
					type: targetType,
					id: targetId
				},
				parentId,
				author: guestAuthorFromForm({
					name,
					...email ? { email } : {},
					...url ? { url } : {}
				}),
				body
			}, null, sanitizeContentBody);
			notifyAdmins(env, buildAuthEngine(env), COMMENT_CREATED_EVENT);
		} else {
			assertCsrf(request, {
				authMode,
				siteOrigin: env.SITE_ORIGIN
			});
			const db = getCommentsDb(env);
			const actor = moderatorActorFromPrincipal(principal);
			await post(db, {
				target: {
					type: targetType,
					id: targetId
				},
				parentId,
				author: userAuthorFromPrincipal(principal),
				body
			}, actor.canModerate ? actor : { id: actor.id }, sanitizeContentBody);
			notifyAdmins(env, buildAuthEngine(env), COMMENT_CREATED_EVENT);
		}
		const referer = request.headers.get("referer");
		return new Response(null, {
			status: 303,
			headers: { Location: referer ?? "/" }
		});
	} catch (error) {
		const mapped = mapCommentError(error);
		if (mapped.status !== 500) return mapped;
		return mapContentError(error);
	}
};
//#endregion
//#region \0virtual:astro:page:src/pages/api/comments@_@ts
var page = () => comments_exports;
//#endregion
export { page };
