import { signupsFull } from "./waitlist";
import { env } from "cloudflare:workers";
import { z } from "zod";
import { first, run } from "./db";
import { randomToken, timingSafeEqualStrings, toBase64 } from "./crypto";
import { pendingLoginCookie, requiresSecondFactor } from "./two-factor";
import { cookieAttributes, cookieName, cookieValue, createSessionCookie } from "./auth";
import { accountNameTaken, createUser, promoteAdminEmailOnVerify, reclaimUnverifiedEmail } from "./accounts";
import { publicUrl } from "./events/emit";
import { requestIp, withinRateLimit } from "./limits";
import { isReservedName } from "~/lib/reserved-names";
import { recordTermsAcceptance } from "./legal";
import { accountDisableState, disabledNotice } from "./account-disable";
import { safeReturnPath } from "~/lib/return-to";
import { userChanged } from "./user-row";
const STATE_TTL_SECONDS = 600;
const GITHUB_USER_AGENT = "gitfor-forge";
const MAX_NAME_SUFFIX = 1000;
const STATE_COOKIE_BASE = "gitfor_oauth";
function clearStateCookie(): string {
return `${cookieName(STATE_COOKIE_BASE)}=; ${cookieAttributes(0)}`;
}
const tokenResponse = z.object({ access_token: z.string() });
const githubUser = z.object({
id: z.number(),
login: z.string(),
name: z.string().nullable(),
});
const githubEmails = z.array(z.object({ email: z.string(), primary: z.boolean(), verified: z.boolean() }));
/** Always the canonical origin (AUTH-A11): the callback and its `__Host-` cookies must live on PUBLIC_URL. */
function callbackUrl(): string {
return publicUrl("/auth/github/callback");
}
/** Auth routes reached on an alias host (e.g. `*.workers.dev`) bounce to PUBLIC_URL so cookies and redirect_uri agree. */
function canonicalRedirect(request: Request): Response | null {