[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","RT_Brandt","name","throne-gelt-ledger","path","auth.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":32,"_60":-5,"_61":-5,"_62":36,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/RT_Brandt/throne-gelt-ledger/code/auth.ts","extension","id","a9d77305-8592-418d-8486-8b521c6fd867","fileId","a744625a-b00e-11f1-b65d-1607ee4eb77e","parentId","branchId","bb0b67fb-350e-4d2b-8d6f-3c56dcf88f85","branchVersion",2,"latest",true,"createdAt",["D",1789371240670],"version",0,"fileType","script","content","/**\n * Password hashing and session tokens.\n *\n * Passwords: PBKDF2-SHA256, per-user random salt, stored as\n * pbkdf2$$$\n * Nothing reversible is ever written to the database.\n *\n * Sessions: 32 random bytes given to the browser, only the SHA-256\n * digest is stored. A database leak does not yield usable sessions.\n */\n\nconst PBKDF2_ITERATIONS = 210_000;\nconst SALT_BYTES = 16;\nconst KEY_BITS = 256;\n\nfunction toB64(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes));\n}\n\nfunction fromB64(s: string): Uint8Array {\n return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations },\n key,\n KEY_BITS,\n );\n return new Uint8Array(bits);\n}\n\n/** Hash a password for storage. */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n const hash = await pbkdf2(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toB64(salt)}$${toB64(hash)}`;\n}\n\n/** Constant-time byte comparison. */\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** Verify a password against a stored hash. */\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n try {\n const [scheme, iterStr, saltB64, hashB64] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\") return false;\n const iterations = parseInt(iterStr, 10);\n if (!Number.isFinite(iterations) || iterations < 1000) return false;\n const candidate = await pbkdf2(password, fromB64(saltB64), iterations);\n return timingSafeEqual(candidate, fromB64(hashB64));\n } catch {\n return false;\n }\n}\n\n/**\n * Burn roughly the same time as a real verification when the username\n * doesn't exist, so response timing doesn't reveal which handles are real.\n */\nexport async function dummyVerify(): Promise {\n const salt = new Uint8Array(SALT_BYTES);\n await pbkdf2(\"decoy-value-for-timing\", salt, PBKDF2_ITERATIONS);\n}\n\n/** A fresh session token. Returns the plaintext (for the cookie) and its digest (for the DB). */\nexport async function newSessionToken(): Promise<{ token: string; digest: string }> {\n const raw = crypto.getRandomValues(new Uint8Array(32));\n const token = toB64(raw).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n return { token, digest: await digestToken(token) };\n}\n\n/** SHA-256 of a session token, hex encoded. */\nexport async function digestToken(token: string): Promise {\n const bytes = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(token),\n );\n return Array.from(new Uint8Array(bytes))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nexport const SESSION_TTL_DAYS = 30;\nexport const SESSION_COOKIE = \"tg_session\";\n","deleted",false,"label",[14],"bfa39e45-7092-4aeb-b689-37287ba7acba",["D",1789371222313],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Imperial wager ledger — accounts, bets, payouts","imageUrl","userId","28c534b6-beee-40a1-be9c-43985b36185d","pinnedFileId","9c51ffec-b00e-11f1-bc3a-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a09ecc-b888-773d-b822-8340b04163b7","tursoName","bfa39e4570924aebb68937287ba7acba","tursoHostname","bfa39e4570924aebb68937287ba7acba-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789458641386],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",6,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Garrick W","avatar","https://lh3.googleusercontent.com/a/ACg8ocIFL4o68YPM3Sv8WlUCusFPkUPZWiKW0FtIuul8fl9ATqyk3Xw=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":36,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]