[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_103":104,"_105":106},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","Tribeca_Rep","name","tribeca-cooler-service-report","path","main.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/Tribeca_Rep/tribeca-cooler-service-report/code/main.ts","extension","id","95db8175-806a-4263-ad89-ed957da3eaa1","fileId","b6262b3e-a0b2-11f1-aeac-1607ee4eb77e","parentId","branchId","7ca66a6a-1b58-4bf5-903e-c8c856ccda9b","branchVersion",27,"latest",true,"createdAt",["D",1787686051038],"version",17,"fileType","http","content","// Cooler service report - a phone page for the field.\n//\n// Someone standing in front of a broken cooler opens this on their phone,\n// photographs the serial plate, optionally types what is wrong, and presses\n// send. The photo and note are emailed to Crystal Coolers.\n//\n// DELIVERY\n// --------\n// Val Town's own mailer cannot do what this val is for, on two counts:\n//\n// 1. `from` is fixed. It refuses anything but `username.valname@valtown.email`\n// - \"Invalid `from` email: info@tribecabeverage.com\".\n// 2. On the free tier `to` must be the account owner. Sending to\n// tkeller@crystalcoolers.com is rejected outright.\n//\n// So the real path is SendGrid, which can send as info@tribecabeverage.com once\n// that sender is verified there. If SENDGRID_API_KEY is absent the val falls\n// back to Val Town mail addressed to the account owner, so a report is never\n// silently lost - it just lands in the Tribeca inbox instead of Crystal's, and\n// the page says so.\nimport { email as valtownEmail } from \"https://esm.town/v/std/email\";\n\n// Which vendor services the cooler is a decision made in the field - the person\n// standing in front of it knows whose machine it is - so it is a choice of\n// button rather than a setting.\nconst VENDORS = {\n crystal: {\n label: \"Crystal Coolers\",\n to: Deno.env.get(\"REPORT_TO_EMAIL\") ?? \"tkeller@crystalcoolers.com\",\n },\n vertex: {\n label: \"Vertex Coolers\",\n to: Deno.env.get(\"REPORT_TO_VERTEX_EMAIL\") ?? \"ryanv@vertexwater.com\",\n },\n} as const;\ntype VendorKey = keyof typeof VENDORS;\nconst isVendor = (v: string): v is VendorKey => v === \"crystal\" || v === \"vertex\";\n\nconst FROM = Deno.env.get(\"REPORT_FROM_EMAIL\") ?? \"info@tribecabeverage.com\";\nconst COOKIE = \"coolerauth\";\n\n// 8MB after client-side downscaling is already generous; this is a backstop\n// against a client that ignores the resize, not the expected size.\nconst MAX_BYTES = 8 * 1024 * 1024;\n\nconst html = (body: string, status = 200) =>\n new Response(body, {\n status,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\", \"Cache-Control\": \"no-store\" },\n });\n\n// Length-independent compare, so a wrong password cannot be narrowed down by\n// timing the response.\nfunction secretsMatch(a: string, b: string): boolean {\n const enc = new TextEncoder();\n const x = enc.encode(a), y = enc.encode(b);\n let diff = x.length ^ y.length;\n for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);\n return diff === 0;\n}\n\nfunction authed(req: Request): boolean {\n const expected = Deno.env.get(\"REPORT_ACCESS_KEY\");\n if (!expected) return false;\n const raw = req.headers.get(\"cookie\") ?? \"\";\n const hit = raw.split(\";\").map((c) => c.trim()).find((c) => c.startsWith(`${COOKIE}=`));\n return !!hit && secretsMatch(decodeURIComponent(hit.slice(COOKIE.length + 1)), expected);\n}\n\nconst STYLE = `\n :root { color-scheme: light dark;\n --bg:#fff; --fg:#111827; --muted:#6b7280; --line:#e5e7eb; --panel:#f9fafb;\n --accent:#2563eb; --ok:#15803d; --bad:#b91c1c; }\n @media (prefers-color-scheme: dark) {\n :root { --bg:#0f172a; --fg:#e2e8f0; --muted:#94a3b8; --line:#1e293b; --panel:#1e293b;\n --accent:#3b82f6; --ok:#4ade80; --bad:#fca5a5; }\n }\n * { box-sizing:border-box; -webkit-tap-highlight-color:transparent; }\n body { margin:0; padding:20px 16px 40px; background:var(--bg); color:var(--fg);\n font:16px/1.5 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif; }\n .wrap { max-width:520px; margin:0 auto; }\n h1 { font-size:19px; margin:0 0 4px; }\n .sub { color:var(--muted); font-size:13px; margin:0 0 22px; }\n label { display:block; font-weight:600; font-size:14px; margin:0 0 6px; }\n .hint { color:var(--muted); font-weight:400; font-size:12.5px; }\n /* A 56px target, because this is used one-handed standing in a stockroom. */\n .shoot { display:flex; align-items:center; justify-content:center; gap:10px;\n width:100%; min-height:56px; margin-bottom:6px; padding:14px;\n border:2px dashed var(--line); border-radius:12px; background:var(--panel);\n color:var(--fg); font:inherit; font-weight:600; cursor:pointer; }\n .shoot:active { border-color:var(--accent); }\n input[type=file] { display:none; }\n #preview { display:none; width:100%; border-radius:12px; border:1px solid var(--line);\n margin:10px 0 4px; }\n #retake { display:none; background:none; border:0; color:var(--accent);\n font:inherit; font-size:13px; padding:4px 0; cursor:pointer; }\n textarea { width:100%; min-height:96px; padding:11px 12px; border-radius:10px;\n border:1px solid var(--line); background:var(--panel); color:var(--fg);\n font:inherit; font-size:16px; resize:vertical; }\n .send { width:100%; min-height:56px; margin-top:10px; border:0; border-radius:12px;\n background:var(--accent); color:#fff; font:inherit; font-size:17px;\n font-weight:650; cursor:pointer; }\n /* The second vendor is outlined rather than filled. Two identical filled\n buttons invite a mis-tap, and sending a cooler to the wrong supplier is\n the one mistake this page can actually make. */\n .send.alt { background:transparent; color:var(--accent);\n box-shadow:inset 0 0 0 2px var(--accent); }\n .send:disabled { opacity:.45; cursor:default; }\n #msg { margin-top:16px; padding:13px 14px; border-radius:10px; font-size:14px; display:none; }\n #msg.ok { display:block; background:rgba(21,128,61,.12); color:var(--ok); }\n #msg.bad { display:block; background:rgba(185,28,28,.12); color:var(--bad); }\n .field { margin-bottom:20px; }\n input[type=password] { width:100%; padding:12px; font:inherit; font-size:16px;\n border-radius:10px; border:1px solid var(--line);\n background:var(--panel); color:var(--fg); }\n`;\n\nfunction loginPage(bad = false) {\n return html(`\n\nCooler service report

Cooler service report

Enter the password to continue.

\n \n ${bad ? `

That password is not right.

` : \"\"}\n

`);\n}\n\nfunction formPage(fallbackOnly: boolean) {\n return html(`\n\nCooler service report

Cooler service report

Photograph the serial number, add a note if it helps, and send.

\n\n

\n Serial number photo required\n \n \n \n $\"\"$ \n \n

\n\n

\n What is wrong? optional\n \n

\n\n Send to\n \n \n

\n`);\n}\n\n// base64 in chunks: a 6MB photo spread over one apply() call blows the argument\n// limit and throws RangeError.\nfunction toBase64(bytes: Uint8Array): string {\n let bin = \"\";\n const CHUNK = 0x8000;\n for (let i = 0; i < bytes.length; i += CHUNK) {\n bin += String.fromCharCode(...bytes.subarray(i, i + CHUNK));\n }\n return btoa(bin);\n}\n\nasync function sendReport(\n photo: Uint8Array,\n note: string,\n filename: string,\n vendor: VendorKey,\n) {\n const TO = VENDORS[vendor].to;\n const subject = \"Compromised water cooler\";\n const text = [\n \"A cooler service request was submitted from the Tribeca field form.\",\n \"\",\n note.trim() ? `Reported problem:\\n${note.trim()}` : \"No description was given.\",\n \"\",\n \"The serial number photo is attached.\",\n ].join(\"\\n\");\n const b64 = toBase64(photo);\n\n const sendgrid = Deno.env.get(\"SENDGRID_API_KEY\");\n if (sendgrid) {\n const res = await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${sendgrid}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n // BCC keeps a copy in the Tribeca inbox. Without it the only record of\n // a report is a log line saying one was sent - the photo and the note\n // themselves would exist nowhere but Crystal's mailbox, so \"which\n // serial did the driver photograph?\" would be unanswerable.\n personalizations: [{ to: [{ email: TO }], bcc: [{ email: FROM }] }],\n from: { email: FROM, name: \"TriBeCa Beverage\" },\n reply_to: { email: FROM },\n subject,\n content: [{ type: \"text/plain\", value: text }],\n attachments: [{\n content: b64,\n filename,\n type: \"image/jpeg\",\n disposition: \"attachment\",\n }],\n }),\n });\n if (!res.ok) {\n throw new Error(`SendGrid ${res.status}: ${(await res.text()).slice(0, 300)}`);\n }\n return { to: TO, bcc: FROM, via: \"sendgrid\" as const };\n }\n\n // Fallback. Val Town will not deliver to Crystal Coolers on this plan, so the\n // report goes to the Tribeca inbox to be forwarded by hand rather than lost.\n await valtownEmail({\n subject: `${subject} (NOT sent to ${VENDORS[vendor].label} - forward manually)`,\n text: `${text}\\n\\nThis went to the Tribeca inbox because SENDGRID_API_KEY is not set.\\nIntended recipient: ${VENDORS[vendor].label} <${TO}>`,\n attachments: [{ filename, content: b64, type: \"image/jpeg\" }],\n } as any);\n return { to: \"the Tribeca inbox\", bcc: null, via: \"valtown\" as const };\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const { pathname } = url;\n\n if (!Deno.env.get(\"REPORT_ACCESS_KEY\")) {\n return html(\n `` +\n `

Not configured

` +\n `

Set REPORT_ACCESS_KEY on this val to switch the page on.

`,\n 503,\n );\n }\n\n if (pathname === \"/login\" && req.method === \"POST\") {\n const form = await req.formData().catch(() => null);\n const given = String(form?.get(\"password\") ?? \"\");\n const expected = Deno.env.get(\"REPORT_ACCESS_KEY\")!;\n if (given && secretsMatch(given, expected)) {\n return new Response(null, {\n status: 302,\n headers: {\n Location: \"/\",\n // 90 days: a field phone should not be asked to log in every shift.\n \"Set-Cookie\": `${COOKIE}=${encodeURIComponent(expected)}; Path=/; Max-Age=7776000; ` +\n `HttpOnly; Secure; SameSite=Lax`,\n },\n });\n }\n return loginPage(true);\n }\n\n if (pathname === \"/logout\") {\n return new Response(null, {\n status: 302,\n headers: { Location: \"/\", \"Set-Cookie\": `${COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax` },\n });\n }\n\n if (!authed(req)) return loginPage();\n\n if (pathname === \"/send\" && req.method === \"POST\") {\n try {\n const form = await req.formData();\n const photo = form.get(\"photo\");\n if (!(photo instanceof File) || photo.size === 0) {\n return Response.json({ ok: false, error: \"No photo was attached.\" }, { status: 400 });\n }\n if (photo.size > MAX_BYTES) {\n return Response.json(\n { ok: false, error: \"That photo is too large to send.\" },\n { status: 413 },\n );\n }\n // No default vendor. Guessing which supplier to email would be a bad way\n // to be wrong, so a missing or unknown value is refused outright.\n const vendorRaw = String(form.get(\"vendor\") ?? \"\");\n if (!isVendor(vendorRaw)) {\n return Response.json({ ok: false, error: \"Pick which company to send to.\" }, {\n status: 400,\n });\n }\n const vendor = VENDORS[vendorRaw];\n\n const bytes = new Uint8Array(await photo.arrayBuffer());\n const sent = await sendReport(\n bytes,\n String(form.get(\"note\") ?? \"\"),\n \"serial.jpg\",\n vendorRaw,\n );\n console.log(\n `report sent via ${sent.via} to ${sent.to}` +\n `${sent.bcc ? ` bcc ${sent.bcc}` : \"\"} (${bytes.length} bytes)`,\n );\n return Response.json({\n ok: true,\n message: sent.via === \"sendgrid\"\n ? `Sent to ${vendor.label}.`\n : `Sent to ${sent.to}. ${vendor.label} was NOT emailed - SendGrid is not configured yet.`,\n });\n } catch (err) {\n console.log(`send failed: ${String(err)}`);\n return Response.json(\n { ok: false, error: \"The email did not go out. Try again, or tell the office.\" },\n { status: 500 },\n );\n }\n }\n\n return formPage(!Deno.env.get(\"SENDGRID_API_KEY\"));\n}\n","deleted",false,"label","tribeca-cooler-report",[14],"43d84ff0-963f-4ef2-afe4-361b8dc9f0c6",["D",1787682484536],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Phone page: photo a cooler serial, email Crystal Coolers","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_102":98},"org",{"_9":10,"_95":96,"_97":98,"_56":57,"_99":100,"_101":42},"branch",{"_35":30,"_11":86,"_22":28,"_87":46,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":12,"_94":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_79":-5,"_136":137,"_138":139,"_140":141,"_142":42,"_143":42,"_144":42,"_145":32,"_146":-5,"_147":-7,"_148":-7,"_149":63,"_150":42,"_151":42,"_152":-5,"_153":42,"_154":42,"_155":42,"_156":-5},"ENV",{"_107":108,"_109":110,"_111":86,"_112":113,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]