[{"_1":2,"_179":-5,"_180":-5},"loaderData",{"_3":4,"_93":94},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","436c7f7c8801ac8e84ab78aba420b373f6264c65","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":20,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":20,"_92":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":20,"_19":20,"_84":74,"_85":86,"_87":74,"_88":47,"_89":20,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_95":96,"_97":98,"_99":100,"_101":102,"_154":155,"_176":177,"_178":-5},"handle","abhishekplating","name","Version2","path","backend/auth","project",{"_103":104,"_97":98,"_105":106,"_107":-5,"_108":20,"_109":110,"_111":-5,"_112":-5,"_12":113,"_114":-5,"_115":20,"_116":-5,"_117":-5,"_118":33,"_14":119,"_120":-5,"_121":-5,"_122":-5,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_23":132,"_135":136,"_140":141,"_153":20},"id","21c81440-1bb8-11f1-808a-42dde27851f2","createdAt",["D",1773061307983],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","019ca7d6-bbec-76d6-822b-6e2c39ed1dbd","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019ca7d6-bbec-76d6-822b-72f395b7c435","tursoName","tursoHostname","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_133":134},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNBS1hsRkxLQ2d3eHdUMVYzU3p3YTNmakRRbSJ9","org",{"_95":96,"_137":134,"_12":113,"_138":139},"avatar","tier","free","branch",{"_142":143,"_97":45,"_103":144,"_145":104,"_146":-5,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":98,"_152":96},"version",61,"21c89e60-1bb8-11f1-808a-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_103":156,"_97":7,"_157":158,"_159":160,"_161":144,"_162":163,"_164":165,"_105":166,"_142":167,"_168":169,"_170":171,"_172":20,"_173":-5,"_99":174},"ab9812e8-1bcb-11f1-8057-42dde27851f2","fileId","bef8e238-1bba-11f1-8467-42dde27851f2","parentId","440c1f56-1bb8-11f1-b80f-42dde27851f2","branchId","branchVersion",50,"latest",true,["D",1773069699627],3,"fileType","script","content","// FactoryPro V2.0 — Auth Module\nimport { ok, err, ss, isStrongPassword } from \"./utils\";\n\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(8));\n const saltHex = Array.from(salt).map(b => b.toString(16).padStart(2, '0')).join('');\n const data = new TextEncoder().encode(saltHex + password);\n const hash1 = await crypto.subtle.digest('SHA-256', data);\n const hash2 = await crypto.subtle.digest('SHA-256', new Uint8Array([...new Uint8Array(hash1), ...data]));\n const hashHex = Array.from(new Uint8Array(hash2)).map(b => b.toString(16).padStart(2, '0')).join('');\n return `$sha256$${saltHex}$${hashHex}`;\n}\n\nexport async function verifyPassword(password: string, stored: string): Promise {\n if (stored.startsWith('$sha256$')) {\n const parts = stored.split('$');\n const saltHex = parts[2];\n const expectedHash = parts[3];\n const data = new TextEncoder().encode(saltHex + password);\n const hash1 = await crypto.subtle.digest('SHA-256', data);\n const hash2 = await crypto.subtle.digest('SHA-256', new Uint8Array([...new Uint8Array(hash1), ...data]));\n const hashHex = Array.from(new Uint8Array(hash2)).map(b => b.toString(16).padStart(2, '0')).join('');\n return hashHex === expectedHash;\n }\n return stored === password;\n}\n\nexport interface TokenEntry {\n userId: number;\n username: string;\n role: string;\n displayName: string;\n createdAt: number;\n expiresAt: number;\n}\n\nconst TOKEN_CACHE = new Map();\nconst TOKEN_EXPIRY_MS = 24 * 60 * 60 * 1000;\n\nfunction generateToken(): string {\n const bytes = crypto.getRandomValues(new Uint8Array(32));\n return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');\n}\n\nexport async function createToken(sqlFn: any, user: { id: number; username: string; role: string; display_name: string }): Promise {\n const now = Date.now();\n const token = generateToken();\n const entry: TokenEntry = { userId: user.id, username: user.username, role: user.role, displayName: user.display_name, createdAt: now, expiresAt: now + TOKEN_EXPIRY_MS };\n try {\n await sqlFn`INSERT INTO fp_sessions (token, user_id, username, role, display_name, created_at, expires_at) VALUES (${token}, ${user.id}, ${user.username}, ${user.role}, ${user.display_name}, ${new Date(now).toISOString()}, ${new Date(now + TOKEN_EXPIRY_MS).toISOString()})`;\n } catch (e: any) { console.error('Failed to persist token:', e.message); }\n TOKEN_CACHE.set(token, entry);\n if (TOKEN_CACHE.size > 100) {\n sqlFn`DELETE FROM fp_sessions WHERE expires_at < ${new Date().toISOString()}`.catch(() => {});\n for (const [k, v] of TOKEN_CACHE) { if (v.expiresAt < now) TOKEN_CACHE.delete(k); }\n }\n return token;\n}\n\nexport async function validateToken(sqlFn: any, token: string): Promise {\n if (!token) return null;\n const now = Date.now();\n const cached = TOKEN_CACHE.get(token);\n if (cached) {\n if (cached.expiresAt < now) { TOKEN_CACHE.delete(token); sqlFn`DELETE FROM fp_sessions WHERE token = ${token}`.catch(() => {}); return null; }\n return cached;\n }\n try {\n const rows = await sqlFn`SELECT user_id, username, role, display_name, created_at, expires_at FROM fp_sessions WHERE token = ${token} LIMIT 1`;\n if (!rows.length) return null;\n const row = rows[0];\n const expiresAt = new Date(row.expires_at).getTime();\n if (expiresAt < now) { sqlFn`DELETE FROM fp_sessions WHERE token = ${token}`.catch(() => {}); return null; }\n const entry: TokenEntry = { userId: Number(row.user_id), username: row.username, role: row.role, displayName: row.display_name, createdAt: new Date(row.created_at).getTime(), expiresAt };\n TOKEN_CACHE.set(token, entry);\n return entry;\n } catch (e: any) { console.error('Token DB lookup failed:', e.message); return null; }\n}\n\nexport async function revokeToken(sqlFn: any, token: string): Promise {\n TOKEN_CACHE.delete(token);\n try { await sqlFn`DELETE FROM fp_sessions WHERE token = ${token}`; } catch { }\n}\n\nconst LOGIN_RATE_LIMIT = new Map();\nfunction checkLoginRateLimit(username: string): boolean {\n const now = Date.now();\n const key = username.toLowerCase().trim();\n const entry = LOGIN_RATE_LIMIT.get(key);\n if (!entry || entry.resetAt < now) { LOGIN_RATE_LIMIT.set(key, { count: 1, resetAt: now + 15 * 60 * 1000 }); return true; }\n if (entry.count >= 5) return false;\n entry.count++;\n return true;\n}\nfunction resetLoginRateLimit(username: string): void { LOGIN_RATE_LIMIT.delete(username.toLowerCase().trim()); }\n\ntype Role = 'admin' | 'management' | 'staff';\nconst PUBLIC_ACTIONS = new Set(['health', 'ping', 'login', 'logout']);\nconst ADMIN_ONLY = new Set(['addUser', 'updateUser', 'deleteUser', 'getUsers', 'migrate']);\nconst MANAGEMENT_UP = new Set(['addMold', 'updateMold', 'deleteMold', 'logPM', 'addMachine', 'updateMachine', 'deleteMachine', 'addWorker', 'updateWorker', 'deleteWorker', 'reactivateWorker', 'getAllWorkers', 'deletePO', 'updatePO', 'deleteRun', 'deleteLabour', 'deleteDispatch', 'deleteDailyExpense', 'deleteElectricity', 'updatePnlSettings', 'savePnlSettings', 'saveSheetUrl', 'syncPOFromSheet', 'syncPOToSheet', 'saveGeminiKey']);\nconst FINANCE_ACTIONS = new Set(['getPnlSettings', 'updatePnlSettings', 'savePnlSettings', 'getDailyExpenses', 'addDailyExpense', 'deleteDailyExpense', 'getElectricity', 'addElectricity', 'deleteElectricity']);\n\nexport function isPublicAction(action: string): boolean { return PUBLIC_ACTIONS.has(action); }\nexport function checkPermission(role: string, action: string): boolean {\n if (role === 'admin') return true;\n if (ADMIN_ONLY.has(action)) return false;\n if (role === 'management') return true;\n if (MANAGEMENT_UP.has(action)) return false;\n if (FINANCE_ACTIONS.has(action)) return false;\n return true;\n}\n\nexport async function handleLogin(sql: any, body: any) {\n const username = ss(body.username, 50);\n const password = String(body.password || '');\n if (!username || !password) return err(\"Username and password required\");\n if (!checkLoginRateLimit(username)) return err(\"Too many login attempts. Try again in 15 minutes.\", 429);\n const rows = await sql`SELECT id, username, display_name, password_hash, role, active FROM fp_users WHERE username = ${username.toLowerCase().trim()} AND active = true LIMIT 1`;\n if (!rows.length) return err(\"Invalid credentials\", 401);\n const user = rows[0];\n const passwordValid = await verifyPassword(password, user.password_hash);\n if (!passwordValid) return err(\"Invalid credentials\", 401);\n resetLoginRateLimit(username);\n if (!user.password_hash.startsWith('$sha256$')) {\n const newHash = await hashPassword(password);\n try { await sql`UPDATE fp_users SET password_hash = ${newHash} WHERE id = ${user.id}`; } catch { }\n }\n const token = await createToken(sql, user);\n return ok({ id: user.id, username: user.username, display_name: user.display_name, role: user.role, token, expiresIn: TOKEN_EXPIRY_MS });\n}\n\nexport async function handleLogout(sql: any, body: any) {\n const token = ss(body.token, 128);\n if (token) await revokeToken(sql, token);\n return ok({ loggedOut: true });\n}\n\nexport async function handleChangePassword(sql: any, body: any) {\n const { id, username, password } = body;\n const pwd = String(password || '');\n if (!isStrongPassword(pwd)) return err(\"Password must be 8+ chars with upper, lower, number and symbol\");\n const hashedPwd = await hashPassword(pwd);\n if (id) { await sql`UPDATE fp_users SET password_hash = ${hashedPwd} WHERE id = ${id}`; }\n else if (username) { await sql`UPDATE fp_users SET password_hash = ${hashedPwd} WHERE username = ${ss(username, 50)}`; }\n else { return err(\"User id or username required\"); }\n return ok({ changed: true });\n}\n\nfunction requireFields(body: any, fields: string[]): string | null {\n for (const f of fields) {\n const v = body[f];\n if (v === undefined || v === null || (typeof v === 'string' && v.trim() === '')) return `Missing required field: ${f}`;\n }\n return null;\n}\n\nexport async function handleAddUser(sql: any, body: any) {\n const username = ss(body.username, 50);\n const display_name = ss(body.display_name, 100);\n const password = String(body.password || '');\n const role = ss(body.role, 20) || 'staff';\n const missing = requireFields({ username, display_name, password }, ['username', 'display_name', 'password']);\n if (missing) return err(missing);\n if (!isStrongPassword(password)) return err(\"Password must be 8+ chars with upper, lower, number and symbol\");\n if (!['admin', 'management', 'staff'].includes(role)) return err(\"Invalid role\");\n const hashedPwd = await hashPassword(password);\n await sql`INSERT INTO fp_users (username, display_name, password_hash, role) VALUES (${username.toLowerCase()}, ${display_name}, ${hashedPwd}, ${role})`;\n return ok({ added: true });\n}\n\nexport async function handleUpdateUser(sql: any, body: any) {\n const { id, display_name, role } = body;\n if (!id) return err(\"User id required\");\n await sql`UPDATE fp_users SET display_name = COALESCE(${display_name ? ss(display_name, 100) : null}, display_name), role = COALESCE(${role ? ss(role, 20) : null}, role) WHERE id = ${Number(id)}`;\n return ok({ updated: true });\n}\n\nexport async function handleDeleteUser(sql: any, body: any) {\n const { id } = body;\n if (!id) return err(\"User id required\");\n await sql`DELETE FROM fp_users WHERE id = ${Number(id)}`;\n return ok({ deleted: true });\n}","deleted","label",[175,7],"backend","permalink","https://www.val.town/x/abhishekplating/Version2/code/backend/auth","extension","actionData","errors"]