[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_110":111,"_112":113},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","boh","name","chaos-diner","path","lib/auth.ts","project",{"_22":48,"_11":12,"_35":49,"_50":-5,"_51":44,"_52":53,"_54":53,"_55":56,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/boh/chaos-diner/code/lib/auth.ts","extension","id","438d4ddd-6c05-4478-bec6-49b7ec1e18b5","auth.ts","fileId","72f4aeec-9ed9-11f1-844a-1607ee4eb77e","parentId","a64b76d5-e1d9-479e-9c13-77aa3008e76f","branchId","d37ffabd-ddb0-472a-8701-c0eef966a563","branchVersion",46,"latest",true,"createdAt",["D",1787479365707],"version",1,"fileType","script","content","// Accounts, friendships, DMs & room-invite notifications.\n// Passwords are never stored: only a salted PBKDF2-SHA256 hash.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { uid } from \"./db.ts\";\n\n// ------------------------------------------------------------- password hashing\n\nfunction toB64(bytes: Uint8Array): string {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin);\n}\nfunction fromB64(s: string): Uint8Array {\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nasync function hashPassword(password: string, salt: Uint8Array, iter: number): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations: iter },\n key,\n 256,\n );\n return `${iter}:${toB64(salt)}:${toB64(new Uint8Array(bits))}`;\n}\n\nasync function verifyPassword(password: string, stored: string): Promise {\n const [iterS, saltB64, hashB64] = stored.split(\":\");\n try {\n const calc = await hashPassword(password, fromB64(saltB64), Number(iterS));\n return calc === stored;\n } catch {\n return false;\n }\n}\n\n// ------------------------------------------------------------- sessions\n\nasync function touch(username: string): Promise {\n await sqlite.execute(\"UPDATE users SET last_seen = ? WHERE username = ?\", [\n Date.now(),\n username,\n ]);\n}\n\nexport async function currentUser(token: string | null): Promise {\n if (!token) return null;\n const r = await sqlite.execute(\n \"SELECT username FROM sessions WHERE token = ?\",\n [token],\n );\n const row = r.rows[0] as { username?: string } | undefined;\n if (!row?.username) return null;\n await touch(row.username);\n return row.username;\n}\n\nasync function createSession(username: string): Promise {\n const token = uid();\n await sqlite.execute(\n \"INSERT INTO sessions (token, username, created_at) VALUES (?,?,?)\",\n [token, username, Date.now()],\n );\n return token;\n}\n\n// ------------------------------------------------------------- auth API\n\nexport async function signup(data: { username: string; email: string; password: string }) {\n const username = (data.username ?? \"\").trim().toLowerCase();\n const email = (data.email ?? \"\").trim().toLowerCase();\n if (!/^[a-z0-9_]{3,20}$/.test(username)) {\n return { error: \"Username: 3-20 caratteri, solo lettere/numeri/underscore.\" };\n }\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) return { error: \"Email non valida.\" };\n if ((data.password ?? \"\").length < 6) return { error: \"Password di almeno 6 caratteri.\" };\n\n const exists = await sqlite.execute(\n \"SELECT 1 FROM users WHERE username = ? OR email = ?\",\n [username, email],\n );\n if (exists.rows.length) return { error: \"Username o email già registrati.\" };\n\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await hashPassword(data.password, salt, 100_000);\n await sqlite.execute(\n \"INSERT INTO users (username, email, password, created_at) VALUES (?,?,?,?)\",\n [username, email, hash, Date.now()],\n );\n const token = await createSession(username);\n return { ok: true, user: { username }, token };\n}\n\nexport async function login(data: { email: string; password: string }) {\n const email = (data.email ?? \"\").trim().toLowerCase();\n const r = await sqlite.execute(\"SELECT * FROM users WHERE email = ?\", [email]);\n const row = r.rows[0] as { username: string; password: string } | undefined;\n if (!row) return { error: \"Nessun account con questa email.\" };\n if (!(await verifyPassword(data.password, row.password))) {\n return { error: \"Password errata.\" };\n }\n const token = await createSession(row.username);\n return { ok: true, user: { username: row.username }, token };\n}\n\nexport async function logout(token: string | null): Promise {\n if (!token) return;\n await sqlite.execute(\"DELETE FROM sessions WHERE token = ?\", [token]);\n}\n\nexport async function userInfo(username: string) {\n return { username, online: await isOnline(username) };\n}\n\nasync function isOnline(username: string): Promise {\n const r = await sqlite.execute(\"SELECT last_seen FROM users WHERE username = ?\", [username]);\n const row = r.rows[0] as { last_seen?: number } | undefined;\n return !!row?.last_seen && Date.now() - row.last_seen < 60_000;\n}\n\n// ------------------------------------------------------------- friends\n\nexport async function addFriend(username: string, identifier: string): Promise<{ error?: string }> {\n let target = (identifier ?? \"\").trim().toLowerCase();\n if (target.includes(\"@\")) {\n const r = await sqlite.execute(\"SELECT username FROM users WHERE email = ?\", [target]);\n const row = r.rows[0] as { username?: string } | undefined;\n if (!row?.username) return { error: \"Nessun utente con questa email.\" };\n target = row.username;\n }\n if (target === username) return { error: \"Non puoi aggiungere te stesso.\" };\n if (!/^[a-z0-9_]{3,20}$/.test(target)) return { error: \"Utente non trovato.\" };\n // ensure the friend exists\n const ex = await sqlite.execute(\"SELECT 1 FROM users WHERE username = ?\", [target]);\n if (!ex.rows.length) return { error: \"Utente non trovato.\" };\n\n const a = username < target ? username : target;\n const b = username < target ? target : username;\n await sqlite.execute(\n \"INSERT OR IGNORE INTO friends (user_a, user_b) VALUES (?,?)\",\n [a, b],\n );\n return {};\n}\n\nexport async function removeFriend(username: string, friend: string): Promise {\n const a = username < friend ? username : friend;\n const b = username < friend ? friend : username;\n await sqlite.execute(\"DELETE FROM friends WHERE user_a = ? AND user_b = ?\", [a, b]);\n}\n\nexport async function listFriends(username: string) {\n const r = await sqlite.execute(\n \"SELECT user_a, user_b FROM friends WHERE user_a = ? OR user_b = ?\",\n [username, username],\n );\n const out: { username: string; online: boolean }[] = [];\n for (const row of r.rows as { user_a: string; user_b: string }[]) {\n const other = row.user_a === username ? row.user_b : row.user_a;\n out.push({ username: other, online: await isOnline(other) });\n }\n out.sort((x, y) => (x.username < y.username ? -1 : 1));\n return out;\n}\n\n// ------------------------------------------------------------- DM chat\n\nexport async function sendMessage(\n from: string,\n to: string,\n text: string,\n): Promise {\n const clean = (text ?? \"\").trim();\n if (!clean) return null;\n const a = from < to ? from : to;\n const b = from < to ? to : from;\n const res = await sqlite.execute(\n \"INSERT INTO messages (user_a, user_b, sender, text, created_at) VALUES (?,?,?,?,?)\",\n [a, b, from, clean.slice(0, 500), Date.now()],\n );\n return { id: Number(res.lastInsertRowid ?? 0), sender: from, text: clean };\n}\n\nexport async function getMessages(username: string, friend: string, since: number) {\n const a = username < friend ? username : friend;\n const b = username < friend ? friend : username;\n const r = await sqlite.execute(\n \"SELECT id, sender, text FROM messages WHERE user_a = ? AND user_b = ? AND id > ? ORDER BY id ASC LIMIT 200\",\n [a, b, since],\n );\n return (r.rows as { id: number; sender: string; text: string }[]).map((m) => ({\n id: m.id,\n sender: m.sender,\n me: m.sender === username,\n text: m.text,\n }));\n}\n\n// ------------------------------------------------------------- notifications\n\nexport async function notifyRoomInvites(\n hostUsername: string,\n roomId: string,\n): Promise {\n const friends = (await listFriends(hostUsername)).map((f) => f.username);\n for (const friend of friends) {\n await sqlite.execute(\n \"INSERT INTO notifications (username, type, data, created_at) VALUES (?,?,?,?)\",\n [\n friend,\n \"room_invite\",\n JSON.stringify({ from: hostUsername, roomId }),\n Date.now(),\n ],\n );\n }\n}\n\nexport async function getNotifications(username: string, since: number) {\n const r = await sqlite.execute(\n \"SELECT id, type, data FROM notifications WHERE username = ? AND id > ? ORDER BY id ASC LIMIT 50\",\n [username, since],\n );\n return (r.rows as { id: number; type: string; data: string }[]).map((n) => ({\n id: n.id,\n type: n.type,\n data: JSON.parse(n.data),\n }));\n}\n\nexport async function markAccept(username: string, notifId: number): Promise<{ roomId?: string }> {\n const r = await sqlite.execute(\n \"SELECT data FROM notifications WHERE id = ? AND username = ?\",\n [notifId, username],\n );\n const row = r.rows[0] as { data?: string } | undefined;\n await sqlite.execute(\"UPDATE notifications SET read_ = 1 WHERE id = ?\", [notifId]);\n return row?.data ? JSON.parse(row.data) : {};\n}\n","deleted",false,"label",[47,24],"lib","f7417c8d-2e35-43cf-b2d5-043eaf93137e",["D",1787477491994],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Chaos Diner RPG – AI waiter, food fights & survival multiplayer","imageUrl","userId","86c0904a-df90-4b28-8be9-0d0cd34688de","pinnedFileId","01a02df6-016f-774c-911b-10e7600604d6","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a02515-3428-7129-a58d-ee30dee1111b","tursoName","f7417c8d2e3543cfb2d5043eaf93137e","tursoHostname","f7417c8d2e3543cfb2d5043eaf93137e-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789476648181],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_109":105},"org",{"_9":10,"_102":103,"_104":105,"_58":59,"_106":107,"_108":44},"branch",{"_37":92,"_11":93,"_22":30,"_94":48,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":12,"_101":10},"isOwned",48,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","BCG Collaborazioni","avatar","https://lh3.googleusercontent.com/a/ACg8ocK88V05YV8HsO4yAaG3hTsa_rYvYnQ7JithXHAoBkrpvT9HmN8=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_85":-5,"_143":144,"_145":146,"_147":148,"_149":44,"_150":44,"_151":44,"_152":34,"_153":-5,"_154":-7,"_155":-7,"_156":66,"_157":44,"_158":44,"_159":-5,"_160":44,"_161":44,"_162":44,"_163":-5},"ENV",{"_114":115,"_116":117,"_118":93,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140,"_141":142},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]