[{"_1":2,"_181":-5,"_182":-5},"loaderData",{"_3":4,"_93":94},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","1ed3b00b191d67ef967325d666dac7a18ce9a124","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":20,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":20,"_92":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":20,"_19":20,"_84":74,"_85":86,"_87":74,"_88":47,"_89":20,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_95":96,"_97":98,"_99":100,"_101":102,"_158":159,"_178":179,"_180":-5},"handle","c15r","name","sync","path","auth.ts","project",{"_103":104,"_97":98,"_105":106,"_107":-5,"_108":20,"_109":110,"_111":112,"_113":-5,"_12":114,"_115":-5,"_116":20,"_117":-5,"_118":-5,"_119":120,"_14":121,"_122":123,"_124":125,"_126":-5,"_127":128,"_129":128,"_130":131,"_132":131,"_133":131,"_134":128,"_135":128,"_23":136,"_139":140,"_144":145,"_157":20},"id","93e19588-0ebb-11f1-a6cd-42dde27851f2","createdAt",["D",1771633422787],"deletedAt","legacyEnvVars","privacy","public","description","Agent collaboration layer https://sync.parc.land","imageUrl","21f2e37e-8066-4730-9dc7-d27cf8d3c9f3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"0630d977-f678-453e-926c-52043293f59f","tursoName","93e195880ebb11f1a6cd42dde27851f2","tursoHostname","93e195880ebb11f1a6cd42dde27851f2-val-town.aws-us-east-2.turso.io","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_137":138},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yb2RJNlc1czZ1NlpZRmoxdGJ2eFVNNVhmeTYifQ","org",{"_95":96,"_141":138,"_12":114,"_142":143},"avatar","tier","pro","branch",{"_146":147,"_97":45,"_103":148,"_149":104,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":98,"_156":96},"version",639,"93e21602-0ebb-11f1-a6cd-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_103":160,"_97":100,"_161":162,"_163":-5,"_164":148,"_165":166,"_167":168,"_105":169,"_146":170,"_171":172,"_173":174,"_175":20,"_176":-5,"_99":177},"1b9125f0-2075-11f1-8859-42dde27851f2","fileId","647487ae-122d-11f1-bb2b-42dde27851f2","parentId","branchId","branchVersion",612,"latest",true,["D",1773582277011],15,"fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { json, rows2objects } from \"./utils.ts\";\nimport {\n parseScope, matchRoom, roleToLevel, minLevel, canWrite as scopeCanWrite,\n canAdmin as scopeCanAdmin, type ScopeLevel,\n} from \"./mcp/scope.ts\";\n\n/**\n * Auth module — unified auth model (v7 Phase 1).\n *\n * Supports BOTH legacy tokens (room_, view_, as_) and unified tokens (tok_).\n * Legacy tokens resolve through rooms/agents tables (unchanged).\n * Unified tokens resolve through the `tokens` table + `smcp_user_rooms`.\n *\n * AuthResult is backward-compatible: existing checks on kind/grants continue to work.\n * New fields (userId, role) are available for new code.\n */\n\n// ============ Token generation and hashing ============\n\nexport async function hashToken(token: string): Promise {\n const data = new TextEncoder().encode(token);\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\n return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** SHA-256 as base64url (used by mcp/db.ts for tokens table). */\nexport async function hashTokenB64(token: string): Promise {\n const data = new TextEncoder().encode(token);\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\n const bytes = new Uint8Array(hash);\n return btoa(String.fromCharCode(...bytes))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\nexport function generateToken(prefix: \"room\" | \"view\" | \"as\" = \"as\"): string {\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n return `${prefix}_` + Array.from(bytes).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n// ============ Auth resolution ============\n\nexport interface AuthResult {\n authenticated: boolean;\n kind: \"room\" | \"view\" | \"agent\" | null;\n agentId: string | null;\n roomId: string | null;\n grants: string[]; // scopes this identity can direct-write\n\n // ── v7 unified auth fields (null for legacy tokens) ──\n userId?: string | null;\n tokenId?: string | null;\n role?: ScopeLevel | null;\n}\n\nconst UNAUTH: AuthResult = { authenticated: false, kind: null, agentId: null, roomId: null, grants: [] };\n\n/**\n * Resolve auth from request headers. Returns AuthResult or a Response (error).\n */\nexport async function resolveAuth(req: Request, roomId: string): Promise {\n const header = req.headers.get(\"Authorization\");\n if (!header || !header.startsWith(\"Bearer \")) {\n return UNAUTH;\n }\n return resolveAuthFromToken(header.slice(7), roomId);\n}\n\n/**\n * Resolve auth from a raw token string (no HTTP request needed).\n * Handles both legacy tokens (room_, view_, as_) and unified tokens (tok_).\n */\nexport async function resolveAuthFromToken(token: string, roomId: string): Promise {\n // ── Unified token path (tok_ prefix) ──\n if (token.startsWith(\"tok_\") || token.startsWith(\"smcp_at_\")) {\n return resolveUnifiedToken(token, roomId);\n }\n\n // ── Legacy paths (unchanged) ──\n const hash = await hashToken(token);\n\n // Check room token\n if (token.startsWith(\"room_\")) {\n const roomResult = await sqlite.execute({\n sql: `SELECT id FROM rooms WHERE id = ? AND token_hash = ?`,\n args: [roomId, hash],\n });\n if (roomResult.rows.length > 0) {\n return { authenticated: true, kind: \"room\", agentId: null, roomId, grants: [\"*\"] };\n }\n return json({ error: \"invalid_token\", message: \"room token does not match\" }, 401);\n }\n\n // Check view token\n if (token.startsWith(\"view_\")) {\n const roomResult = await sqlite.execute({\n sql: `SELECT id FROM rooms WHERE id = ? AND view_token_hash = ?`,\n args: [roomId, hash],\n });\n if (roomResult.rows.length > 0) {\n return { authenticated: true, kind: \"view\", agentId: null, roomId, grants: [] };\n }\n return json({ error: \"invalid_token\", message: \"view token does not match\" }, 401);\n }\n\n // Check agent token (as_ or any unknown prefix) — v8: tokens table\n const agentResult = await sqlite.execute({\n sql: `SELECT agent_id, scope, room_id FROM tokens WHERE token_hash = ? AND room_id = ? AND revoked = 0`,\n args: [hash, roomId],\n });\n if (agentResult.rows.length === 0) {\n return json({ error: \"invalid_token\", message: \"bearer token does not match any agent in this room\" }, 401);\n }\n const agentId = agentResult.rows[0][0] as string;\n // Derive grants from scope + agent_id\n let grants: string[] = [agentId];\n // Legacy compatibility: check if _agents scope has explicit grants\n try {\n const scopeResult = await sqlite.execute({\n sql: `SELECT value FROM state WHERE room_id = ? AND scope = '_agents' AND key = ?`,\n args: [roomId, agentId],\n });\n if (scopeResult.rows.length > 0) {\n const def = JSON.parse(scopeResult.rows[0][0] as string);\n if (Array.isArray(def.grants) && def.grants.length > 0) {\n grants = [agentId, ...def.grants.filter((g: string) => g !== agentId)];\n }\n }\n } catch {}\n\n return { authenticated: true, kind: \"agent\", agentId, roomId, grants };\n}\n\n// ============ Unified token resolution (v7) ============\n\n/**\n * Resolve a unified token (tok_ or smcp_at_) against the tokens table.\n *\n * Flow: token → tokens table → user_rooms → scope intersection → embodiment check.\n * Returns backward-compatible AuthResult with v7 extensions.\n */\nasync function resolveUnifiedToken(token: string, roomId: string): Promise {\n // Hash with the same algorithm mcp/db.ts uses (base64url SHA-256)\n const hash = await hashTokenB64(token);\n\n // 1. Token lookup\n const tokenResult = await sqlite.execute({\n sql: `SELECT id, minted_by, scope, room_id, agent_id\n FROM tokens\n WHERE token_hash = ? AND revoked = 0\n AND (expires_at IS NULL OR expires_at > datetime('now'))`,\n args: [hash],\n });\n\n // Also check legacy smcp_access_tokens for smcp_at_ backward compat\n if (tokenResult.rows.length === 0 && token.startsWith(\"smcp_at_\")) {\n return resolveSmcpAccessToken(token, roomId, hash);\n }\n\n if (tokenResult.rows.length === 0) {\n return json({ error: \"invalid_token\", message: \"token not found, expired, or revoked\" }, 401);\n }\n\n const tok = {\n id: tokenResult.rows[0][0] as string,\n mintedBy: tokenResult.rows[0][1] as string,\n scope: tokenResult.rows[0][2] as string,\n roomId: tokenResult.rows[0][3] as string | null,\n agentId: tokenResult.rows[0][4] as string | null,\n };\n\n // 2. Scope check: does this token grant access to the requested room?\n const parsed = parseScope(tok.scope);\n const roomMatch = matchRoom(parsed, roomId);\n if (!roomMatch) {\n // Build stateless elevation URL for the agent to present to the user\n const elevateUrl = `https://sync.parc.land/auth/elevate?token_id=${encodeURIComponent(tok.id)}&room=${encodeURIComponent(roomId)}`;\n return json({\n error: \"scope_denied\",\n message: `Token scope does not include room \"${roomId}\"`,\n room: roomId,\n elevate: elevateUrl,\n hint: \"Present the elevate URL to the user to request access, then retry.\",\n }, 403);\n }\n\n // 3. User's actual room role\n const userRoomResult = await sqlite.execute({\n sql: `SELECT access FROM smcp_user_rooms WHERE user_id = ? AND room_id = ?`,\n args: [tok.mintedBy, roomId],\n });\n\n let userRole: ScopeLevel = \"read\"; // default if no user_rooms entry\n if (userRoomResult.rows.length > 0) {\n userRole = roleToLevel(userRoomResult.rows[0][0] as string);\n }\n\n // 4. Intersect scope with user's actual role\n const effectiveLevel = minLevel(roomMatch.level, userRole);\n\n // 5. Agent resolution\n let agentId = roomMatch.agentId ?? tok.agentId ?? null;\n\n // If no agent from scope, check embodiment\n if (!agentId) {\n const embodimentResult = await sqlite.execute({\n sql: `SELECT agent_id FROM smcp_embodiments\n WHERE session_hash = ? AND room_id = ?`,\n args: [hash, roomId],\n });\n if (embodimentResult.rows.length > 0) {\n agentId = embodimentResult.rows[0][0] as string;\n }\n }\n\n // 6. Map to backward-compatible AuthResult\n const isAdmin = scopeCanAdmin(effectiveLevel);\n const isWrite = scopeCanWrite(effectiveLevel);\n const isReadOnly = !isWrite;\n\n let kind: \"room\" | \"view\" | \"agent\";\n let grants: string[];\n\n if (isAdmin) {\n kind = \"room\";\n grants = [\"*\"];\n } else if (isReadOnly) {\n kind = \"view\";\n grants = [];\n } else if (agentId) {\n kind = \"agent\";\n grants = [agentId, \"_shared\"];\n } else {\n // Write-capable but no agent — treat as view until embodied\n kind = \"view\";\n grants = [];\n }\n\n return {\n authenticated: true,\n kind,\n agentId,\n roomId,\n grants,\n // v7 extensions\n userId: tok.mintedBy,\n tokenId: tok.id,\n role: effectiveLevel,\n };\n}\n\n/**\n * Backward-compat fallback: resolve smcp_at_ tokens from old smcp_access_tokens table.\n * This path exists so existing MCP sessions don't break during Phase 1.\n */\nasync function resolveSmcpAccessToken(token: string, roomId: string, _hash: string): Promise {\n // Delegate to the old MCP path — return as view-level (observe) for safety\n // The MCP handler will resolve embodiment separately\n const result = await sqlite.execute({\n sql: `SELECT user_id FROM smcp_access_tokens WHERE token = ? AND expires_at > datetime('now')`,\n args: [token],\n });\n if (result.rows.length === 0) {\n return json({ error: \"invalid_token\", message: \"token not found or expired\" }, 401);\n }\n const userId = result.rows[0][0] as string;\n\n // Check user_rooms\n const userRoomResult = await sqlite.execute({\n sql: `SELECT access FROM smcp_user_rooms WHERE user_id = ? AND room_id = ?`,\n args: [userId, roomId],\n });\n if (userRoomResult.rows.length === 0) {\n return { authenticated: true, kind: \"view\", agentId: null, roomId, grants: [], userId };\n }\n const role = userRoomResult.rows[0][0] as string;\n const level = roleToLevel(role);\n\n if (scopeCanAdmin(level)) {\n return { authenticated: true, kind: \"room\", agentId: null, roomId, grants: [\"*\"], userId };\n }\n return { authenticated: true, kind: \"view\", agentId: null, roomId, grants: [], userId };\n}\n\n// ============ Authorization checks ============\n\nexport function checkScopeAuthority(auth: AuthResult, scope: string): Response | null {\n if (!auth.authenticated) {\n return json({ error: \"authentication_required\", message: \"include Authorization: Bearer \" }, 401);\n }\n if (auth.grants.includes(\"*\")) return null;\n if (auth.grants.includes(scope)) return null;\n return json({\n error: \"scope_denied\",\n message: `no authority over scope \"${scope}\"`,\n grants: auth.grants,\n scope,\n }, 403);\n}\n\nexport function assertIdentity(auth: AuthResult, claimedAgent: string | null): Response | null {\n if (!auth.authenticated) return null;\n if (!claimedAgent) return null;\n if (auth.kind === \"room\") return null;\n if (auth.agentId === claimedAgent) return null;\n return json({\n error: \"identity_mismatch\",\n message: `token belongs to \"${auth.agentId}\" but request claims \"${claimedAgent}\"`,\n authenticated_as: auth.agentId,\n claimed: claimedAgent,\n }, 403);\n}\n\nexport function requireAuth(auth: AuthResult): Response | null {\n if (!auth.authenticated) {\n return json({ error: \"authentication_required\", message: \"include Authorization: Bearer \" }, 401);\n }\n return null;\n}\n\nexport function requireRoomToken(auth: AuthResult): Response | null {\n if (!auth.authenticated) {\n return json({ error: \"authentication_required\", message: \"room token required\" }, 401);\n }\n if (auth.kind !== \"room\" && !auth.grants.includes(\"*\")) {\n return json({ error: \"room_token_required\", message: \"this operation requires a room token or admin grants\" }, 403);\n }\n return null;\n}\n\nexport function requireWriteAuth(auth: AuthResult): Response | null {\n if (!auth.authenticated) {\n return json({ error: \"authentication_required\", message: \"include Authorization: Bearer \" }, 401);\n }\n if (auth.kind === \"view\") {\n return json({ error: \"read_only_token\", message: \"view tokens cannot perform mutations\" }, 403);\n }\n return null;\n}\n\nexport function hasFullReadAccess(auth: AuthResult): boolean {\n return auth.grants.includes(\"*\") || auth.kind === \"view\";\n}\n\n// ============ Auto-heartbeat ============\n\nexport function touchAgent(roomId: string, agentId: string | null | undefined): void {\n if (!agentId) return;\n const now = new Date().toISOString();\n // Update token liveness (applies to all token types)\n sqlite.execute({\n sql: `UPDATE tokens SET last_used_at = ? WHERE room_id = ? AND agent_id = ? AND revoked = 0`,\n args: [now, roomId, agentId],\n }).catch(() => {});\n // Update _agents scope heartbeat\n sqlite.execute({\n sql: `UPDATE state SET\n value = json_set(value, '$.last_heartbeat', ?),\n revision = revision + 1, updated_at = ?\n WHERE room_id = ? AND scope = '_agents' AND key = ?`,\n args: [now, now, roomId, agentId],\n }).catch(() => {});\n}\n\n// ============ Direct agent auth (no token required) ============\n\nexport async function resolveAgentAuth(\n roomId: string, agentId: string,\n): Promise {\n // v8: Read grants from _agents scope\n const result = await sqlite.execute({\n sql: `SELECT value FROM state WHERE room_id = ? AND scope = '_agents' AND key = ?`,\n args: [roomId, agentId],\n });\n if (result.rows.length === 0) return null;\n let grants: string[] = [agentId];\n try {\n const def = JSON.parse(result.rows[0][0] as string);\n if (Array.isArray(def.grants) && def.grants.length > 0) {\n grants = [agentId, ...def.grants.filter((g: string) => g !== agentId)];\n }\n } catch {}\n return {\n authenticated: true,\n kind: \"agent\",\n agentId,\n roomId,\n grants,\n };\n}\n","deleted","label",[100],"permalink","https://www.val.town/x/c15r/sync/code/auth.ts","extension","actionData","errors"]