Error

${escapeHtml(message)}

`;\n}\n\nfunction escapeHtml(str: string): string {\n return str.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\n// ─── Authorization Endpoint ──────────────────────────────────────\n\nexport async function handleAuthorize(req: Request): Promise {\n const url = new URL(req.url);\n const clientId = url.searchParams.get(\"client_id\");\n const redirectUri = url.searchParams.get(\"redirect_uri\");\n const responseType = url.searchParams.get(\"response_type\");\n const codeChallenge = url.searchParams.get(\"code_challenge\");\n const codeChallengeMethod = url.searchParams.get(\"code_challenge_method\") ??\n \"S256\";\n const scope = url.searchParams.get(\"scope\") ?? \"sync:rooms\";\n const state = url.searchParams.get(\"state\") ?? \"\";\n const resource = url.searchParams.get(\"resource\") ?? \"\";\n\n if (!clientId || !redirectUri || responseType !== \"code\" || !codeChallenge) {\n return html(\n errorPage(\n \"Missing required parameters (client_id, redirect_uri, response_type=code, code_challenge)\",\n ),\n 400,\n );\n }\n\n const client = await db.getOAuthClient(clientId);\n if (!client) {\n return html(errorPage(\"Unknown client_id\"), 400);\n }\n if (!client.redirectUris.includes(redirectUri)) {\n return html(errorPage(\"redirect_uri not registered for this client\"), 400);\n }\n\n const origin = getOrigin(req);\n\n const oauthParams = {\n clientId,\n clientName: client.clientName ?? \"MCP Client\",\n redirectUri,\n codeChallenge,\n codeChallengeMethod,\n scope,\n state,\n resource,\n };\n\n return renderPage({\n element: ,\n entry: \"https://esm.town/v/c15r/sync/frontend/pages/authorize/client.tsx\",\n props: { origin, params: oauthParams },\n title: \"Sign in — sync·mcp\",\n });\n}\n\n// ─── Management Page ─────────────────────────────────────────────\n\nexport function handleManagePage(req: Request): Response {\n const origin = getOrigin(req);\n const dashboardOrigin = getDashboardOrigin(req);\n return renderPage({\n element: ,\n entry: \"https://esm.town/v/c15r/sync/frontend/pages/manage/client.tsx\",\n props: { origin, dashboardOrigin },\n title: \"Manage — sync·mcp\",\n });\n}\n\nexport async function handleManageApi(req: Request): Promise {\n const sessionId = req.headers.get(\"x-session-id\");\n if (!sessionId) return json({ error: \"Missing X-Session-Id header\" }, 401);\n\n const session = await db.validateSession(sessionId);\n if (!session) {\n return json(\n { error: \"Invalid or expired session. Please sign in again.\" },\n 401,\n );\n }\n if (session.scope === \"recovery\") {\n return json(\n { error: \"Recovery sessions cannot access management API\" },\n 403,\n );\n }\n\n const userId = session.userId;\n const url = new URL(req.url);\n const path = url.pathname.replace(\"/manage/api\", \"\");\n\n // GET /manage/api/me — user info\n if (req.method === \"GET\" && path === \"/me\") {\n const user = await db.getUserById(userId);\n const creds = await db.getCredentialsByUserId(userId);\n return json({\n user: user\n ? { id: user.id, username: user.username, created_at: user.created_at }\n : null,\n passkeys: creds.map((c) => ({\n id: c.id.substring(0, 16) + \"...\",\n device_type: c.deviceType,\n backed_up: c.backedUp,\n })),\n });\n }\n\n // GET /manage/api/rooms — user's rooms with agents and roles\n if (req.method === \"GET\" && path === \"/rooms\") {\n const userRooms = await db.listUserRooms(userId);\n const roomsWithDetail = [];\n for (const ur of userRooms) {\n const agentsRes = await sqlite.execute({\n sql: `SELECT id, name, role, status, last_heartbeat FROM agents WHERE room_id = ? ORDER BY joined_at`,\n args: [ur.roomId],\n });\n const agents = agentsRes.rows.map((r: any[]) => ({\n id: r[0], name: r[1], role: r[2], status: r[3], last_heartbeat: r[4],\n }));\n const roles = await fetchRoomRoles(ur.roomId);\n roomsWithDetail.push({\n room_id: ur.roomId,\n access: ur.access,\n label: ur.label,\n is_default: ur.isDefault,\n agents,\n roles,\n });\n }\n return json({ rooms: roomsWithDetail });\n }\n\n // POST /manage/api/rooms — create a new room\n if (req.method === \"POST\" && path === \"/rooms\") {\n const body = await req.json();\n const roomId = body.id ?? crypto.randomUUID();\n const label = body.label ?? `Room: ${roomId}`;\n // Check if room already exists\n const existing = await sqlite.execute({\n sql: `SELECT id FROM rooms WHERE id = ?`, args: [roomId],\n });\n if (existing.rows.length > 0) return json({ error: \"room_exists\", id: roomId }, 409);\n // Create room\n const { generateToken, hashToken } = await import(\"../auth.ts\");\n const token = generateToken(\"room\");\n const hash = await hashToken(token);\n const viewToken = generateToken(\"view\");\n const viewHash = await hashToken(viewToken);\n await sqlite.execute({\n sql: `INSERT INTO rooms (id, meta, token_hash, view_token_hash) VALUES (?, ?, ?, ?)`,\n args: [roomId, JSON.stringify(body.meta ?? {}), hash, viewHash],\n });\n // Link to user as owner\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO smcp_user_rooms (user_id, room_id, access, label)\n VALUES (?, ?, 'owner', ?)`,\n args: [userId, roomId, label],\n });\n return json({ id: roomId, label, access: \"owner\" }, 201);\n }\n\n // POST /manage/api/rooms/:id/invite — invite a user\n if (req.method === \"POST\" && path.match(/^\\/rooms\\/[^/]+\\/invite$/)) {\n const roomId = path.split(\"/\")[2];\n const userRoom = await db.getUserRoom(userId, roomId);\n if (!userRoom || userRoom.access !== \"owner\") {\n return json({ error: \"not_owner\", message: \"Only room owners can invite users\" }, 403);\n }\n const body = await req.json();\n const { username, role } = body;\n if (!username) return json({ error: \"username required\" }, 400);\n const validRoles = [\"owner\", \"collaborator\", \"participant\", \"observer\"];\n const targetRole = role ?? \"participant\";\n if (!validRoles.includes(targetRole)) return json({ error: \"invalid_role\", valid: validRoles }, 400);\n const targetUser = await db.getUserByUsername(username);\n if (!targetUser) return json({ error: \"user_not_found\", message: `No user \"${username}\"` }, 404);\n await db.inviteUserToRoom(targetUser.id, roomId, targetRole, userId, body.label);\n return json({ invited: true, username, room: roomId, role: targetRole });\n }\n\n // DELETE /manage/api/rooms/:id — delete a room (owner only)\n if (req.method === \"DELETE\" && path.match(/^\\/rooms\\/[^/]+$/)) {\n const roomId = path.split(\"/\")[2];\n const userRoom = await db.getUserRoom(userId, roomId);\n if (!userRoom || userRoom.access !== \"owner\") {\n return json({ error: \"not_owner\", message: \"Only room owners can delete rooms\" }, 403);\n }\n // Delete room data (cascade: agents, state, actions, views, messages, audit)\n await sqlite.batch([\n { sql: `DELETE FROM state WHERE room_id = ?`, args: [roomId] },\n { sql: `DELETE FROM actions WHERE room_id = ?`, args: [roomId] },\n { sql: `DELETE FROM views WHERE room_id = ?`, args: [roomId] },\n { sql: `DELETE FROM agents WHERE room_id = ?`, args: [roomId] },\n { sql: `DELETE FROM smcp_user_rooms WHERE room_id = ?`, args: [roomId] },\n { sql: `DELETE FROM rooms WHERE id = ?`, args: [roomId] },\n ]);\n return json({ deleted: true, room: roomId });\n }\n\n // POST /manage/api/room-token — mint a temporary token for dashboard access\n if (req.method === \"POST\" && path === \"/room-token\") {\n const body = await req.json();\n const roomId = body.room_id;\n if (!roomId) return json({ error: \"room_id required\" }, 400);\n\n // Check user has access to this room\n const userRoom = await db.getUserRoom(userId, roomId);\n if (!userRoom) return json({ error: \"no_access\", message: \"You don't have access to this room\" }, 403);\n\n // Mint a short-lived token scoped to this room\n const level = userRoom.access === \"owner\" ? \"\" : \":read\";\n const result = await db.mintToken({\n userId,\n scope: `rooms:${roomId}${level}`,\n label: `Dashboard: ${roomId}`,\n roomId,\n expiresInSec: 3600, // 1 hour\n });\n\n return json({\n token: result.token,\n room_id: roomId,\n access: userRoom.access,\n expires_at: result.expiresAt,\n });\n }\n\n // ── Unified tokens (v7) ──\n\n // GET /manage/api/tokens — list unified tokens\n if (req.method === \"GET\" && path === \"/tokens\") {\n const tokens = await db.listUserTokens(userId);\n return json({\n tokens: tokens.map(t => ({\n id: t.id,\n scope: t.scope,\n label: t.label,\n room_id: t.roomId,\n agent_id: t.agentId,\n client_id: t.clientId,\n revoked: t.revoked,\n expires_at: t.expiresAt,\n created_at: t.createdAt,\n })),\n });\n }\n\n // DELETE /manage/api/tokens/:id — revoke a unified token\n if (req.method === \"DELETE\" && path.startsWith(\"/tokens/\")) {\n const tokenId = path.split(\"/\")[2];\n if (!tokenId) return json({ error: \"Missing token ID\" }, 400);\n const ok = await db.revokeToken(tokenId, userId);\n if (!ok) return json({ error: \"Token not found or not owned by you\" }, 404);\n return json({ revoked: true, id: tokenId });\n }\n\n // POST /manage/api/recovery — generate recovery token\n if (req.method === \"POST\" && path === \"/recovery\") {\n const result = await db.createRecoveryToken(userId);\n if (\"error\" in result) return json({ error: result.error }, 400);\n return json({\n token: result.token,\n expires_at: result.expiresAt,\n warning: \"Store this token safely. It will not be shown again.\",\n }, 201);\n }\n\n // GET /manage/api/recovery — list recovery tokens (metadata only)\n if (req.method === \"GET\" && path === \"/recovery\") {\n const tokens = await db.listRecoveryTokens(userId);\n return json({ tokens });\n }\n\n // DELETE /manage/api/recovery/:id — revoke a recovery token\n if (req.method === \"DELETE\" && path.startsWith(\"/recovery/\")) {\n const tokenId = path.split(\"/\")[2];\n if (!tokenId) return json({ error: \"Missing token ID\" }, 400);\n await db.revokeRecoveryToken(userId, tokenId);\n return json({ deleted: true, id: tokenId });\n }\n\n return json({ error: \"Not found\" }, 404);\n}\n\n// ─── Recovery: passkey re-registration ───────────────────────────\n\nexport function handleRecoverPage(req: Request): Response {\n const origin = getOrigin(req);\n return renderPage({\n element: ,\n entry: \"https://esm.town/v/c15r/sync/frontend/pages/recover/client.tsx\",\n props: { origin },\n title: \"Recover — sync·mcp\",\n });\n}\n\nexport async function handleRecoverValidate(req: Request): Promise {\n const { token } = await req.json();\n if (!token) return json({ error: \"Recovery token required\" }, 400);\n\n const result = await db.validateRecoveryToken(token);\n if (!result) {\n return json(\n { error: \"Invalid, expired, or already-used recovery token\" },\n 400,\n );\n }\n\n const sessionId = await db.createSession(result.userId, \"recovery\");\n\n return json({ verified: true, sessionId, tokenId: result.tokenId });\n}\n\nexport async function handleRecoverRegisterOptions(\n req: Request,\n): Promise {\n const { sessionId } = await req.json();\n if (!sessionId) return json({ error: \"Session required\" }, 400);\n\n const session = await db.validateSession(sessionId);\n if (!session || session.scope !== \"recovery\") {\n return json({ error: \"Invalid or expired recovery session\" }, 400);\n }\n\n const user = await db.getUserById(session.userId);\n if (!user) return json({ error: \"User not found\" }, 400);\n\n const rpId = getRpId(req);\n const existingCreds = await db.getCredentialsByUserId(user.id, rpId);\n\n const options = await generateRegistrationOptions({\n rpName: \"sync-mcp\",\n rpID: rpId,\n userName: user.username,\n userID: new TextEncoder().encode(user.id),\n attestationType: \"none\",\n authenticatorSelection: {\n residentKey: \"preferred\",\n userVerification: \"preferred\",\n },\n excludeCredentials: existingCreds.map((c) => ({\n id: c.id,\n transports: c.transports as AuthenticatorTransportFuture[] | undefined,\n })),\n });\n\n const challengeId = db.generateId();\n await db.saveChallenge(\n challengeId,\n options.challenge,\n \"recovery-registration\",\n user.id,\n );\n\n return json({ options, challengeId, username: user.username });\n}\n\nexport async function handleRecoverRegisterVerify(\n req: Request,\n): Promise {\n const { challengeId, sessionId, tokenId, response } = await req.json();\n\n const session = await db.validateSession(sessionId);\n if (!session || session.scope !== \"recovery\") {\n return json({ error: \"Invalid or expired recovery session\" }, 400);\n }\n\n const challenge = await db.getChallenge(challengeId);\n if (!challenge || challenge.type !== \"recovery-registration\") {\n return json({ error: \"Invalid or expired challenge\" }, 400);\n }\n\n const rpId = getRpId(req);\n const origin = getOrigin(req);\n\n try {\n const verification = await verifyRegistrationResponse({\n response,\n expectedChallenge: challenge.challenge,\n expectedOrigin: origin,\n expectedRPID: rpId,\n });\n\n if (!verification.verified || !verification.registrationInfo) {\n return json({ error: \"Verification failed\" }, 400);\n }\n\n const { credential, credentialDeviceType, credentialBackedUp } =\n verification.registrationInfo;\n\n await db.saveCredential({\n id: credential.id,\n userId: session.userId,\n publicKey: credential.publicKey,\n counter: credential.counter,\n transports: credential.transports as string[],\n deviceType: credentialDeviceType,\n backedUp: credentialBackedUp,\n rpId,\n });\n\n await db.deleteChallenge(challengeId);\n await db.consumeRecoveryToken(tokenId);\n await db.deleteSession(sessionId);\n\n return json({ verified: true, rpId });\n } catch (err) {\n return json(\n { error: `Registration failed: ${(err as Error).message}` },\n 400,\n );\n }\n}\n","deleted","label",[180,161],"mcp","permalink","https://www.val.town/x/c15r/sync/code/mcp/manage.tsx","extension","actionData","errors"]