[{"_1":2,"_181":-5,"_182":-5},"loaderData",{"_3":4,"_93":94},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","1ed3b00b191d67ef967325d666dac7a18ce9a124","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":20,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":20,"_92":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":20,"_19":20,"_84":74,"_85":86,"_87":74,"_88":47,"_89":20,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_95":96,"_97":98,"_99":100,"_101":102,"_158":159,"_178":179,"_180":-5},"handle","c15r","name","sync","path","tokens.ts","project",{"_103":104,"_97":98,"_105":106,"_107":-5,"_108":20,"_109":110,"_111":112,"_113":-5,"_12":114,"_115":-5,"_116":20,"_117":-5,"_118":-5,"_119":120,"_14":121,"_122":123,"_124":125,"_126":-5,"_127":128,"_129":128,"_130":131,"_132":131,"_133":131,"_134":128,"_135":128,"_23":136,"_139":140,"_144":145,"_157":20},"id","93e19588-0ebb-11f1-a6cd-42dde27851f2","createdAt",["D",1771633422787],"deletedAt","legacyEnvVars","privacy","public","description","Agent collaboration layer https://sync.parc.land","imageUrl","21f2e37e-8066-4730-9dc7-d27cf8d3c9f3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"0630d977-f678-453e-926c-52043293f59f","tursoName","93e195880ebb11f1a6cd42dde27851f2","tursoHostname","93e195880ebb11f1a6cd42dde27851f2-val-town.aws-us-east-2.turso.io","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_137":138},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yb2RJNlc1czZ1NlpZRmoxdGJ2eFVNNVhmeTYifQ","org",{"_95":96,"_141":138,"_12":114,"_142":143},"avatar","tier","pro","branch",{"_146":147,"_97":45,"_103":148,"_149":104,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":-5,"_155":98,"_156":96},"version",639,"93e21602-0ebb-11f1-a6cd-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_103":160,"_97":100,"_161":162,"_163":-5,"_164":148,"_165":166,"_167":168,"_105":169,"_146":170,"_171":172,"_173":174,"_175":20,"_176":-5,"_99":177},"e854bd6a-1e70-11f1-9d26-42dde27851f2","fileId","ba200440-1df3-11f1-a2c2-42dde27851f2","parentId","branchId","branchVersion",556,"latest",true,["D",1773360570812],6,"fileType","script","content","/**\n * tokens.ts — Token management HTTP endpoints.\n *\n * POST /tokens — Mint a scoped token (delegation, view, agent-bound)\n * GET /tokens — List your minted tokens\n * DELETE /tokens/:id — Revoke a token\n * PATCH /tokens/:id — Update a token's scope (bounded by caller's scope)\n * POST /tokens/refresh — Refresh a token (exchange refresh_token for new access_token)\n *\n * All endpoints require a valid tok_ or smcp_at_ token in Authorization header\n * (except refresh which uses the refresh_token in the body).\n *\n * SECURITY: Minted/patched tokens cannot exceed the calling token's scope.\n * A narrow token cannot mint a wide one (no privilege escalation).\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport * as db from \"./mcp/db.ts\";\nimport { hashTokenB64 } from \"./auth.ts\";\nimport {\n parseScope, serializeScope, matchRoom, roleToLevel, minLevel,\n scopeSubsumes, type ParsedScope,\n} from \"./mcp/scope.ts\";\nimport { json, rows2objects } from \"./utils.ts\";\n\n// ─── Caller resolution ──────────────────────────────────────────\n\ninterface CallerInfo {\n userId: string;\n /** Parsed scope of the calling token. null = unrestricted (legacy smcp_at_ or session). */\n scope: ParsedScope | null;\n}\n\n/**\n * Resolve the calling user + their token's scope from a bearer token.\n * Returns null if unauthenticated.\n */\nasync function resolveCaller(req: Request): Promise {\n const header = req.headers.get(\"Authorization\");\n if (!header?.startsWith(\"Bearer \")) return null;\n const token = header.slice(7);\n\n // Check unified tokens table\n const hash = await hashTokenB64(token);\n const tok = await db.validateTokenByHash(hash);\n if (tok) {\n return { userId: tok.mintedBy, scope: parseScope(tok.scope) };\n }\n\n // Fallback: check smcp_access_tokens for backward compat\n // Legacy tokens have no structured scope — treat as unrestricted\n if (token.startsWith(\"smcp_at_\")) {\n const res = await sqlite.execute({\n sql: `SELECT user_id FROM smcp_access_tokens WHERE token = ? AND expires_at > datetime('now')`,\n args: [token],\n });\n if (res.rows.length > 0) {\n return { userId: res.rows[0][0] as string, scope: null };\n }\n }\n\n return null;\n}\n\n// ─── Shared validation ──────────────────────────────────────────\n\n/**\n * Validate that a requested scope is within bounds:\n * 1. User must have access to all rooms (user_rooms check)\n * 2. New scope must not exceed calling token's scope (subsumption check)\n */\nasync function validateScope(\n userId: string,\n callerScope: ParsedScope | null,\n requestedScope: string,\n): Promise {\n const parsed = parseScope(requestedScope);\n\n // Check 1: user_rooms — user must actually have access to named rooms\n for (const [rId] of parsed.rooms) {\n const userRoom = await sqlite.execute({\n sql: `SELECT access FROM smcp_user_rooms WHERE user_id = ? AND room_id = ?`,\n args: [userId, rId],\n });\n if (userRoom.rows.length === 0) {\n return json({\n error: \"scope_exceeds_access\",\n message: `You don't have access to room \"${rId}\"`,\n room: rId,\n }, 403);\n }\n }\n\n // Check 2: token subsumption — new scope ≤ caller's scope\n if (callerScope) {\n const check = scopeSubsumes(callerScope, parsed);\n if (!check.ok) {\n return json({\n error: \"scope_exceeds_token\",\n message: check.reason,\n hint: \"A token cannot grant more access than it has itself.\",\n }, 403);\n }\n }\n // callerScope === null means legacy/unrestricted — skip subsumption\n\n return null; // all good\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /tokens — Mint a scoped token\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleMintToken(req: Request): Promise {\n const caller = await resolveCaller(req);\n if (!caller) return json({ error: \"authentication_required\" }, 401);\n\n const body = await req.json();\n const scope = body.scope;\n if (!scope || typeof scope !== \"string\") {\n return json({ error: \"scope is required (e.g., 'rooms:my-room:agent:alice')\" }, 400);\n }\n\n const label = body.label ?? null;\n const expiresIn = body.expires_in ?? null;\n const roomId = body.room_id ?? null;\n const agentId = body.agent_id ?? null;\n\n // Validate scope against user access AND calling token\n const scopeError = await validateScope(caller.userId, caller.scope, scope);\n if (scopeError) return scopeError;\n\n // Validate: if agent-bound, the agent must exist\n const parsed = parseScope(scope);\n const agentBound = agentId ?? (() => {\n for (const [, rs] of parsed.rooms) {\n if (rs.agent) return rs.agent;\n }\n return null;\n })();\n if (agentBound && roomId) {\n const agentCheck = await sqlite.execute({\n sql: `SELECT id FROM agents WHERE id = ? AND room_id = ?`,\n args: [agentBound, roomId],\n });\n if (agentCheck.rows.length === 0) {\n return json({\n error: \"agent_not_found\",\n message: `Agent \"${agentBound}\" not found in room \"${roomId}\"`,\n }, 404);\n }\n }\n\n const result = await db.mintToken({\n userId: caller.userId,\n scope,\n label,\n roomId,\n agentId: agentBound,\n expiresInSec: expiresIn ?? undefined,\n withRefresh: !!body.with_refresh,\n });\n\n return json({\n id: result.id,\n token: result.token,\n refresh_token: result.refreshToken ?? undefined,\n scope,\n label,\n room_id: roomId,\n agent_id: agentBound,\n expires_at: result.expiresAt,\n }, 201);\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// GET /tokens — List your minted tokens\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleListTokens(req: Request): Promise {\n const caller = await resolveCaller(req);\n if (!caller) return json({ error: \"authentication_required\" }, 401);\n\n const tokens = await db.listUserTokens(caller.userId);\n\n return json({\n tokens: tokens.map(t => ({\n id: t.id,\n scope: t.scope,\n label: t.label,\n room_id: t.roomId,\n agent_id: t.agentId,\n client_id: t.clientId,\n revoked: t.revoked,\n expires_at: t.expiresAt,\n created_at: t.createdAt,\n })),\n });\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// DELETE /tokens/:id — Revoke a token\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleRevokeToken(req: Request, tokenId: string): Promise {\n const caller = await resolveCaller(req);\n if (!caller) return json({ error: \"authentication_required\" }, 401);\n\n const ok = await db.revokeToken(tokenId, caller.userId);\n if (!ok) return json({ error: \"not_found\", message: \"Token not found or not owned by you\" }, 404);\n\n return json({ revoked: true, id: tokenId });\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// PATCH /tokens/:id — Update a token's scope (bounded by caller's scope)\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleUpdateToken(req: Request, tokenId: string): Promise {\n const caller = await resolveCaller(req);\n if (!caller) return json({ error: \"authentication_required\" }, 401);\n\n const body = await req.json();\n const newScope = body.scope;\n if (!newScope || typeof newScope !== \"string\") {\n return json({ error: \"scope is required\" }, 400);\n }\n\n // Fetch the existing token — must be owned by caller\n const existing = await sqlite.execute({\n sql: `SELECT id, scope, label, minted_by, revoked FROM tokens WHERE id = ? AND minted_by = ?`,\n args: [tokenId, caller.userId],\n });\n if (existing.rows.length === 0) {\n return json({ error: \"not_found\", message: \"Token not found or not owned by you\" }, 404);\n }\n if (existing.rows[0][4] === 1) {\n return json({ error: \"token_revoked\", message: \"Cannot update a revoked token\" }, 409);\n }\n\n const oldScope = existing.rows[0][1] as string;\n\n // Validate new scope against user access AND calling token\n const scopeError = await validateScope(caller.userId, caller.scope, newScope);\n if (scopeError) return scopeError;\n\n // Update the scope\n await sqlite.execute({\n sql: `UPDATE tokens SET scope = ? WHERE id = ?`,\n args: [newScope, tokenId],\n });\n\n // Optionally update label\n if (body.label !== undefined) {\n await sqlite.execute({\n sql: `UPDATE tokens SET label = ? WHERE id = ?`,\n args: [body.label, tokenId],\n });\n }\n\n return json({\n id: tokenId,\n scope: newScope,\n label: body.label ?? existing.rows[0][2],\n previous_scope: oldScope,\n });\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /tokens/refresh — Exchange refresh_token for new access_token\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleRefreshToken(req: Request): Promise {\n let body: Record;\n const contentType = req.headers.get(\"content-type\") ?? \"\";\n if (contentType.includes(\"application/x-www-form-urlencoded\")) {\n const text = await req.text();\n body = Object.fromEntries(new URLSearchParams(text));\n } else {\n body = await req.json();\n }\n\n const refreshToken = body.refresh_token;\n if (!refreshToken) {\n return json({ error: \"invalid_request\", error_description: \"refresh_token required\" }, 400);\n }\n\n const refreshHash = await hashTokenB64(refreshToken);\n const result = await db.refreshUnifiedToken(refreshHash);\n if (!result) {\n return json({ error: \"invalid_grant\", error_description: \"Invalid or expired refresh token\" }, 400);\n }\n\n return json({\n access_token: result.token,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: result.refreshToken,\n });\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /rooms/:id/invite — Invite a user to a room\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleInvite(req: Request, roomId: string, body?: any): Promise {\n const caller = await resolveCaller(req);\n if (!caller) return json({ error: \"authentication_required\" }, 401);\n\n // Check the caller is an owner\n const callerRoom = await sqlite.execute({\n sql: `SELECT access FROM smcp_user_rooms WHERE user_id = ? AND room_id = ?`,\n args: [caller.userId, roomId],\n });\n if (callerRoom.rows.length === 0 || callerRoom.rows[0][0] !== \"owner\") {\n return json({ error: \"not_owner\", message: \"Only room owners can invite users\" }, 403);\n }\n\n if (!body) body = await req.json();\n const { username, role } = body;\n if (!username) return json({ error: \"username is required\" }, 400);\n\n const validRoles = [\"owner\", \"collaborator\", \"participant\", \"observer\"];\n const targetRole = role ?? \"participant\";\n if (!validRoles.includes(targetRole)) {\n return json({ error: \"invalid_role\", valid: validRoles }, 400);\n }\n\n // Look up user by username\n const targetUser = await db.getUserByUsername(username);\n if (!targetUser) {\n return json({ error: \"user_not_found\", message: `No user with username \"${username}\"` }, 404);\n }\n\n await db.inviteUserToRoom(targetUser.id, roomId, targetRole, caller.userId, body.label);\n\n return json({ invited: true, username, room: roomId, role: targetRole });\n}\n\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /rooms/:id/claim — Claim an orphaned room\n// ═══════════════════════════════════════════════════════════════════\n\n/**\n * Claim a room that has no owners in user_rooms. This handles rooms\n * created via the HTTP API before unified auth existed (e.g., cartographers).\n *\n * Rules:\n * - If room has NO user_rooms entries: any authenticated user can claim as owner\n * - If room has owners but you have the room_ token: claim as owner\n * - Otherwise: denied\n */\nexport async function handleClaim(req: Request, roomId: string, body?: any): Promise {\n const caller = await resolveCaller(req);\n if (!caller) return json({ error: \"authentication_required\" }, 401);\n\n // Verify room exists\n const roomCheck = await sqlite.execute({\n sql: `SELECT id FROM rooms WHERE id = ?`,\n args: [roomId],\n });\n if (roomCheck.rows.length === 0) {\n return json({ error: \"room_not_found\" }, 404);\n }\n\n // Check for existing owners\n const ownerCheck = await sqlite.execute({\n sql: `SELECT user_id FROM smcp_user_rooms WHERE room_id = ?`,\n args: [roomId],\n });\n\n if (ownerCheck.rows.length > 0) {\n // Room already has users — check if caller has the room_ token\n if (!body) try { body = await req.json(); } catch { body = {}; }\n const roomToken = body?.room_token;\n if (!roomToken) {\n return json({\n error: \"already_owned\",\n message: \"Room already has users. Provide room_token to claim, or ask an owner to invite you.\",\n existing_users: ownerCheck.rows.length,\n }, 403);\n }\n // Verify room token\n const { hashToken } = await import(\"./auth.ts\");\n const hash = await hashToken(roomToken);\n const tokenCheck = await sqlite.execute({\n sql: `SELECT id FROM rooms WHERE id = ? AND token_hash = ?`,\n args: [roomId, hash],\n });\n if (tokenCheck.rows.length === 0) {\n return json({ error: \"invalid_room_token\" }, 401);\n }\n }\n\n // Claim as owner\n const label = body?.label ?? `Claimed: ${roomId}`;\n await sqlite.execute({\n sql: `INSERT INTO smcp_user_rooms (user_id, room_id, access, label)\n VALUES (?, ?, 'owner', ?)\n ON CONFLICT(user_id, room_id) DO UPDATE SET access = 'owner'`,\n args: [caller.userId, roomId, label],\n });\n\n return json({ claimed: true, room: roomId, role: \"owner\" });\n}\n","deleted","label",[100],"permalink","https://www.val.town/x/c15r/sync/code/tokens.ts","extension","actionData","errors"]