[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","adff7c7aeabd218801703bcdcaac3a168cba1c7b","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_150":151,"_172":173,"_174":-5},"handle","colel","name","rust-nyc-event-signin","path","backend/auth.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":-5,"_111":-5,"_12":112,"_113":114,"_115":116,"_117":116,"_118":-5,"_119":32,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":130,"_133":134,"_136":137,"_149":20},"id","24ebbe74-5dcc-11f0-990d-0224a6c84d84","createdAt",["D",1752179182252],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","c821e8f7-4cc4-4c23-96f1-319b8f33d4b7","pinnedFileId","bf0d74d5-88e6-41c6-8cbc-04803a89034b","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","6b193d60-e165-45a9-869c-c3f886455f3e","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_131":132},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJ6RVZCOExVNXBIT3FrVDh5a0VZQTNRRG5ycCJ9","org",{"_94":95,"_135":132,"_12":112},"avatar","branch",{"_138":139,"_96":44,"_102":140,"_141":103,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":97,"_148":95},"version",60,"24ee5ca6-5dcc-11f0-990d-0224a6c84d84","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":152,"_96":153,"_154":155,"_156":157,"_158":140,"_159":160,"_161":116,"_104":162,"_138":163,"_164":165,"_166":167,"_168":20,"_169":-5,"_98":170},"c8255eb0-5ddb-11f0-8796-0224a6c84d84","auth.ts","fileId","b5630810-5dd4-11f0-a784-0224a6c84d84","parentId","ab3f0ddd-bf40-418f-aee1-1e6f03b7f261","branchId","branchVersion",53,"latest",["D",1752185898552],1,"fileType","script","content","import { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nimport { getCookie, setCookie, deleteCookie } from \"https://esm.sh/hono@3.11.7/cookie\";\nimport type { Context } from \"https://esm.sh/hono@3.11.7\";\nimport { TABLES } from \"./database.ts\";\n\n// Session configuration\nconst SESSION_EXPIRES_IN_SECONDS = 60 * 60 * 24 * 30; // 30 days\nconst SESSION_COOKIE_NAME = \"session_token\";\n\n// Database interfaces\ninterface Session {\n id: string;\n secretHash: Uint8Array;\n eventId: number;\n createdAt: Date;\n}\n\ninterface SessionWithToken extends Session {\n token: string;\n}\n\n// Note: Sessions table initialization moved to database.ts\n\n// Generate secure random string for session IDs and secrets\nfunction generateSecureRandomString(): string {\n const alphabet = \"abcdefghijklmnpqrstuvwxyz23456789\";\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n \n let result = \"\";\n for (let i = 0; i < bytes.length; i++) {\n result += alphabet[bytes[i] >> 3];\n }\n return result;\n}\n\n// Hash secret using SHA-256\nasync function hashSecret(secret: string): Promise {\n const secretBytes = new TextEncoder().encode(secret);\n const secretHashBuffer = await crypto.subtle.digest(\"SHA-256\", secretBytes);\n return new Uint8Array(secretHashBuffer);\n}\n\n// Constant-time comparison for security\nfunction constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.byteLength !== b.byteLength) {\n return false;\n }\n let c = 0;\n for (let i = 0; i < a.byteLength; i++) {\n c |= a[i] ^ b[i];\n }\n return c === 0;\n}\n\n// Create a new session for event management\nexport async function createSession(eventId: number): Promise {\n const now = new Date();\n const sessionId = generateSecureRandomString();\n const sessionSecret = generateSecureRandomString();\n const secretHash = await hashSecret(sessionSecret);\n \n const token = `${sessionId}.${sessionSecret}`;\n \n const session: SessionWithToken = {\n id: sessionId,\n secretHash,\n eventId,\n createdAt: now,\n token\n };\n \n await sqlite.execute(\n `INSERT INTO ${TABLES.SESSIONS} (id, secret_hash, event_id, created_at) VALUES (?, ?, ?, ?)`,\n [sessionId, secretHash, eventId, Math.floor(now.getTime() / 1000)]\n );\n \n return session;\n}\n\n// Validate session token\nexport async function validateSessionToken(token: string): Promise {\n const tokenParts = token.split(\".\");\n if (tokenParts.length !== 2) {\n return null;\n }\n \n const [sessionId, sessionSecret] = tokenParts;\n \n try {\n const session = await getSession(sessionId);\n if (!session) {\n return null;\n }\n \n const tokenSecretHash = await hashSecret(sessionSecret);\n const validSecret = constantTimeEqual(tokenSecretHash, session.secretHash);\n \n if (!validSecret) {\n return null;\n }\n \n return session;\n } catch (error) {\n console.error(\"Error validating session token:\", error);\n return null;\n }\n}\n\n// Get session by ID\nasync function getSession(sessionId: string): Promise {\n const now = new Date();\n \n const result = await sqlite.execute(\n `SELECT id, secret_hash, event_id, created_at FROM ${TABLES.SESSIONS} WHERE id = ?`,\n [sessionId]\n );\n \n if (result.rows.length !== 1) {\n return null;\n }\n \n const row = result.rows[0];\n const session: Session = {\n id: row[0] as string,\n secretHash: new Uint8Array(row[1] as ArrayBuffer),\n eventId: row[2] as number,\n createdAt: new Date((row[3] as number) * 1000)\n };\n \n // Check expiration\n if (now.getTime() - session.createdAt.getTime() >= SESSION_EXPIRES_IN_SECONDS * 1000) {\n await deleteSession(sessionId);\n return null;\n }\n \n return session;\n}\n\n// Delete session\nexport async function deleteSession(sessionId: string): Promise {\n await sqlite.execute(`DELETE FROM ${TABLES.SESSIONS} WHERE id = ?`, [sessionId]);\n}\n\n// Set session cookie\nexport function setSessionCookie(c: Context, token: string): void {\n setCookie(c, SESSION_COOKIE_NAME, token, {\n maxAge: SESSION_EXPIRES_IN_SECONDS,\n httpOnly: true,\n secure: true,\n sameSite: 'Lax',\n path: '/'\n });\n}\n\n// Clear session cookie\nexport function clearSessionCookie(c: Context): void {\n deleteCookie(c, SESSION_COOKIE_NAME, {\n httpOnly: true,\n secure: true,\n sameSite: 'Lax',\n path: '/'\n });\n}\n\n// Get session from request\nexport async function getSessionFromRequest(c: Context): Promise {\n const token = getCookie(c, SESSION_COOKIE_NAME);\n if (!token) {\n return null;\n }\n \n return await validateSessionToken(token);\n}\n\n// Authentication middleware\nexport async function authMiddleware(c: Context, next: () => Promise) {\n const session = await getSessionFromRequest(c);\n \n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n \n // Store session in context for use in handlers\n c.set('session', session);\n await next();\n}\n\n// Verify event access (user has session for this specific event)\nexport async function verifyEventAccess(c: Context, eventId: number): Promise {\n const session = c.get('session') as Session;\n if (!session) {\n return false;\n }\n \n return session.eventId === eventId;\n}\n\n// CSRF protection - verify request origin\nexport function verifyRequestOrigin(c: Context): boolean {\n const method = c.req.method;\n if (method === \"GET\" || method === \"HEAD\") {\n return true;\n }\n \n const origin = c.req.header(\"origin\");\n const host = c.req.header(\"host\");\n \n if (!origin || !host) {\n return false;\n }\n \n // Allow same-origin requests\n return origin === `https://${host}` || origin === `http://${host}`;\n}\n\n// CSRF middleware\nexport async function csrfMiddleware(c: Context, next: () => Promise) {\n if (!verifyRequestOrigin(c)) {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n \n await next();\n}\n","deleted","label",[171,153],"backend","permalink","https://www.val.town/x/colel/rust-nyc-event-signin/code/backend/auth.ts","extension","actionData","errors"]