[{"_1":2,"_176":-5,"_177":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","4e736cb42e83c17c10d9f33412034a74b06f3941","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_150":151,"_173":174,"_175":-5},"handle","ianmenethil","name","ZenServer","path","src/services/validationService.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":73,"_111":-5,"_12":112,"_113":114,"_115":116,"_117":116,"_118":-5,"_119":32,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":130,"_133":134,"_136":137,"_149":20},"id","619e7f00-58a9-11f0-a700-f69ea79377d9","createdAt",["D",1751614495896],"deletedAt","legacyEnvVars","privacy","unlisted","description","imageUrl","5856754a-b1b9-4358-87d1-77f1d9f79e45","pinnedFileId","9f5c41ce-58a9-11f0-947f-f69ea79377d9","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","7559f40a-a274-4a9b-8f8b-7486509c3949","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_131":132},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ycXU1U2ZIVEk3NnhGTXRySE0wbWdYQncxSnYifQ","org",{"_94":95,"_135":132,"_12":112},"avatar","branch",{"_138":139,"_96":44,"_102":140,"_141":103,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":97,"_148":95},"version",883,"619ecc08-58a9-11f0-a700-f69ea79377d9","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":152,"_96":153,"_154":155,"_156":157,"_158":140,"_159":160,"_161":116,"_104":162,"_138":163,"_164":165,"_166":167,"_168":20,"_169":-5,"_98":170},"1cea1360-5fd4-11f0-afbf-0224a6c84d84","validationService.ts","fileId","a0236cc2-58a9-11f0-a255-f69ea79377d9","parentId","9ec2a1a4-58a9-11f0-9d42-f69ea79377d9","branchId","branchVersion",821,"latest",["D",1752402507120],8,"fileType","script","content","/**\n * Comprehensive validation service for ZenServer.\n * Consolidated validation utilities and security checks.\n */\n\nimport { z } from 'https://esm.sh/zod@3.22.4';\n\n// ========================================\n// Constants and Patterns\n// ========================================\n\nexport const NONCE_PATTERN = /^[a-f0-9]{64}$/;\nexport const BOOKING_ID_PATTERN = /^booking_[a-zA-Z0-9]{6,12}$/;\nexport const TIMESTAMP_PATTERN = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/;\nexport const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nexport const AMOUNT_PATTERN = /^\\d+(\\.\\d{2})?$/;\n\n// ========================================\n// Zod Schemas\n// ========================================\n\n/**\n * Validates nonce format (64 hex characters).\n */\nexport const NonceSchema = z.string()\n .length(64, 'Nonce must be exactly 64 characters')\n .regex(NONCE_PATTERN, 'Nonce must contain only lowercase hexadecimal characters');\n\n/**\n * Validates booking ID format.\n */\nexport const BookingIdSchema = z.string()\n .min(14, 'Booking ID too short')\n .max(20, 'Booking ID too long')\n .regex(BOOKING_ID_PATTERN, 'Invalid booking ID format');\n\n/**\n * Validates timestamp format for payment requests.\n */\nexport const PaymentTimestampSchema = z.string()\n .regex(TIMESTAMP_PATTERN, 'Timestamp must be in YYYY-MM-DDTHH:MM:SS format');\n\n/**\n * Validates payment amount (must be string with optional .00).\n */\nexport const PaymentAmountSchema = z.string()\n .regex(AMOUNT_PATTERN, 'Invalid amount format')\n .refine((val) => {\n const num = parseFloat(val);\n return num > 0 && num <= 999999.99;\n }, 'Amount must be between 0.01 and 999999.99');\n\n/**\n * Validates UUID format.\n */\nexport const UUIDSchema = z.string()\n .regex(UUID_PATTERN, 'Invalid UUID format');\n\n/**\n * Validates IP address format.\n */\nexport const IPAddressSchema = z.string()\n .ip({ message: 'Invalid IP address format' });\n\n/**\n * Validates payment nonce request.\n */\nexport const PaymentNonceRequestSchema = z.object({\n bookingId: BookingIdSchema,\n email_verify: z.string().optional(), // Honeypot field\n timestamp: PaymentTimestampSchema.optional(),\n});\n\n/**\n * Validates payment hash request.\n */\nexport const PaymentHashRequestSchema = z.object({\n apikey: z.string().min(1),\n mode: z.enum(['0', '1', '2', '3']),\n paymentAmount: PaymentAmountSchema,\n merchantUniquePaymentId: UUIDSchema,\n timestamp: PaymentTimestampSchema,\n});\n\n// ========================================\n// Validation Helper Functions\n// ========================================\n\n/**\n * Formats Zod validation errors into user-friendly messages.\n */\nexport function formatValidationErrors(error: z.ZodError): string[] {\n return error.errors.map((err) => {\n const path = err.path.length > 0 ? `${err.path.join('.')}: ` : '';\n return `${path}${err.message}`;\n });\n}\n\n/**\n * Validates request data and returns formatted errors if validation fails.\n */\nexport function validateRequestData(\n schema: z.ZodSchema,\n data: unknown,\n): { success: true; data: T } | { success: false; errors: string[] } {\n try {\n const validatedData = schema.parse(data);\n return { success: true, data: validatedData };\n } catch (error) {\n if (error instanceof z.ZodError) {\n return { success: false, errors: formatValidationErrors(error) };\n }\n return { success: false, errors: ['Validation failed: Unknown error'] };\n }\n}\n\n/**\n * Validates required fields are present in request.\n */\nexport function checkRequiredFields>(\n data: T,\n requiredFields: string[],\n): string[] {\n const missing: string[] = [];\n\n for (const field of requiredFields) {\n if (data[field] === undefined || data[field] === null || data[field] === '') {\n missing.push(field);\n }\n }\n\n return missing;\n}\n\n// ========================================\n// IP Address Extraction\n// ========================================\n\n/**\n * Extracts and validates IP address from headers.\n * Checks multiple headers in order of preference.\n */\nexport function extractAndValidateIP(headers: Headers): string {\n // Check for Cloudflare headers first\n const cfConnectingIP = headers.get('cf-connecting-ip');\n if (cfConnectingIP) {\n try {\n IPAddressSchema.parse(cfConnectingIP);\n return cfConnectingIP;\n } catch {\n // Fall through to next option\n }\n }\n\n const trueClientIP = headers.get('true-client-ip');\n if (trueClientIP) {\n try {\n IPAddressSchema.parse(trueClientIP);\n return trueClientIP;\n } catch {\n // Fall through to next option\n }\n }\n\n // Check X-Forwarded-For (may contain multiple IPs)\n const xForwardedFor = headers.get('x-forwarded-for');\n if (xForwardedFor) {\n const firstIP = xForwardedFor.split(',')[0].trim();\n try {\n IPAddressSchema.parse(firstIP);\n return firstIP;\n } catch {\n // Fall through to unknown\n }\n }\n\n const xRealIP = headers.get('x-real-ip');\n if (xRealIP) {\n try {\n IPAddressSchema.parse(xRealIP);\n return xRealIP;\n } catch {\n // Fall through to unknown\n }\n }\n\n return 'unknown';\n}\n\n// ========================================\n// Security Validation\n// ========================================\n\n/**\n * Validates email_verify field for honeypot detection.\n * Returns true if honeypot is triggered (field is missing or has wrong value).\n * Correct value should be \"🍯\" (honey emoji) for human users.\n */\nexport function isHoneypotTriggered(emailVerify: string | undefined): boolean {\n // Honeypot is triggered when field is missing OR has wrong value\n // Correct value should be \"🍯\" (honey emoji) \n return !emailVerify || emailVerify.trim() !== \"🍯\";\n}\n\n/**\n * Validates origin header against allowed origins.\n */\nexport function isValidOrigin(origin: string | null, allowedOrigins: string[]): boolean {\n if (!origin) return false;\n return allowedOrigins.includes(origin);\n}\n\n/**\n * Validates referer header against origin.\n */\nexport function isValidReferer(referer: string | null, origin: string | null): boolean {\n if (!referer || !origin) return false;\n try {\n return referer.startsWith(origin);\n } catch {\n return false;\n }\n}\n\n/**\n * Validates host header against expected host.\n */\nexport function isValidHost(host: string | null, expectedHost: string): boolean {\n if (!host) return false;\n return host === expectedHost;\n}\n\n/**\n * Validates timestamp for replay attack prevention.\n */\nexport function isRequestTimestampValid(\n timestamp: string | undefined,\n toleranceMs: number = 5 * 60 * 1000, // 5 minutes\n): boolean {\n if (!timestamp) {\n return false;\n }\n\n try {\n const requestTime = new Date(timestamp).getTime();\n const now = Date.now();\n\n if (isNaN(requestTime)) {\n return false;\n }\n\n // Request must be recent but not from the future\n const age = now - requestTime;\n return age >= 0 && age <= toleranceMs;\n } catch {\n return false;\n }\n}\n\n// ========================================\n// Type Guards\n// ========================================\n\n/**\n * Type guard to check if value is a valid payment mode.\n */\nexport function isValidPaymentMode(mode: any): mode is '0' | '1' | '2' | '3' {\n return ['0', '1', '2', '3'].includes(String(mode));\n}\n\n/**\n * Validates that payment amount string doesn't contain decimals.\n */\nexport function hasNoDecimals(amountString: string): boolean {\n return !/[.,]/.test(amountString);\n}\n\n// ========================================\n// ValidationService Class\n// ========================================\n\nexport class ValidationService {\n /**\n * Validates booking ID using Zod schema.\n */\n static validateBookingId(bookingId: string): { valid: boolean; error?: string } {\n const result = validateRequestData(BookingIdSchema, bookingId);\n\n if (result.success === false) {\n return { valid: false, error: result.errors[0] };\n }\n\n return { valid: true };\n }\n\n /**\n * Validates nonce format using Zod schema.\n */\n static validateNonceFormat(nonce: string): { valid: boolean; error?: string } {\n const result = validateRequestData(NonceSchema, nonce);\n\n if (result.success === false) {\n return { valid: false, error: result.errors[0] };\n }\n\n return { valid: true };\n }\n\n /**\n * Validates IP address using Zod schema.\n */\n static validateIpAddress(ip: string): { valid: boolean; error?: string } {\n if (ip === 'unknown') {\n return { valid: true }; // Allow 'unknown' as fallback\n }\n\n const result = validateRequestData(IPAddressSchema, ip);\n\n if (result.success === false) {\n return { valid: false, error: result.errors[0] };\n }\n\n return { valid: true };\n }\n\n /**\n * Extracts IP address from request headers.\n */\n static extractIpAddress(headers: Headers): string {\n return extractAndValidateIP(headers);\n }\n\n /**\n * Validates request headers for security requirements.\n */\n static validateRequestHeaders(headers: Headers): { valid: boolean; errors: string[] } {\n const errors: string[] = [];\n\n // Check for required security headers\n const userAgent = headers.get(\"user-agent\");\n if (!userAgent || userAgent.trim().length === 0) {\n errors.push(\"User-Agent header is required\");\n }\n\n // Validate Content-Type for POST requests\n const contentType = headers.get(\"content-type\");\n if (contentType && !contentType.includes(\"application/json\")) {\n errors.push(\"Content-Type must be application/json\");\n }\n\n return {\n valid: errors.length === 0,\n errors\n };\n }\n\n /**\n * Validates Turnstile token format.\n */\n static validateTurnstileToken(token: string): { valid: boolean; error?: string } {\n if (!token || typeof token !== 'string') {\n return { valid: false, error: \"Turnstile token is required\" };\n }\n\n // Basic format validation for Cloudflare Turnstile tokens\n if (token.length < 50 || token.length > 2000) {\n return { valid: false, error: \"Invalid Turnstile token format\" };\n }\n\n // Check for basic token structure\n if (!/^[a-zA-Z0-9._-]+$/.test(token)) {\n return { valid: false, error: \"Invalid Turnstile token characters\" };\n }\n\n return { valid: true };\n }\n\n /**\n * Validates Turnstile token format (alias for validateTurnstileToken for compatibility).\n */\n static isValidTurnstileTokenFormat(token: string): boolean {\n return ValidationService.validateTurnstileToken(token).valid;\n }\n\n /**\n * Validates payment callback data format.\n */\n static isValidCallbackFormat(callbackData: any): boolean {\n if (!callbackData || typeof callbackData !== 'object') {\n return false;\n }\n\n const { merchantUniquePaymentId, status, validationCode } = callbackData;\n\n // Check required fields are present and have reasonable formats\n if (typeof merchantUniquePaymentId !== 'string' || merchantUniquePaymentId.length < 10) {\n return false;\n }\n\n if (typeof status !== 'string' || status.length === 0) {\n return false;\n }\n\n if (typeof validationCode !== 'string' || validationCode.length < 10) {\n return false;\n }\n\n // Additional validation can be added here for specific payment gateway formats\n return true;\n }\n\n /**\n * Sanitizes general input to prevent XSS and other attacks.\n */\n static sanitizeInput(input: any, maxLength: number = 1000): string {\n if (typeof input !== 'string') {\n return '';\n }\n\n // Truncate if too long\n let sanitized = input.substring(0, maxLength);\n\n // Remove dangerous characters and patterns\n sanitized = sanitized\n .replace(/)<[^<]*)*<\\/script>/gi, '')\n .replace(/<[^>]*>?/g, '') // Remove all HTML tags\n .replace(/javascript:/gi, '')\n .replace(/vbscript:/gi, '')\n .replace(/on\\w+\\s*=/gi, '') // Remove event handlers\n // deno-lint-ignore no-control-regex\n .replace(/[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F\\x7F]/g, '') // Remove control characters\n .trim();\n\n return sanitized;\n }\n}\n\n// ========================================\n// Export consolidated validation utilities\n// ========================================\n\nexport default {\n // Patterns\n NONCE_PATTERN,\n BOOKING_ID_PATTERN,\n TIMESTAMP_PATTERN,\n UUID_PATTERN,\n AMOUNT_PATTERN,\n\n // Schemas\n NonceSchema,\n BookingIdSchema,\n PaymentTimestampSchema,\n PaymentAmountSchema,\n UUIDSchema,\n IPAddressSchema,\n PaymentNonceRequestSchema,\n PaymentHashRequestSchema,\n\n // Functions\n extractAndValidateIP,\n isHoneypotTriggered,\n isValidOrigin,\n isValidReferer,\n isValidHost,\n isRequestTimestampValid,\n formatValidationErrors,\n validateRequestData,\n checkRequiredFields,\n isValidPaymentMode,\n hasNoDecimals,\n};\n","deleted","label",[171,172,153],"src","services","permalink","https://www.val.town/x/ianmenethil/ZenServer/code/src/services/validationService.ts","extension","actionData","errors"]