[{"_1":2,"_176":-5,"_177":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","4e736cb42e83c17c10d9f33412034a74b06f3941","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_150":151,"_173":174,"_175":-5},"handle","ianmenethil","name","ZenServer","path","src/utils/cookies.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":73,"_111":-5,"_12":112,"_113":114,"_115":116,"_117":116,"_118":-5,"_119":32,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":130,"_133":134,"_136":137,"_149":20},"id","619e7f00-58a9-11f0-a700-f69ea79377d9","createdAt",["D",1751614495896],"deletedAt","legacyEnvVars","privacy","unlisted","description","imageUrl","5856754a-b1b9-4358-87d1-77f1d9f79e45","pinnedFileId","9f5c41ce-58a9-11f0-947f-f69ea79377d9","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","7559f40a-a274-4a9b-8f8b-7486509c3949","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_131":132},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ycXU1U2ZIVEk3NnhGTXRySE0wbWdYQncxSnYifQ","org",{"_94":95,"_135":132,"_12":112},"avatar","branch",{"_138":139,"_96":44,"_102":140,"_141":103,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":97,"_148":95},"version",883,"619ecc08-58a9-11f0-a700-f69ea79377d9","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":152,"_96":153,"_154":155,"_156":157,"_158":140,"_159":160,"_161":116,"_104":162,"_138":163,"_164":165,"_166":167,"_168":20,"_169":-5,"_98":170},"9025ec3a-5fcc-11f0-bf0a-0224a6c84d84","cookies.ts","fileId","cad2e8fa-5c67-11f0-b675-0224a6c84d84","parentId","9f14f27e-58a9-11f0-9a99-f69ea79377d9","branchId","branchVersion",807,"latest",["D",1752399264468],6,"fileType","script","content","import {\r\n getCookie,\r\n getSignedCookie,\r\n setCookie,\r\n setSignedCookie,\r\n deleteCookie,\r\n} from \"npm:hono/cookie\";\r\nimport type { Context } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger } from \"./logger.ts\";\r\nimport { DatabaseService, validateCSRFToken } from \"../services/dbService.ts\";\r\n\r\n/**\r\n * Cookie utility functions for ZenServer\r\n * Provides secure defaults and convenience methods for cookie management\r\n * All configuration comes from environment/security settings\r\n */\r\n\r\n// ============================================================================\r\n// TYPES AND INTERFACES\r\n// ============================================================================\r\n\r\n/**\r\n * Session data for token-based CSRF protection\r\n */\r\nexport interface CSRFSession {\r\n sessionId: string;\r\n xsrfToken: string;\r\n createdAt: Date;\r\n expiresAt: Date;\r\n}\r\n\r\n/**\r\n * Result of token validation\r\n */\r\nexport interface TokenValidationResult {\r\n valid: boolean;\r\n error?: string;\r\n sessionId?: string;\r\n}\r\n\r\n// ============================================================================\r\n// DYNAMIC COOKIE OPTIONS (using environment configuration)\r\n// ============================================================================\r\n\r\n/**\r\n * Get default secure cookie options from environment configuration\r\n */\r\nfunction getDefaultCookieOptions() {\r\n return {\r\n path: environment.COOKIE_DEFAULT_PATH,\r\n secure: shouldUseSecureCookies(),\r\n httpOnly: true, // Prevent XSS attacks\r\n sameSite: environment.COOKIE_SAME_SITE as \"Strict\" | \"Lax\" | \"None\",\r\n maxAge: environment.COOKIE_DEFAULT_MAX_AGE,\r\n domain: environment.COOKIE_DEFAULT_DOMAIN || undefined,\r\n };\r\n}\r\n\r\n/**\r\n * Get session cookie options from environment configuration\r\n */\r\nfunction getSessionCookieOptions() {\r\n return {\r\n ...getDefaultCookieOptions(),\r\n maxAge: environment.COOKIE_SESSION_MAX_AGE,\r\n };\r\n}\r\n\r\n/**\r\n * Get CSRF cookie options from environment configuration\r\n */\r\nfunction getCSRFCookieOptions() {\r\n return {\r\n ...getDefaultCookieOptions(),\r\n maxAge: environment.COOKIE_CSRF_MAX_AGE,\r\n };\r\n}\r\n\r\n// ============================================================================\r\n// BASIC COOKIE UTILITIES (Hono Context-based)\r\n// ============================================================================\r\n\r\n/**\r\n * Set a secure cookie with default security options from environment\r\n */\r\nexport function setSecureCookie(\r\n c: Context,\r\n name: string,\r\n value: string,\r\n options: Partial> = {}\r\n): void {\r\n const defaultOptions = getDefaultCookieOptions();\r\n setCookie(c, name, value, {\r\n ...defaultOptions,\r\n ...options,\r\n });\r\n}\r\n\r\n/**\r\n * Set a session cookie (longer lived, for user sessions)\r\n */\r\nexport function setSessionCookie(\r\n c: Context,\r\n name: string,\r\n value: string,\r\n options: Partial> = {}\r\n): void {\r\n const sessionOptions = getSessionCookieOptions();\r\n setCookie(c, name, value, {\r\n ...sessionOptions,\r\n ...options,\r\n });\r\n}\r\n\r\n/**\r\n * Set a signed cookie with secure defaults\r\n */\r\nexport async function setSecureSignedCookie(\r\n c: Context,\r\n name: string,\r\n value: string,\r\n secret: string,\r\n options: Partial> = {}\r\n): Promise {\r\n const defaultOptions = getDefaultCookieOptions();\r\n await setSignedCookie(c, name, value, secret, {\r\n ...defaultOptions,\r\n ...options,\r\n });\r\n}\r\n\r\n/**\r\n * Get a cookie value\r\n */\r\nexport function getCookieValue(c: Context, name: string): string | undefined {\r\n return getCookie(c, name);\r\n}\r\n\r\n/**\r\n * Get all cookies\r\n */\r\nexport function getAllCookies(c: Context): Record {\r\n return getCookie(c) || {};\r\n}\r\n\r\n/**\r\n * Get a signed cookie value\r\n */\r\nexport async function getSignedCookieValue(\r\n c: Context,\r\n name: string,\r\n secret: string\r\n): Promise {\r\n return await getSignedCookie(c, secret, name);\r\n}\r\n\r\n/**\r\n * Delete a cookie securely\r\n */\r\nexport function deleteSecureCookie(\r\n c: Context,\r\n name: string,\r\n options: { path?: string; domain?: string } = {}\r\n): string | undefined {\r\n return deleteCookie(c, name, {\r\n path: environment.COOKIE_DEFAULT_PATH,\r\n secure: shouldUseSecureCookies(),\r\n domain: environment.COOKIE_DEFAULT_DOMAIN || undefined,\r\n ...options,\r\n });\r\n}\r\n\r\n/**\r\n * Set a temporary cookie (short-lived, for flash messages, etc.)\r\n */\r\nexport function setTempCookie(\r\n c: Context,\r\n name: string,\r\n value: string,\r\n maxAgeSeconds?: number // Optional override, defaults to environment setting\r\n): void {\r\n setSecureCookie(c, name, value, {\r\n maxAge: maxAgeSeconds ?? environment.COOKIE_TEMP_MAX_AGE,\r\n });\r\n}\r\n\r\n// ============================================================================\r\n// RESPONSE-BASED COOKIE UTILITIES (for non-Hono contexts)\r\n// ============================================================================\r\n\r\n/**\r\n * Check if environment supports secure cookies\r\n */\r\nexport function shouldUseSecureCookies(): boolean {\r\n return (\r\n environment.COOKIE_FORCE_SECURE ||\r\n environment.APP_ENV === \"prod\" ||\r\n environment.BASE_URL.startsWith(\"https://\")\r\n );\r\n}\r\n\r\n/**\r\n * Set cookies on a Response object by manipulating headers\r\n * Used when working with raw Response objects instead of Hono Context\r\n */\r\nexport function setCookieOnResponse(\r\n response: Response,\r\n name: string,\r\n value: string,\r\n options: {\r\n path?: string;\r\n secure?: boolean;\r\n httpOnly?: boolean;\r\n sameSite?: \"Strict\" | \"Lax\" | \"None\";\r\n maxAge?: number;\r\n domain?: string;\r\n } = {}\r\n): Response {\r\n const headers = new Headers(response.headers);\r\n\r\n // Use environment-aware secure settings\r\n const isSecure = options.secure ?? shouldUseSecureCookies();\r\n const cookieOptions = {\r\n path: environment.COOKIE_DEFAULT_PATH,\r\n httpOnly: true,\r\n sameSite: environment.COOKIE_SAME_SITE as \"Strict\" | \"Lax\" | \"None\",\r\n maxAge: environment.COOKIE_DEFAULT_MAX_AGE,\r\n domain: environment.COOKIE_DEFAULT_DOMAIN || undefined,\r\n ...options,\r\n secure: isSecure,\r\n };\r\n\r\n // Build cookie string\r\n let cookieString = `${name}=${value}`;\r\n\r\n if (cookieOptions.path) cookieString += `; Path=${cookieOptions.path}`;\r\n if (cookieOptions.domain) cookieString += `; Domain=${cookieOptions.domain}`;\r\n if (cookieOptions.maxAge) cookieString += `; Max-Age=${cookieOptions.maxAge}`;\r\n if (cookieOptions.sameSite)\r\n cookieString += `; SameSite=${cookieOptions.sameSite}`;\r\n if (cookieOptions.httpOnly) cookieString += `; HttpOnly`;\r\n if (cookieOptions.secure) cookieString += `; Secure`;\r\n\r\n headers.append(\"Set-Cookie\", cookieString);\r\n\r\n return new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers,\r\n });\r\n}\r\n\r\n// ============================================================================\r\n// CSRF-SPECIFIC COOKIE UTILITIES\r\n// ============================================================================\r\n\r\n/**\r\n * Set CSRF-related cookies using Hono Context (SESSION and XSRF-TOKEN)\r\n * Used by CSRF middleware when working with Hono Context\r\n */\r\nexport function setCSRFCookiesHono(\r\n c: Context,\r\n sessionId: string,\r\n xsrfToken: string\r\n): void {\r\n const csrfOptions = getCSRFCookieOptions();\r\n\r\n // Set SESSION cookie (httpOnly, secure, configured TTL)\r\n setSecureCookie(c, environment.COOKIE_SESSION_NAME, sessionId, {\r\n ...csrfOptions,\r\n httpOnly: true,\r\n });\r\n\r\n // Set XSRF-TOKEN cookie (NOT httpOnly so frontend can read it, configured TTL)\r\n setSecureCookie(c, environment.COOKIE_CSRF_TOKEN_NAME, xsrfToken, {\r\n ...csrfOptions,\r\n httpOnly: false, // Frontend needs to read this for CSRF protection\r\n });\r\n}\r\n\r\n/**\r\n * Set CSRF protection cookies on a Response object\r\n * Sets both SESSION (httpOnly) and XSRF-TOKEN (readable by JS) cookies\r\n * This replaces the duplicate function in csrf.ts\r\n *\r\n * @param response - The HTTP response to modify\r\n * @param session - The CSRF session data\r\n * @returns Modified response with cookies set\r\n */\r\nexport function setCSRFCookies(\r\n response: Response,\r\n session: CSRFSession\r\n): Response {\r\n const headers = new Headers(response.headers);\r\n\r\n // Determine if we should use Secure flag based on environment\r\n const isSecure = shouldUseSecureCookies();\r\n const secureFlag = isSecure ? \"; Secure\" : \"\";\r\n const maxAge = environment.COOKIE_CSRF_MAX_AGE;\r\n const path = environment.COOKIE_DEFAULT_PATH;\r\n const sameSite = environment.COOKIE_SAME_SITE;\r\n const domain = environment.COOKIE_DEFAULT_DOMAIN;\r\n const domainPart = domain ? `; Domain=${domain}` : \"\";\r\n\r\n // Set SESSION cookie (httpOnly, secure based on env, configured TTL)\r\n const sessionCookie = `${environment.COOKIE_SESSION_NAME}=${session.sessionId}; Path=${path}; HttpOnly; SameSite=${sameSite}; Max-Age=${maxAge}${domainPart}${secureFlag}`;\r\n\r\n // Set XSRF-TOKEN cookie (secure based on env, readable by JS, configured TTL)\r\n const xsrfCookie = `${environment.COOKIE_CSRF_TOKEN_NAME}=${session.xsrfToken}; Path=${path}; SameSite=${sameSite}; Max-Age=${maxAge}${domainPart}${secureFlag}`;\r\n\r\n headers.append(\"Set-Cookie\", sessionCookie);\r\n headers.append(\"Set-Cookie\", xsrfCookie);\r\n\r\n logger.info(\"CSRF cookies set\", {\r\n sessionId: session.sessionId.substring(0, 8) + \"...\",\r\n expiresAt: session.expiresAt.toISOString(),\r\n secure: isSecure,\r\n sessionName: environment.COOKIE_SESSION_NAME,\r\n tokenName: environment.COOKIE_CSRF_TOKEN_NAME,\r\n maxAge,\r\n sameSite,\r\n domain: domain || \"current\",\r\n });\r\n\r\n return new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers,\r\n });\r\n}\r\n\r\n/**\r\n * Get CSRF session cookie value from request\r\n */\r\nexport function getCSRFSessionFromRequest(\r\n request: Request\r\n): string | undefined {\r\n const cookieHeader = request.headers.get(\"Cookie\");\r\n if (!cookieHeader) return undefined;\r\n\r\n const sessionPattern = new RegExp(\r\n `${environment.COOKIE_SESSION_NAME}=([^;]+)`\r\n );\r\n const sessionMatch = cookieHeader.match(sessionPattern);\r\n return sessionMatch ? sessionMatch[1] : undefined;\r\n}\r\n\r\n/**\r\n * Get CSRF token from request headers\r\n */\r\nexport function getCSRFTokenFromRequest(request: Request): string | undefined {\r\n return request.headers.get(\"X-XSRF-TOKEN\") || undefined;\r\n}\r\n\r\n/**\r\n * Get CSRF session cookie (Hono Context version)\r\n */\r\nexport function getCSRFSessionCookie(c: Context): string | undefined {\r\n return getCookieValue(c, environment.COOKIE_SESSION_NAME);\r\n}\r\n\r\n/**\r\n * Get CSRF token cookie (Hono Context version)\r\n */\r\nexport function getCSRFTokenCookie(c: Context): string | undefined {\r\n return getCookieValue(c, environment.COOKIE_CSRF_TOKEN_NAME);\r\n}\r\n\r\n/**\r\n * Validate CSRF token from incoming request\r\n * Checks that X-XSRF-TOKEN header corresponds to SESSION cookie\r\n * This replaces the duplicate function in csrf.ts\r\n *\r\n * @param request - The incoming HTTP request\r\n * @returns Validation result with status and optional error message\r\n */\r\nexport async function validateTokenBasedCSRFToken(request: Request): Promise {\r\n const xsrfHeader = request.headers.get(\"X-XSRF-TOKEN\");\r\n const cookieHeader = request.headers.get(\"Cookie\");\r\n\r\n if (!xsrfHeader) {\r\n return { valid: false, error: \"Missing X-XSRF-TOKEN header\" };\r\n }\r\n\r\n if (!cookieHeader) {\r\n return { valid: false, error: \"Missing session cookies\" };\r\n }\r\n\r\n // Parse SESSION cookie using environment-configured name\r\n // Handle multiple cookies by getting the last (most recent) value\r\n const sessionPattern = new RegExp(\r\n `${environment.COOKIE_SESSION_NAME}=([^;]+)`, 'g'\r\n );\r\n const sessionMatches = [...cookieHeader.matchAll(sessionPattern)];\r\n if (sessionMatches.length === 0) {\r\n return {\r\n valid: false,\r\n error: `Missing ${environment.COOKIE_SESSION_NAME} cookie`,\r\n };\r\n }\r\n\r\n // Use the last (most recent) session cookie value\r\n const sessionId = sessionMatches[sessionMatches.length - 1][1];\r\n\r\n // Validate token formats first\r\n if (xsrfHeader.length !== 64 || !/^[0-9a-f]+$/i.test(xsrfHeader)) {\r\n return { valid: false, error: \"Invalid XSRF token format\" };\r\n }\r\n\r\n if (sessionId.length !== 64 || !/^[0-9a-f]+$/i.test(sessionId)) {\r\n return { valid: false, error: \"Invalid session format\" };\r\n }\r\n\r\n // Validate against stored session-token pairs in database\r\n try {\r\n const dbValidation = await validateCSRFToken(sessionId, xsrfHeader);\r\n \r\n if (!dbValidation.valid) {\r\n return { valid: false, error: dbValidation.error || \"CSRF token validation failed\" };\r\n }\r\n\r\n logger.info(\"CSRF validation passed\", {\r\n sessionId: sessionId.substring(0, 8) + \"...\",\r\n xsrfToken: xsrfHeader.substring(0, 8) + \"...\",\r\n sessionName: environment.COOKIE_SESSION_NAME,\r\n tokenName: environment.COOKIE_CSRF_TOKEN_NAME,\r\n });\r\n\r\n return { valid: true, sessionId };\r\n } catch (error) {\r\n logger.error(\"CSRF database validation failed\", {\r\n error: error instanceof Error ? error.message : String(error),\r\n sessionId: sessionId.substring(0, 8) + \"...\",\r\n });\r\n return { valid: false, error: \"CSRF validation system error\" };\r\n }\r\n}\r\n\r\n/**\r\n * Clear all authentication-related cookies using Hono Context\r\n */\r\nexport function clearAuthCookies(c: Context): void {\r\n deleteSecureCookie(c, environment.COOKIE_SESSION_NAME);\r\n deleteSecureCookie(c, environment.COOKIE_CSRF_TOKEN_NAME);\r\n // Add any other auth-related cookies here as needed\r\n}\r\n\r\n/**\r\n * Clear all authentication-related cookies on a Response object\r\n */\r\nexport function clearAuthCookiesOnResponse(response: Response): Response {\r\n const headers = new Headers(response.headers);\r\n\r\n const path = environment.COOKIE_DEFAULT_PATH;\r\n const sameSite = environment.COOKIE_SAME_SITE;\r\n const domain = environment.COOKIE_DEFAULT_DOMAIN;\r\n const domainPart = domain ? `; Domain=${domain}` : \"\";\r\n const secureFlag = shouldUseSecureCookies() ? \"; Secure\" : \"\";\r\n\r\n // Clear SESSION cookie\r\n headers.append(\r\n \"Set-Cookie\",\r\n `${environment.COOKIE_SESSION_NAME}=; Path=${path}; HttpOnly; SameSite=${sameSite}; Max-Age=0${domainPart}${secureFlag}`\r\n );\r\n\r\n // Clear XSRF-TOKEN cookie\r\n headers.append(\r\n \"Set-Cookie\",\r\n `${environment.COOKIE_CSRF_TOKEN_NAME}=; Path=${path}; SameSite=${sameSite}; Max-Age=0${domainPart}${secureFlag}`\r\n );\r\n\r\n return new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers,\r\n });\r\n}\r\n\r\n// ============================================================================\r\n// COOKIE PARSING UTILITIES\r\n// ============================================================================\r\n\r\n/**\r\n * Parse all cookies from a request\r\n */\r\nexport function parseCookiesFromRequest(\r\n request: Request\r\n): Record {\r\n const cookieHeader = request.headers.get(\"Cookie\");\r\n if (!cookieHeader) return {};\r\n\r\n const cookies: Record = {};\r\n\r\n cookieHeader.split(\";\").forEach((cookie) => {\r\n const [name, ...rest] = cookie.trim().split(\"=\");\r\n if (name && rest.length) {\r\n cookies[name] = rest.join(\"=\");\r\n }\r\n });\r\n\r\n return cookies;\r\n}\r\n\r\n/**\r\n * Get a specific cookie value from request\r\n */\r\nexport function getCookieFromRequest(\r\n request: Request,\r\n name: string\r\n): string | undefined {\r\n const cookies = parseCookiesFromRequest(request);\r\n return cookies[name];\r\n}\r\n","deleted","label",[171,172,153],"src","utils","permalink","https://www.val.town/x/ianmenethil/ZenServer/code/src/utils/cookies.ts","extension","actionData","errors"]