[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_112":113,"_114":115},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","nbbaier","name","townie-slackbot","path","connectors/oauth.ts","project",{"_22":48,"_11":12,"_35":49,"_50":-5,"_51":44,"_52":53,"_54":53,"_55":56,"_57":58,"_59":60,"_61":62,"_63":34,"_64":-5,"_65":-5,"_66":38,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/nbbaier/townie-slackbot/code/connectors/oauth.ts","extension","id","394e3f08-af01-46e1-a10e-8c522fcf8782","oauth.ts","fileId","01a026ee-4ccb-7558-abd5-04d494161ee6","parentId","01a026ee-4ccb-7558-abd5-0f8e5bde6d2b","branchId","c98fe62e-e4a5-4985-a211-8127f69af2d1","branchVersion",1,"latest",true,"createdAt",["D",1787359546508],"version",0,"fileType","script","content","/**\n * Generic OAuth 2.0 + PKCE engine for MCP services.\n *\n * Implements:\n * - RFC 9470 (Protected Resource Metadata discovery)\n * - RFC 8414 (Authorization Server Metadata discovery)\n * - RFC 7591 (Dynamic Client Registration)\n * - RFC 7636 (PKCE)\n * - Token exchange + refresh with rotation\n *\n * Storage: project-scoped SQLite (std/sqlite/main.ts)\n * Designed for single-token-per-service (one user auths, whole team benefits).\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ── Types ────────────────────────────────────────────────────────────────────\n\nexport type OAuthMetadata = {\n issuer: string;\n authorization_endpoint: string;\n token_endpoint: string;\n registration_endpoint?: string;\n code_challenge_methods_supported?: string[];\n grant_types_supported?: string[];\n response_types_supported?: string[];\n scopes_supported?: string[];\n};\n\ntype StoredTokens = {\n service: string;\n access_token: string;\n refresh_token: string | null;\n client_id: string;\n client_secret: string | null;\n metadata_json: string;\n expires_at: number;\n updated_at: number;\n};\n\n// ── Init tables (idempotent) ─────────────────────────────────────────────────\n\nawait sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS oauth_pending (\n state TEXT PRIMARY KEY,\n service TEXT NOT NULL,\n code_verifier TEXT NOT NULL,\n client_id TEXT NOT NULL,\n client_secret TEXT,\n metadata_json TEXT NOT NULL,\n redirect_uri TEXT NOT NULL,\n created_at INTEGER NOT NULL\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS oauth_tokens (\n service TEXT PRIMARY KEY,\n access_token TEXT NOT NULL,\n refresh_token TEXT,\n client_id TEXT NOT NULL,\n client_secret TEXT,\n metadata_json TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n updated_at INTEGER NOT NULL\n )`,\n },\n]);\n\n// ── Helpers ──────────────────────────────────────────────────────────────────\n\nfunction base64URLEncode(buf: Uint8Array): string {\n let str = \"\";\n for (const b of buf) str += String.fromCharCode(b);\n return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\n// ── Step 1: OAuth Discovery (RFC 9470 → RFC 8414) ───────────────────────────\n\nexport async function discoverOAuthMetadata(\n mcpServerUrl: string,\n): Promise {\n const url = new URL(mcpServerUrl);\n\n // RFC 9470: Protected Resource Metadata\n const prUrl = new URL(\"/.well-known/oauth-protected-resource\", url);\n const prRes = await fetch(prUrl.toString());\n if (!prRes.ok) {\n throw new Error(`Protected resource metadata failed: ${prRes.status}`);\n }\n const pr = await prRes.json();\n const authServers = pr.authorization_servers;\n if (!Array.isArray(authServers) || authServers.length === 0) {\n throw new Error(\"No authorization_servers in protected resource metadata\");\n }\n const authServerUrl = authServers[0];\n\n // RFC 8414: Authorization Server Metadata\n const asUrl = new URL(\"/.well-known/oauth-authorization-server\", authServerUrl);\n const asRes = await fetch(asUrl.toString());\n if (!asRes.ok) {\n throw new Error(`Authorization server metadata failed: ${asRes.status}`);\n }\n const metadata = (await asRes.json()) as OAuthMetadata;\n if (!metadata.authorization_endpoint || !metadata.token_endpoint) {\n throw new Error(\"Missing required OAuth endpoints in metadata\");\n }\n return metadata;\n}\n\n// ── Step 2: PKCE ─────────────────────────────────────────────────────────────\n\nexport async function generatePKCE(): Promise<{\n verifier: string;\n challenge: string;\n}> {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n const verifier = base64URLEncode(bytes);\n\n const hash = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n const challenge = base64URLEncode(new Uint8Array(hash));\n return { verifier, challenge };\n}\n\n// ── Step 3: Dynamic Client Registration (RFC 7591) ──────────────────────────\n\nexport async function registerClient(\n metadata: OAuthMetadata,\n redirectUri: string,\n clientName: string,\n): Promise<{ client_id: string; client_secret?: string }> {\n if (!metadata.registration_endpoint) {\n throw new Error(\"Server does not support dynamic client registration\");\n }\n const res = await fetch(metadata.registration_endpoint, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", Accept: \"application/json\" },\n body: JSON.stringify({\n client_name: clientName,\n redirect_uris: [redirectUri],\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n token_endpoint_auth_method: \"none\",\n }),\n });\n if (!res.ok) {\n const body = await res.text();\n throw new Error(`Client registration failed: ${res.status} — ${body}`);\n }\n const creds = await res.json();\n return { client_id: creds.client_id, client_secret: creds.client_secret };\n}\n\n// ── Step 4: Build authorization URL ──────────────────────────────────────────\n\nexport function buildAuthorizationUrl(\n metadata: OAuthMetadata,\n clientId: string,\n redirectUri: string,\n codeChallenge: string,\n state: string,\n scopes: string[] = [],\n): string {\n const params = new URLSearchParams({\n response_type: \"code\",\n client_id: clientId,\n redirect_uri: redirectUri,\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n state,\n prompt: \"consent\",\n });\n if (scopes.length) params.set(\"scope\", scopes.join(\" \"));\n return `${metadata.authorization_endpoint}?${params.toString()}`;\n}\n\n// ── Step 5–6: Start auth (store pending) ─────────────────────────────────────\n\nexport async function startAuth(\n service: string,\n mcpServerUrl: string,\n redirectUri: string,\n clientName: string,\n scopes: string[] = [],\n): Promise {\n const metadata = await discoverOAuthMetadata(mcpServerUrl);\n const creds = await registerClient(metadata, redirectUri, clientName);\n const { verifier, challenge } = await generatePKCE();\n const state = crypto.randomUUID();\n\n await sqlite.execute({\n sql: `INSERT INTO oauth_pending (state, service, code_verifier, client_id, client_secret, metadata_json, redirect_uri, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n state,\n service,\n verifier,\n creds.client_id,\n creds.client_secret ?? null,\n JSON.stringify(metadata),\n redirectUri,\n Date.now(),\n ],\n });\n\n // Clean up old pending entries (> 10 min)\n await sqlite.execute({\n sql: `DELETE FROM oauth_pending WHERE created_at < ?`,\n args: [Date.now() - 10 * 60 * 1000],\n });\n\n return buildAuthorizationUrl(\n metadata,\n creds.client_id,\n redirectUri,\n challenge,\n state,\n scopes,\n );\n}\n\n// ── Step 6: Handle callback ──────────────────────────────────────────────────\n\nexport async function handleCallback(\n code: string,\n state: string,\n): Promise<{ service: string }> {\n const result = await sqlite.execute({\n sql: `SELECT * FROM oauth_pending WHERE state = ?`,\n args: [state],\n });\n if (!result.rows.length) throw new Error(\"Invalid or expired state\");\n\n const pending = result.rows[0] as Record;\n const service = pending.service as string;\n const codeVerifier = pending.code_verifier as string;\n const clientId = pending.client_id as string;\n const clientSecret = (pending.client_secret as string) ?? undefined;\n const metadataJson = pending.metadata_json as string;\n const redirectUri = pending.redirect_uri as string;\n const metadata = JSON.parse(metadataJson) as OAuthMetadata;\n\n // Exchange code for tokens\n const params = new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n client_id: clientId,\n redirect_uri: redirectUri,\n code_verifier: codeVerifier,\n });\n if (clientSecret) params.append(\"client_secret\", clientSecret);\n\n const res = await fetch(metadata.token_endpoint, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n Accept: \"application/json\",\n },\n body: params.toString(),\n });\n\n if (!res.ok) {\n const body = await res.text();\n throw new Error(`Token exchange failed: ${res.status} — ${body}`);\n }\n\n const tokens = await res.json();\n if (!tokens.access_token) throw new Error(\"No access_token in response\");\n\n // Store tokens\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO oauth_tokens\n (service, access_token, refresh_token, client_id, client_secret, metadata_json, expires_at, updated_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n service,\n tokens.access_token,\n tokens.refresh_token ?? null,\n clientId,\n clientSecret ?? null,\n metadataJson,\n Date.now() + (tokens.expires_in ?? 3600) * 1000,\n Date.now(),\n ],\n });\n\n // Clean up pending\n await sqlite.execute({\n sql: `DELETE FROM oauth_pending WHERE state = ?`,\n args: [state],\n });\n\n return { service };\n}\n\n// ── Step 8: Get valid access token (refresh if needed) ───────────────────────\n\nexport async function getValidAccessToken(\n service: string,\n): Promise {\n const result = await sqlite.execute({\n sql: `SELECT * FROM oauth_tokens WHERE service = ?`,\n args: [service],\n });\n if (!result.rows.length) return null;\n\n const row = result.rows[0] as unknown as StoredTokens;\n\n // Still valid (with 60s buffer)\n if (row.expires_at > Date.now() + 60_000) {\n return row.access_token;\n }\n\n // Need to refresh\n if (!row.refresh_token) {\n console.warn(`[OAuth] ${service}: token expired, no refresh token — need re-auth`);\n // Delete the stale token so connect tool shows up again\n await sqlite.execute({ sql: `DELETE FROM oauth_tokens WHERE service = ?`, args: [service] });\n return null;\n }\n\n console.log(`[OAuth] ${service}: refreshing token...`);\n const metadata = JSON.parse(row.metadata_json) as OAuthMetadata;\n\n const params = new URLSearchParams({\n grant_type: \"refresh_token\",\n refresh_token: row.refresh_token,\n client_id: row.client_id,\n });\n if (row.client_secret) params.append(\"client_secret\", row.client_secret);\n\n const res = await fetch(metadata.token_endpoint, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n Accept: \"application/json\",\n },\n body: params.toString(),\n });\n\n if (!res.ok) {\n const body = await res.text();\n console.error(`[OAuth] ${service}: refresh failed: ${res.status} — ${body}`);\n // If invalid_grant, nuke the tokens so user re-auths\n if (body.includes(\"invalid_grant\")) {\n await sqlite.execute({ sql: `DELETE FROM oauth_tokens WHERE service = ?`, args: [service] });\n }\n return null;\n }\n\n const tokens = await res.json();\n\n // Store new tokens (refresh token rotates!)\n await sqlite.execute({\n sql: `UPDATE oauth_tokens SET\n access_token = ?, refresh_token = ?,\n expires_at = ?, updated_at = ?\n WHERE service = ?`,\n args: [\n tokens.access_token,\n tokens.refresh_token ?? row.refresh_token,\n Date.now() + (tokens.expires_in ?? 3600) * 1000,\n Date.now(),\n service,\n ],\n });\n\n console.log(`[OAuth] ${service}: token refreshed`);\n return tokens.access_token;\n}\n\n// ── Utility: check which services are connected ──────────────────────────────\n\nexport async function getConnectedServices(): Promise {\n const result = await sqlite.execute(`SELECT service FROM oauth_tokens`);\n return result.rows.map((r: Record) => r.service as string);\n}\n","deleted",false,"label",[47,24],"connectors","721185aa-9345-4fa6-a7de-8fce15275464",["D",1787359546508],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","BYOA Slack agent powered by Claude + Val Town MCP","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/9d7c45b4-38a8-441c-1ffb-cc9c79a0f000/square512?exp=1789666001&sig=87b4b6442c4268c33943faedc50c1fb7509faf9e00baee6265aeab1bca63a601","userId","5d1042a9-7b0b-499d-8a72-3a8ac7a4e185","pinnedFileId","01a026ee-4ccc-72a8-897e-b050402a80c5","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","5f80108f-7ca4-4327-b77b-089dbe4b5a82","tursoName","721185aa93454fa6a7de8fce15275464","tursoHostname","721185aa93454fa6a7de8fce15275464-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789618867318],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_111":107},"org",{"_9":10,"_105":-5,"_106":107,"_59":60,"_108":109,"_110":44},"branch",{"_37":32,"_11":92,"_22":30,"_93":48,"_94":95,"_96":97,"_98":53,"_99":100,"_101":102,"_103":12,"_104":10},"isOwned","main","projectId","forkedBranchId","22878860-7ef2-46a5-b121-c919b4589b8d","forkedBranchVersion",229,"forkedProjectPrivacy","forkedProjectId","c15ce0c4-49b2-4207-bd81-70dcc91daf31","forkedProjectOrgId","019aa807-52c2-709c-928b-2029bae9a558","projectName","userHandle","displayName","avatar","https://secure.gravatar.com/avatar/0129a541b7b3574e92c4afd06c5e32da&d=identicon","tier","pro","canRestrictVals","profileImageUrl","ctx",{"_85":-5,"_145":146,"_147":148,"_149":150,"_151":44,"_152":44,"_153":44,"_154":34,"_155":-5,"_156":-7,"_157":-7,"_158":38,"_159":44,"_160":44,"_161":-5,"_162":44,"_163":44,"_164":44,"_165":-5},"ENV",{"_116":117,"_118":119,"_120":92,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140,"_141":142,"_143":144},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","a3e067d4463eea85f6334f8e583e8516ae58c4f6","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]