[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","ngzvhmcf","name","sambkw","path","index.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":12,"_13":44},"permalink","https://www.val.town/x/ngzvhmcf/sambkw/code/index.tsx","extension","id","fee6e4cf-b54a-44b9-8111-8110becc04c1","fileId","89687324-a740-11f1-8395-1607ee4eb77e","parentId","branchId","f3696943-a273-4717-a367-2529b8699f92","branchVersion",8,"latest",true,"createdAt",["D",1788403126103],"version",3,"fileType","http","content","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono@4/cookie\";\nimport {\n base64urlEncode,\n hashPassword,\n sign,\n verify,\n verifyPassword,\n} from \"./lib/security.ts\";\nimport {\n createSession,\n createUser,\n deleteSession,\n findSession,\n findUserByEmail,\n findUserById,\n initDb,\n} from \"./lib/db.ts\";\n\n// Cookie-signing secret. Set SESSION_SECRET env var; falls back to a dev value.\nconst SESSION_SECRET = Deno.env.get(\"SESSION_SECRET\") ?? \"dev-insecure-secret-change-me\";\nconst SESSION_COOKIE = \"sambkw_session\";\nconst SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\nawait initDb();\n\n/** The currently logged-in user, or null. */\nasync function getCurrentUser(c: any) {\n const raw = getCookie(c, SESSION_COOKIE);\n if (!raw) return null;\n const token = await verify(raw, SESSION_SECRET);\n if (!token) return null;\n const session = await findSession(token);\n if (!session) return null;\n if (Date.now() - session.createdAt > SESSION_TTL_MS) {\n await deleteSession(token);\n return null;\n }\n return findUserById(session.userId);\n}\n\nasync function startSession(c: any, userId: number) {\n const token = base64urlEncode(crypto.getRandomValues(new Uint8Array(32)));\n await createSession(token, userId);\n const signed = await sign(token, SESSION_SECRET);\n setCookie(c, SESSION_COOKIE, signed, {\n httpOnly: true,\n sameSite: \"Lax\",\n secure: true,\n maxAge: 30 * 24 * 60 * 60,\n path: \"/\",\n });\n}\n\nconst app = new Hono();\n\n// ---------------------------------------------------------------- Layout\nfunction Layout(props: {\n title: string;\n user?: { email: string } | null;\n children: any;\n}) {\n return (\n \n \n \n \n {props.title} · Sambkw\n \n \n \n \n

{props.children}

\n \n \n );\n}\n\nfunction Input(props: any) {\n return (\n \n );\n}\n\n// ---------------------------------------------------------------- Homepage\napp.get(\"/\", async (c) => {\n const user = await getCurrentUser(c);\n return c.html(\n \n

\n Welcome to sambkw\n

\n A sample website with a complete email + password authentication\n system built on Val Town — SQLite storage, PBKDF2 password hashing,\n and signed session cookies.\n

\n {user ? (\n \n Go to your dashboard\n \n ) : (\n <>\n \n Create an account\n \n \n Log in\n \n \n )}\n

SQLite users

\n Accounts are stored in this val's scoped database.\n

Secure passwords

\n PBKDF2 with per-user salts — plaintext is never stored.\n

Signed sessions

\n HttpOnly cookies with HMAC signatures and expiry.\n

\n ,\n );\n});\n\n// ---------------------------------------------------------------- Signup\napp.get(\"/signup\", async (c) => {\n const user = await getCurrentUser(c);\n if (user) return c.redirect(\"/dashboard\", 303);\n return c.html(\n \n

Create your account

Join Sambkw.

\n ,\n );\n});\n\napp.post(\"/signup\", async (c) => {\n const body = await c.req.parseBody();\n const email = String(body.email ?? \"\").trim().toLowerCase();\n const password = String(body.password ?? \"\");\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return c.html(\"Invalid email address.\", 400);\n }\n if (password.length < 8) {\n return c.html(\"Password must be at least 8 characters.\", 400);\n }\n if (await findUserByEmail(email)) {\n return c.html(\"An account with that email already exists.\", 409);\n }\n const hash = await hashPassword(password);\n const user = await createUser(email, hash);\n await startSession(c, user.id);\n return c.redirect(\"/dashboard\", 303);\n});\n\n// ---------------------------------------------------------------- Login\napp.get(\"/login\", async (c) => {\n const user = await getCurrentUser(c);\n if (user) return c.redirect(\"/dashboard\", 303);\n return c.html(\n \n

Welcome back

\n ,\n );\n});\n\napp.post(\"/login\", async (c) => {\n const body = await c.req.parseBody();\n const email = String(body.email ?? \"\").trim().toLowerCase();\n const password = String(body.password ?? \"\");\n const user = await findUserByEmail(email);\n const ok = user ? await verifyPassword(password, user.passwordHash) : false;\n if (!user || !ok) {\n // Same error for unknown email vs wrong password (no user enumeration).\n return c.html(\"Invalid email or password.\", 401);\n }\n await startSession(c, user.id);\n return c.redirect(\"/dashboard\", 303);\n});\n\n// ---------------------------------------------------------------- Logout\napp.post(\"/logout\", async (c) => {\n const raw = getCookie(c, SESSION_COOKIE);\n if (raw) {\n const token = await verify(raw, SESSION_SECRET);\n if (token) await deleteSession(token);\n }\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n return c.redirect(\"/\", 303);\n});\n\n// ---------------------------------------------------------------- Dashboard (protected)\napp.get(\"/dashboard\", async (c) => {\n const user = await getCurrentUser(c);\n if (!user) return c.redirect(\"/login\", 303);\n return c.html(\n \n

Your dashboard

\n You're logged in. This page is only visible to authenticated users.\n

\n Account\n

Email: {user.email}
User ID: {user.id}
Member since: {new Date(user.createdAt).toLocaleDateString()}

\n ,\n );\n});\n\napp.onError((err, c) => {\n console.error(\"Error:\", err);\n return c.html(\"Something went wrong on the server.\", 500);\n});\n\nexport default app.fetch;\n","deleted",false,"label",[14],"7c95e742-1d59-467e-b1f7-289effbf1692",["D",1788403044901],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Sambkw sample website with working email+password authentication","imageUrl","userId","c1f94b8c-4441-434e-8b7b-3ee79bd9e8f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0651e-7b41-76ac-a4dd-a5dbdd5a1174","tursoName","7c95e7421d59467eb1f7289effbf1692","tursoHostname","7c95e7421d59467eb1f7289effbf1692-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789533091345],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":99},"org",{"_9":10,"_98":99,"_100":99,"_55":56,"_101":102,"_103":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",9,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":89,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]