[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","orbem","name","airtable-approval-form","path","index.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/orbem/airtable-approval-form/code/index.ts","extension","id","d19b1f89-2bb9-423f-ad25-e3f3d5ec5d77","fileId","65372a4c-9bc2-11f1-8237-1607ee4eb77e","parentId","branchId","9b9abaa1-d920-4c6c-9e30-bb9fac0049e3","branchVersion",22,"latest",true,"createdAt",["D",1787237203893],"version",15,"fileType","http","content","// Airtable-backed approval form, gated behind Airtable OAuth sign-in.\n//\n// URL: /?record=recXXXX (the Airtable record id)\n//\n// Flow:\n// - Anyone not signed in is redirected to /auth/login → Airtable's OAuth.\n// - On return, /auth/callback exchanges the code, verifies via whoami and\n// creates a session (stored in SQLite; id in an httpOnly cookie).\n// - The record is read/written using the AIRTABLE_API_KEY env var (Option B:\n// the user's OAuth token is only used as an identity gate, so sign-in works\n// even if the approver isn't a base collaborator).\n//\n// Env vars required:\n// AIRTABLE_CLIENT_ID Airtable OAuth integration client id (set)\n// AIRTABLE_CLIENT_SECRET optional; omit unless you generate one in Airtable\n// AIRTABLE_API_KEY personal access token (data.records:read + write)\n//\n// OAuth callback URL (register this in the Airtable integration):\n// https://airtable-approval.val.run/auth/callback\n\nimport {\n buildAuthorizeUrl,\n exchangeCode,\n generateCodeChallenge,\n generateCodeVerifier,\n refreshAccessToken,\n whoami,\n} from \"./oauth.ts\";\nimport type { Tokens, WhoAmI } from \"./oauth.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---------- helpers ----------\n\nconst error = (msg: string, status = 500) =>\n new Response(`

Error

${escapeHtml(msg)}

`, {\n status,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n\nconst escapeHtml = (s: string) =>\n s.replace(\n /[&<>\"']/g,\n (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" })[\n c\n ]!,\n );\n\nconst methodNotAllowed = () =>\n new Response(\"Method Not Allowed\", { status: 405 });\n\n// Val Town's Response.redirect is unreliable; use a raw 302.\nconst redirect = (location: string) =>\n new Response(null, { status: 302, headers: { Location: location } });\n\nconst base = \"https://api.airtable.com/v0\";\n\n// All non-secret configuration lives here.\nconst config = {\n baseId: \"appmol7FrK9ONzsv6\", // the Airtable base id\n table: \"tblNwX4Wmd257B9yY\", // the table name or id\n // Field names in the table for the approval workflow:\n approverField: \"Approver\",\n noteField: \"Approver note\",\n statusField: \"Status\",\n // Fields describing what the approval is for (fetched & rendered):\n titleField: \"Title\",\n descriptionField: \"Description\",\n requestedByField: \"Requested by\",\n};\n\n// ---------- cookies ----------\n\nconst SESSION_COOKIE = \"airtable_session\";\nconst STATE_COOKIE = \"oauth_state\";\n\nfunction parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") ?? \"\";\n const out: Record = {};\n for (const part of header.split(\";\")) {\n const i = part.indexOf(\"=\");\n if (i === -1) continue;\n out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());\n }\n return out;\n}\n\nfunction cookieHeader(name: string, value: string, maxAge: number): string {\n return [\n `${name}=${encodeURIComponent(value)}`,\n \"Path=/\",\n \"HttpOnly\",\n \"SameSite=Lax\",\n \"Secure\",\n `Max-Age=${maxAge}`,\n ].join(\"; \");\n}\n\nconst randomId = () => crypto.randomUUID();\n\n// ---------- sessions (SQLite) ----------\n\ntype SessionRow = {\n id: string;\n airtable_id: string;\n email: string;\n access_token: string;\n refresh_token: string;\n expires_at: number;\n};\n\nasync function ensureSessionsTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS oauth_sessions (\n id TEXT PRIMARY KEY,\n airtable_id TEXT,\n email TEXT,\n access_token TEXT NOT NULL,\n refresh_token TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n created_at TEXT DEFAULT CURRENT_TIMESTAMP,\n updated_at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n}\n\nasync function getSession(id: string): Promise {\n const r = await sqlite.execute(\"SELECT * FROM oauth_sessions WHERE id = ?\", [id]);\n return (r.rows[0] as SessionRow | undefined) ?? null;\n}\n\n/** Load a session, refreshing the Airtable access token when it's expired. */\nasync function resolveSession(id: string | undefined): Promise {\n if (!id) return null;\n let row = await getSession(id);\n if (!row) return null;\n\n if (Date.now() >= row.expires_at - 30_000) {\n try {\n const tok = await refreshAccessToken(row.refresh_token);\n const info = await whoami(tok.access_token).catch(() => null);\n const newExp = Date.now() + (tok.expires_in ?? 3600) * 1000;\n const refreshedToken = tok.refresh_token ?? row.refresh_token;\n await sqlite.execute(\n `UPDATE oauth_sessions\n SET access_token = ?, refresh_token = ?, expires_at = ?, email = ?\n WHERE id = ?`,\n [tok.access_token, refreshedToken, newExp, info?.email ?? row.email, id],\n );\n row = {\n ...row,\n access_token: tok.access_token,\n refresh_token: refreshedToken,\n expires_at: newExp,\n email: info?.email ?? row.email,\n };\n } catch (e) {\n console.error(\"Session refresh failed, dropping session:\", (e as Error).message);\n await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [id]);\n return null;\n }\n }\n return row;\n}\n\nasync function createSession(info: WhoAmI, tok: Tokens): Promise {\n await ensureSessionsTable();\n const id = randomId();\n const expiresAt = Date.now() + (tok.expires_in ?? 3600) * 1000;\n await sqlite.execute(\n `INSERT INTO oauth_sessions (id, airtable_id, email, access_token, refresh_token, expires_at)\n VALUES (?, ?, ?, ?, ?, ?)`,\n [id, info.id, info.email ?? \"\", tok.access_token, tok.refresh_token ?? \"\", expiresAt],\n );\n return id;\n}\n\n// ---------- OAuth flow ----------\n\n// Only ever redirect back to a same-origin relative path (no open redirect).\nfunction normalizeRedirect(p: string | null): string {\n return p && p.startsWith(\"/\") && !p.startsWith(\"//\") ? p : \"/\";\n}\n\nfunction decodeRedirect(encoded: string | undefined): string {\n if (!encoded) return \"/\";\n try {\n return normalizeRedirect(atob(encoded));\n } catch {\n return \"/\";\n }\n}\n\nasync function handleLogin(req: Request): Promise {\n const url = new URL(req.url);\n const redirectTo = normalizeRedirect(url.searchParams.get(\"redirect\"));\n const proceed = url.searchParams.get(\"proceed\") === \"1\";\n\n // First visit: show an interstitial sign-in page with a \"Login with Airtable\"\n // button rather than bouncing the user straight into Airtable's OAuth screen.\n if (!proceed) {\n const loginUrl =\n `/auth/login?proceed=1&redirect=${encodeURIComponent(redirectTo)}`;\n return new Response(\n `\n

🔒 Sign in to review this request

This decision needs an approval. To keep it accountable, please sign in with your Airtable account before continuing.

\n Login with Airtable\n

Signing in only verifies who you are — no access to your Airtable bases is granted.

\n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n const state = randomId();\n // PKCE: generate a per-request verifier, send its S256 challenge to Airtable,\n // and keep the verifier (packed in the state cookie) to present on exchange.\n const verifier = generateCodeVerifier();\n const challenge = await generateCodeChallenge(verifier);\n // Pack the return path + PKCE verifier into the state cookie so we know them\n // after authorize. (base64/verifier contain no \".\" so splitting is safe.)\n const stateValue = `${state}.${btoa(redirectTo)}.${verifier}`;\n const authorizeUrl = buildAuthorizeUrl(\n `${url.origin}/auth/callback`,\n state,\n challenge,\n );\n const h = new Headers({ Location: authorizeUrl });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, stateValue, 600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleCallback(req: Request): Promise {\n const url = new URL(req.url);\n const cookies = parseCookies(req);\n const code = url.searchParams.get(\"code\");\n const returnedState = url.searchParams.get(\"state\");\n\n if (!code) {\n return error(\n `Airtable sign-in was cancelled or failed (${escapeHtml(\n url.searchParams.get(\"error_description\") ?? url.searchParams.get(\"error\") ?? \"no code\",\n )}).`,\n 400,\n );\n }\n\n // Verify the CSRF state matches what we set before the authorize redirect.\n const stateValue = cookies[STATE_COOKIE];\n const expectedState = stateValue?.split(\".\")[0];\n if (!expectedState || returnedState !== expectedState) {\n return error(\"Sign-in did not validate (state mismatch). Please try again.\", 400);\n }\n const parts = stateValue.split(\".\");\n const redirectTo = decodeRedirect(parts[1]);\n const verifier = parts[2];\n\n let tokens: Tokens;\n try {\n tokens = await exchangeCode(code, `${url.origin}/auth/callback`, verifier);\n } catch (e) {\n return error(`Could not complete Airtable sign-in: ${escapeHtml((e as Error).message)}`, 502);\n }\n let info: WhoAmI;\n try {\n info = await whoami(tokens.access_token);\n } catch (e) {\n return error(`Could not verify your Airtable account: ${escapeHtml((e as Error).message)}`, 502);\n }\n\n const sessionId = await createSession(info, tokens);\n const h = new Headers({ Location: redirectTo });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, \"\", 0)); // clear state\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, sessionId, 30 * 24 * 3600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleLogout(req: Request): Promise {\n const url = new URL(req.url);\n const sid = parseCookies(req)[SESSION_COOKIE];\n if (sid) await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [sid]);\n const h = new Headers({ Location: normalizeRedirect(url.searchParams.get(\"redirect\")) });\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, \"\", 0));\n return new Response(null, { status: 302, headers: h });\n}\n\n// \"first.last@x.com\" → \"First Last\"\nfunction displayName(email: string): string {\n const local = (email.split(\"@\")[0] ?? \"\").trim();\n if (!local) return \"\";\n return local.replace(/[._-]+/g, \" \").replace(/\\b\\w/g, (c) => c.toUpperCase());\n}\n\n// Minimal kv store for approvals so they're visible in Val Town too.\nasync function writeMeta(\n recordId: string,\n approver: string,\n note: string,\n status: string,\n) {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS approvals (\n record_id TEXT PRIMARY KEY, approver TEXT, note TEXT, status TEXT, at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n await sqlite.execute(\n `INSERT OR REPLACE INTO approvals (record_id, approver, note, status) VALUES (?, ?, ?, ?)`,\n [recordId, approver, note, status],\n );\n}\n\n// ---------- handler ----------\n\nexport default async function handler(req: Request): Promise {\n await ensureSessionsTable();\n\n const key = Deno.env.get(\"AIRTABLE_API_KEY\");\n if (!key) {\n return error(\n \"Missing AIRTABLE_API_KEY env var. Add it in the val's env vars.\",\n );\n }\n\n const url = new URL(req.url);\n const path = url.pathname;\n\n // OAuth plumbing\n if (path === \"/auth/login\") return req.method === \"GET\" ? handleLogin(req) : methodNotAllowed();\n if (path === \"/auth/callback\") return req.method === \"GET\" ? handleCallback(req) : methodNotAllowed();\n if (path === \"/auth/logout\") return req.method === \"POST\" ? handleLogout(req) : methodNotAllowed();\n\n // Everything else requires Airtable sign-in.\n const session = await resolveSession(parseCookies(req)[SESSION_COOKIE]);\n if (!session) {\n return redirect(`/auth/login?redirect=${encodeURIComponent(url.pathname + url.search)}`);\n }\n const signedInAs = session.email || \"an Airtable user\";\n\n const recordId = url.searchParams.get(\"record\");\n if (!recordId) {\n return error(\"Missing ?record= in the URL.\", 400);\n }\n\n const { baseId, table } = config;\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const decision = form.get(\"decision\")?.toString() || \"\";\n const approver = form.get(\"approver\")?.toString() || \"\";\n const note = form.get(\"note\")?.toString() || \"\";\n\n const status = decision === \"approve\" ? \"Approved\" : \"Declined\";\n\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n method: \"PATCH\",\n headers: {\n Authorization: `Bearer ${key}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n typecast: true,\n fields: { [config.statusField]: status },\n }),\n }).catch((e) => null);\n\n if (!res || !res.ok) {\n const body = res ? await res.text() : \"network error\";\n console.error(\"Airtable PATCH failed:\", res?.status, body);\n return error(`Could not update the record. ${body}`, 502);\n }\n\n // Record who approved (verified sign-in email) alongside the note.\n await writeMeta(recordId, approver || signedInAs, note, status).catch(() => {});\n\n return new Response(\n `\n

✅ ${escapeHtml(decision === \"approve\" ? \"Approved\" : \"Declined\")}

Thanks, your decision for this record has been saved to Airtable.

Signed in as ${escapeHtml(signedInAs)}

\n Back\n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n if (req.method !== \"GET\") {\n return methodNotAllowed();\n }\n\n // GET — fetch record and render form\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n headers: { Authorization: `Bearer ${key}` },\n }).catch(() => null);\n\n if (!res || !res.ok) {\n return error(`Could not fetch record ${recordId}. Is the id valid?`, 404);\n }\n const data = await res.json();\n const recordFields = data.fields || {};\n const title = recordFields[config.titleField] ?? \"Approval request\";\n const description = recordFields[config.descriptionField];\n // Collaborator fields come back as an array of { name } objects.\n const rawRequester = recordFields[config.requestedByField];\n const requestedBy = Array.isArray(rawRequester) && rawRequester.length > 0\n ? rawRequester.map((c: { name?: string }) => c.name).filter(Boolean).join(\", \")\n : \"\";\n\n const nameDefault = displayName(signedInAs);\n\n return new Response(\n `\n

\n Signed in as ${escapeHtml(signedInAs)}\n

${escapeHtml(String(title))}

\n ${requestedBy ? `

Requested by: ${escapeHtml(requestedBy)}

` : \"\"}\n ${\n description\n ? `

${\n escapeHtml(String(description))\n }

`\n : \"\"\n }\n

Review this request and submit your decision.

\n \n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n","deleted",false,"label","airtable-approval",[14],"4d61816f-152b-42a1-8139-861fa01332f5",["D",1787139453377],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Airtable-backed approval form (approve/decline)","imageUrl","userId","45088755-762b-4822-a602-c6427fb13a1a","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a019cc-24df-7478-82d7-5b520124f432","tursoName","4d61816f152b42a18139861fa01332f5","tursoHostname","4d61816f152b42a18139861fa01332f5-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789476648181],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":-5},"org",{"_9":10,"_99":100,"_101":-5,"_56":-5,"_102":103,"_104":42},"branch",{"_35":89,"_11":90,"_22":28,"_91":46,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",23,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Orbem","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":63,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":90,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]