[{"_1":2,"_180":-5,"_181":-5},"loaderData",{"_3":4,"_93":94},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","1f1a009cadcf7353a37b999b92a7f8af633192ea","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":20,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":20,"_92":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":20,"_19":20,"_84":74,"_85":86,"_87":74,"_88":47,"_89":20,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_95":96,"_97":98,"_99":100,"_101":102,"_155":156,"_177":178,"_179":-5},"handle","shapedlines","name","loki","path","backend/auth.ts","project",{"_103":104,"_97":98,"_105":106,"_107":-5,"_108":20,"_109":110,"_111":-5,"_112":-5,"_12":113,"_114":115,"_116":117,"_118":117,"_119":-5,"_120":33,"_14":121,"_122":-5,"_123":-5,"_124":125,"_126":125,"_127":128,"_129":128,"_130":128,"_131":125,"_132":125,"_23":133,"_136":137,"_141":142,"_154":20},"id","d3df2ae6-4d5b-11f0-b336-76b3cceeab13","createdAt",["D",1750371724044],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","7ed186b0-c78a-4757-a5b0-12c00ac89afa","pinnedFileId","9cf06f84-4d5d-11f0-a672-76b3cceeab13","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","e9195859-3c6b-4b40-bb3e-c11844477fdf","tursoName","tursoHostname","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_134":135},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yYlc2Q1A2eUFyNEdDeXBud0E0bFJyWlJVUzQifQ","org",{"_95":96,"_138":135,"_12":113,"_139":140},"avatar","tier","free","branch",{"_143":144,"_97":45,"_103":145,"_146":104,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":98,"_153":96},"version",336,"d3df7564-4d5b-11f0-b336-76b3cceeab13","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_103":157,"_97":158,"_159":160,"_161":162,"_163":145,"_164":165,"_166":117,"_105":167,"_143":168,"_169":170,"_171":172,"_173":20,"_174":-5,"_99":175},"290d0262-f80c-11f0-891d-42dde27851f2","auth.ts","fileId","7d8fb204-f806-11f0-818c-42dde27851f2","parentId","7c759398-f806-11f0-be4c-42dde27851f2","branchId","branchVersion",324,"latest",["D",1769139156002],2,"fileType","script","content","/**\n * Google OAuth authentication for Loki\n * Handles login, callback, session management, and logout\n */\n\nimport { Hono } from \"https://esm.sh/hono@4.0.0\";\nimport { getCookie, setCookie, deleteCookie } from \"https://esm.sh/hono@4.0.0/cookie\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport type { User, Session } from \"../shared/types.ts\";\nimport { rowToObject, rowsToObjects } from \"./db-utils.ts\";\n\nconst TABLE_PREFIX = \"loki_\";\nconst SESSION_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n// Type for Hono context with user\nexport type AuthContext = {\n Variables: {\n user: User | null;\n session: Session | null;\n };\n};\n\nexport const authRouter = new Hono();\n\n/**\n * Generate a random session token\n */\nfunction generateSessionToken(): string {\n const chars = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\n let token = \"\";\n for (let i = 0; i < 64; i++) {\n token += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n return token;\n}\n\n/**\n * Generate a unique ID\n */\nfunction generateId(): string {\n return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;\n}\n\n/**\n * Store session in blob storage\n */\nasync function createSession(userId: string): Promise {\n const token = generateSessionToken();\n const session: Session = {\n token,\n user_id: userId,\n expires_at: Date.now() + SESSION_EXPIRY_MS,\n };\n await blob.setJSON(`loki_session_${token}`, session);\n return session;\n}\n\n/**\n * Get session from blob storage\n */\nasync function getSession(token: string): Promise {\n try {\n const session = await blob.getJSON(`loki_session_${token}`) as Session;\n if (session && session.expires_at > Date.now()) {\n return session;\n }\n // Session expired, delete it\n if (session) {\n await blob.delete(`loki_session_${token}`);\n }\n return null;\n } catch {\n return null;\n }\n}\n\n/**\n * Delete session from blob storage\n */\nasync function deleteSession(token: string): Promise {\n try {\n await blob.delete(`loki_session_${token}`);\n } catch {\n // Ignore errors\n }\n}\n\n/**\n * Get user by ID from database\n */\nasync function getUserById(userId: string): Promise {\n const result = await sqlite.execute({\n sql: `SELECT id, email, name, avatar_url, created_at FROM ${TABLE_PREFIX}users WHERE id = ?`,\n args: [userId],\n });\n if (result.rows.length === 0) return null;\n \n const row = rowToObject<{ id: string; email: string; name: string | null; avatar_url: string | null; created_at: number }>(\n result.rows[0] as unknown[] | Record,\n result.columns\n );\n \n return {\n id: row.id,\n email: row.email,\n name: row.name,\n avatar_url: row.avatar_url,\n created_at: row.created_at,\n };\n}\n\n/**\n * Get or create user from Google profile\n */\nasync function getOrCreateUser(googleProfile: {\n sub: string;\n email: string;\n name?: string;\n picture?: string;\n}): Promise {\n // Check if user exists\n const existingResult = await sqlite.execute({\n sql: `SELECT id, email, name, avatar_url, created_at FROM ${TABLE_PREFIX}users WHERE id = ?`,\n args: [googleProfile.sub],\n });\n\n if (existingResult.rows.length > 0) {\n const row = rowToObject<{ id: string; email: string; name: string | null; avatar_url: string | null; created_at: number }>(\n existingResult.rows[0] as unknown[] | Record,\n existingResult.columns\n );\n \n // Update user info\n await sqlite.execute({\n sql: `UPDATE ${TABLE_PREFIX}users SET name = ?, avatar_url = ? WHERE id = ?`,\n args: [googleProfile.name || null, googleProfile.picture || null, googleProfile.sub],\n });\n return {\n id: googleProfile.sub,\n email: row.email,\n name: googleProfile.name || null,\n avatar_url: googleProfile.picture || null,\n created_at: row.created_at,\n };\n }\n\n // Create new user\n const now = Math.floor(Date.now() / 1000);\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE_PREFIX}users (id, email, name, avatar_url, created_at) VALUES (?, ?, ?, ?, ?)`,\n args: [googleProfile.sub, googleProfile.email, googleProfile.name || null, googleProfile.picture || null, now],\n });\n\n // Create default notification preferences\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE_PREFIX}notification_prefs (user_id) VALUES (?)`,\n args: [googleProfile.sub],\n });\n\n return {\n id: googleProfile.sub,\n email: googleProfile.email,\n name: googleProfile.name || null,\n avatar_url: googleProfile.picture || null,\n created_at: now,\n };\n}\n\n/**\n * Middleware to authenticate requests\n */\nexport async function authMiddleware(c: any, next: () => Promise) {\n const sessionToken = getCookie(c, \"loki_session\");\n \n if (sessionToken) {\n const session = await getSession(sessionToken);\n if (session) {\n if (!session.user_id) {\n console.error(\"Session has no user_id:\", JSON.stringify(session));\n c.set(\"user\", null);\n c.set(\"session\", null);\n } else {\n const user = await getUserById(session.user_id);\n if (user && !user.id) {\n console.error(\"User object has no id:\", JSON.stringify(user));\n c.set(\"user\", null);\n c.set(\"session\", null);\n } else {\n c.set(\"user\", user);\n c.set(\"session\", session);\n }\n }\n }\n }\n \n if (!c.get(\"user\")) {\n c.set(\"user\", null);\n c.set(\"session\", null);\n }\n \n await next();\n}\n\n/**\n * Middleware to require authentication\n */\nexport async function requireAuth(c: any, next: () => Promise) {\n const user = c.get(\"user\");\n if (!user || !user.id) {\n return c.json({ error: \"Unauthorized\", message: \"Authentication required\" }, 401);\n }\n await next();\n}\n\n/**\n * GET /auth/google - Redirect to Google OAuth\n */\nauthRouter.get(\"/google\", async (c) => {\n const clientId = Deno.env.get(\"GOOGLE_CLIENT_ID\");\n if (!clientId) {\n return c.json({ error: \"Configuration error\", message: \"Google OAuth not configured\" }, 500);\n }\n\n // Get the callback URL from the request\n const requestUrl = new URL(c.req.url);\n const redirectUri = `${requestUrl.protocol}//${requestUrl.host}/auth/callback`;\n \n // Store redirect URI in blob for callback to use\n const state = generateSessionToken();\n await blob.setJSON(`loki_oauth_state_${state}`, {\n redirect_uri: redirectUri,\n expires_at: Date.now() + 10 * 60 * 1000, // 10 minutes\n });\n\n const authUrl = new URL(\"https://accounts.google.com/o/oauth2/v2/auth\");\n authUrl.searchParams.set(\"client_id\", clientId);\n authUrl.searchParams.set(\"redirect_uri\", redirectUri);\n authUrl.searchParams.set(\"response_type\", \"code\");\n authUrl.searchParams.set(\"scope\", \"openid email profile\");\n authUrl.searchParams.set(\"state\", state);\n authUrl.searchParams.set(\"access_type\", \"offline\");\n authUrl.searchParams.set(\"prompt\", \"consent\");\n\n return c.redirect(authUrl.toString());\n});\n\n/**\n * GET /auth/callback - Handle Google OAuth callback\n */\nauthRouter.get(\"/callback\", async (c) => {\n const code = c.req.query(\"code\");\n const state = c.req.query(\"state\");\n const error = c.req.query(\"error\");\n\n if (error) {\n return c.json({ error: \"OAuth error\", message: error }, 400);\n }\n\n if (!code || !state) {\n return c.json({ error: \"Invalid request\", message: \"Missing code or state\" }, 400);\n }\n\n // Verify state\n let stateData: { redirect_uri: string; expires_at: number } | null = null;\n try {\n stateData = await blob.getJSON(`loki_oauth_state_${state}`);\n await blob.delete(`loki_oauth_state_${state}`);\n } catch {\n // State not found\n }\n\n if (!stateData || stateData.expires_at < Date.now()) {\n return c.json({ error: \"Invalid state\", message: \"OAuth state expired or invalid\" }, 400);\n }\n\n const clientId = Deno.env.get(\"GOOGLE_CLIENT_ID\");\n const clientSecret = Deno.env.get(\"GOOGLE_CLIENT_SECRET\");\n\n if (!clientId || !clientSecret) {\n return c.json({ error: \"Configuration error\", message: \"Google OAuth not configured\" }, 500);\n }\n\n try {\n // Exchange code for tokens\n const tokenResponse = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n code,\n client_id: clientId,\n client_secret: clientSecret,\n redirect_uri: stateData.redirect_uri,\n grant_type: \"authorization_code\",\n }),\n });\n\n if (!tokenResponse.ok) {\n const errorData = await tokenResponse.text();\n console.error(\"Token exchange failed:\", errorData);\n return c.json({ error: \"OAuth error\", message: \"Failed to exchange code for tokens\" }, 400);\n }\n\n const tokens = await tokenResponse.json();\n\n // Get user info\n const userInfoResponse = await fetch(\"https://www.googleapis.com/oauth2/v3/userinfo\", {\n headers: { Authorization: `Bearer ${tokens.access_token}` },\n });\n\n if (!userInfoResponse.ok) {\n return c.json({ error: \"OAuth error\", message: \"Failed to get user info\" }, 400);\n }\n\n const googleProfile = await userInfoResponse.json();\n\n // Get or create user\n const user = await getOrCreateUser(googleProfile);\n\n // Create session\n const session = await createSession(user.id);\n\n // Set session cookie\n setCookie(c, \"loki_session\", session.token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: SESSION_EXPIRY_MS / 1000,\n path: \"/\",\n });\n\n // Redirect to app home\n return c.redirect(\"/\");\n } catch (err) {\n console.error(\"OAuth callback error:\", err);\n return c.json({ error: \"OAuth error\", message: \"Authentication failed\" }, 500);\n }\n});\n\n/**\n * GET /auth/me - Get current user\n */\nauthRouter.get(\"/me\", async (c) => {\n const user = c.get(\"user\");\n if (!user || !user.id) {\n return c.json({ user: null, groups: [] });\n }\n\n // Get user's groups\n const groupsResult = await sqlite.execute({\n sql: `\n SELECT g.id, g.name, g.created_by, g.invite_code, g.created_at, gm.role \n FROM ${TABLE_PREFIX}groups g\n JOIN ${TABLE_PREFIX}group_members gm ON g.id = gm.group_id\n WHERE gm.user_id = ?\n `,\n args: [user.id],\n });\n\n type GroupRow = { id: string; name: string; created_by: string; invite_code: string; created_at: number; role: string };\n const groupRows = rowsToObjects(\n groupsResult.rows as (unknown[] | Record)[],\n groupsResult.columns\n );\n\n const groups = groupRows.map(row => ({\n id: row.id,\n name: row.name,\n created_by: row.created_by,\n invite_code: row.invite_code,\n created_at: row.created_at,\n role: row.role,\n }));\n\n return c.json({ user, groups });\n});\n\n/**\n * POST /auth/logout - Log out current user\n */\nauthRouter.post(\"/logout\", async (c) => {\n const sessionToken = getCookie(c, \"loki_session\");\n \n if (sessionToken) {\n await deleteSession(sessionToken);\n }\n \n deleteCookie(c, \"loki_session\", { path: \"/\" });\n \n return c.json({ success: true });\n});\n\nexport { getUserById, getSession };\n","deleted","label",[176,158],"backend","permalink","https://www.val.town/x/shapedlines/loki/code/backend/auth.ts","extension","actionData","errors"]