[{"_1":2,"_170":-5,"_171":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","96591c8dbfc078fdbadefbda462961392fdd9880","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_148":149,"_167":168,"_169":-5},"handle","theguythatmakesstuff","name","reborn-auth","path","main.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":-5,"_111":-5,"_12":112,"_113":-5,"_114":20,"_115":-5,"_116":-5,"_117":32,"_14":118,"_119":120,"_121":120,"_122":123,"_124":123,"_125":123,"_126":120,"_127":120,"_23":128,"_131":132,"_134":135,"_147":20},"id","3ce7af70-e467-11f0-98f4-42dde27851f2","createdAt",["D",1766979250303],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","019b67f9-870c-75ac-9bb3-2238af5e603d","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019b67f9-870c-75ac-9bb3-24210d3c5641","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_129":130},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zN1Y2Yk5SZFd1TU41ZU1TbXB4Nnc3Q1VnU2wifQ","org",{"_94":95,"_133":130,"_12":112},"avatar","branch",{"_136":137,"_96":44,"_102":138,"_139":103,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":97,"_146":95},"version",5,"3ce7ef76-e467-11f0-98f4-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":150,"_96":99,"_151":152,"_153":-5,"_154":138,"_155":137,"_156":157,"_104":158,"_136":159,"_160":161,"_162":163,"_164":20,"_165":-5,"_98":166},"483f97d8-e468-11f0-96a1-42dde27851f2","fileId","3ce96c0c-e467-11f0-98f4-42dde27851f2","parentId","branchId","branchVersion","latest",true,["D",1766979698827],4,"fileType","http","content","// Learn more: https://docs.val.town/vals/http\n// Single-file HTTP val handler with zero external packages.\n// Implements minimal auth: /health, /, /auth/login, /auth/me, /auth/logout\n\n// --- Config (edit these for val.run) ---\nconst AUTH_SHARED_SECRET = \"replace-with-strong-secret\"; // required\nconst AUTH_ALLOWED_EMAILS = [\"user@example.com\", \"admin@example.com\"]; // [] allows any email\nconst AUTH_PASSWORD = \"replace-with-demo-password\"; // required\nconst AUTH_TOKEN_TTL = \"1h\"; // e.g., \"3600s\", \"60m\", \"1h\"\nconst COOKIE_DOMAIN = \"\"; // set to your domain to enable cookie mode\nconst NODE_ENV = \"production\";\n\n// --- Helpers ---\nconst te = new TextEncoder();\nconst td = new TextDecoder();\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);\n return btoa(binary);\n}\n\nfunction base64ToBytes(base64: string): Uint8Array {\n const binary = atob(base64);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n return out;\n}\n\nfunction base64urlEncode(bytes: Uint8Array): string {\n const str = bytesToBase64(bytes);\n return str.replace(/=+$/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n}\n\nfunction base64urlEncodeJSON(obj: unknown): string {\n const json = JSON.stringify(obj);\n return base64urlEncode(te.encode(json));\n}\n\nfunction base64urlDecodeToJSON(b64: string): T | null {\n try {\n const normalized = b64.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (b64.length % 4)) % 4);\n const bytes = base64ToBytes(normalized);\n const json = td.decode(bytes);\n return JSON.parse(json) as T;\n } catch {\n return null;\n }\n}\n\nfunction parseTTL(ttl: string): number {\n const m = ttl.match(/^(\\d+)([smh])$/);\n if (!m) return 3600; // default 1h\n const n = Number(m[1]);\n const unit = m[2];\n if (unit === \"s\") return n;\n if (unit === \"m\") return n * 60;\n if (unit === \"h\") return n * 3600;\n return 3600;\n}\n\nasync function importHMACKey(secret: string): Promise {\n return crypto.subtle.importKey(\n \"raw\",\n te.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"]\n );\n}\n\nasync function hmacSign(secret: string, data: string): Promise {\n const key = await importHMACKey(secret);\n const sig = await crypto.subtle.sign(\"HMAC\", key, te.encode(data));\n return base64urlEncode(new Uint8Array(sig));\n}\n\nasync function hmacVerify(secret: string, data: string, signature: string): Promise {\n const key = await importHMACKey(secret);\n const normalized = signature.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (signature.length % 4)) % 4);\n const sigBytes = base64ToBytes(normalized);\n return crypto.subtle.verify(\"HMAC\", key, sigBytes, te.encode(data));\n}\n\n// --- Bot detection ---\nfunction isLikelyBot(req: Request): boolean {\n const ua = (req.headers.get(\"user-agent\") || \"\").toLowerCase();\n if (!ua) return true; // missing UA is suspicious\n const patterns = [\n \"bot\",\n \"spider\",\n \"crawl\",\n \"slurp\",\n \"fetch\",\n \"monitor\",\n \"headlesschrome\",\n \"phantom\",\n \"facebookexternalhit\",\n \"twitterbot\",\n \"slackbot\",\n \"discordbot\",\n \"telegrambot\",\n \"applebot\",\n \"baiduspider\",\n \"bingbot\",\n \"duckduckbot\",\n \"yandexbot\",\n \"ahrefsbot\",\n \"semrush\",\n \"curl\",\n \"wget\",\n \"postman\",\n \"insomnia\",\n \"httpclient\",\n \"okhttp\",\n \"guzzle\",\n \"libwww-perl\",\n \"python-requests\",\n \"aiohttp\",\n \"scrapy\",\n ];\n return patterns.some((p) => ua.includes(p));\n}\n\nfunction withBotHeader(req: Request, headers: HeadersInit = {}): HeadersInit {\n const isBot = isLikelyBot(req);\n return { ...headers, \"x-is-bot\": String(isBot) };\n}\n\n// --- Minimal JWT (HS256) ---\nasync function jwtSignHS256(payload: Record, secret: string): Promise {\n const header = { alg: \"HS256\", typ: \"JWT\" };\n const exp = Math.floor(Date.now() / 1000) + parseTTL(AUTH_TOKEN_TTL);\n const fullPayload = { ...payload, exp };\n const h = base64urlEncodeJSON(header);\n const p = base64urlEncodeJSON(fullPayload);\n const data = `${h}.${p}`;\n const sig = await hmacSign(secret, data);\n return `${data}.${sig}`;\n}\n\nasync function jwtVerifyHS256(token: string, secret: string): Promise | null> {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const [h, p, s] = parts;\n const ok = await hmacVerify(secret, `${h}.${p}`, s);\n if (!ok) return null;\n const payload = base64urlDecodeToJSON>(p);\n if (!payload) return null;\n const exp = Number((payload as any).exp || 0);\n if (!exp || Math.floor(Date.now() / 1000) > exp) return null;\n return payload;\n}\n\nfunction json(status: number, body: unknown, headers: HeadersInit = {}): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...headers },\n });\n}\n\nfunction notFound(): Response {\n return json(404, { error: \"Not found\" });\n}\n\nfunction unauthorized(msg = \"Unauthorized\"): Response {\n return json(401, { error: msg });\n}\n\nfunction parseCookies(req: Request): Record {\n const raw = req.headers.get(\"cookie\") || \"\";\n const out: Record = {};\n raw.split(\";\").forEach((part) => {\n const [k, ...rest] = part.trim().split(\"=\");\n if (!k) return;\n out[k] = decodeURIComponent(rest.join(\"=\"));\n });\n return out;\n}\n\nfunction getTokenFromReq(req: Request): string | null {\n const auth = req.headers.get(\"authorization\") || \"\";\n if (auth.startsWith(\"Bearer \")) return auth.slice(7);\n const cookies = parseCookies(req);\n return cookies[\"auth_token\"] || null;\n}\n\nasync function handleLogin(req: Request): Promise {\n let body: any = {};\n try {\n body = await req.json();\n } catch {}\n const email = String(body?.email || \"\").trim();\n const password = String(body?.password || \"\").trim();\n if (!email || !password) return json(400, { error: \"Invalid request\" });\n\n const allowed = AUTH_ALLOWED_EMAILS.length === 0 || AUTH_ALLOWED_EMAILS.includes(email);\n const passwordOk = password === AUTH_PASSWORD;\n if (!allowed || !passwordOk) return unauthorized(\"Invalid credentials\");\n\n const token = await jwtSignHS256({ email }, AUTH_SHARED_SECRET);\n\n if (COOKIE_DOMAIN) {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=${token}; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=${parseTTL(AUTH_TOKEN_TTL)}`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n }\n return json(200, { token, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nasync function handleMe(req: Request): Promise {\n const token = getTokenFromReq(req);\n if (!token) return unauthorized(\"Missing token\");\n const payload = await jwtVerifyHS256(token, AUTH_SHARED_SECRET);\n if (!payload) return unauthorized(\"Invalid token\");\n return json(200, { user: { email: (payload as any).email }, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nfunction handleLogout(req: Request): Response {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=0`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const { pathname } = url;\n\n if (req.method === \"GET\" && pathname === \"/health\") {\n return json(200, { ok: true, env: NODE_ENV, isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"GET\" && pathname === \"/\") {\n return json(200, { status: \"Auth server ready\", isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"POST\" && pathname === \"/auth/login\") {\n return handleLogin(req);\n }\n if (req.method === \"GET\" && pathname === \"/auth/me\") {\n return handleMe(req);\n }\n if (req.method === \"POST\" && pathname === \"/auth/logout\") {\n return handleLogout(req);\n }\n if (req.method === \"GET\" && pathname === \"/bot\") {\n return json(200, { isBot: isLikelyBot(req), userAgent: req.headers.get(\"user-agent\") || \"\" }, withBotHeader(req));\n }\n return notFound();\n}","deleted","label",[99],"permalink","https://www.val.town/x/theguythatmakesstuff/reborn-auth/code/main.ts","extension","actionData","errors"]