[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_91":92},"root",{"_5":6,"_34":35,"_64":65},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","ENV",{"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","211a89d56cb938223531f8369b7ef9317a5870ac","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_66":67},"__internal_clerk_state",{"_68":69,"_70":45,"_71":72,"_73":72,"_74":20,"_75":72,"_76":72,"_77":72,"_78":72,"_79":80,"_89":20,"_90":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_81":20,"_19":20,"_82":72,"_83":84,"_85":72,"_86":45,"_87":20,"_88":72},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_93":94,"_95":96,"_97":98,"_99":100,"_149":150,"_172":173,"_174":-5},"handle","tijs","name","location-feed-generator","path","backend/api/anchor-api-old.ts","project",{"_101":102,"_95":96,"_103":104,"_105":-5,"_106":20,"_107":108,"_109":110,"_111":112,"_12":113,"_114":-5,"_115":20,"_116":-5,"_117":118,"_14":119,"_120":121,"_122":121,"_123":124,"_125":124,"_126":124,"_127":121,"_128":121,"_23":129,"_132":133,"_135":136,"_148":20},"id","db7bc7d6-58ab-11f0-bdec-f69ea79377d9","createdAt",["D",1751615559344],"deletedAt","legacyEnvVars","privacy","public","description","This is the Anchor AppView - location based feed generator","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/318e963f-ae91-4683-a733-6c4a3da95500/square512","14049850-28c1-11f0-89c9-c7d0e2d9e1ea","pinnedFileId","pinPreview","screenshotVersion","likeCount",1,"c04d51b2-a7dc-46ca-ad6f-52f47c2906a8","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_93":94,"_130":131},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yd2Nod2N0bE1MWFdEUlRYd083ZE5pbXJ1bDAifQ","org",{"_93":94,"_134":131,"_12":113},"avatar","branch",{"_137":138,"_95":43,"_101":139,"_140":102,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":96,"_147":94},"version",1447,"db7c07aa-58ab-11f0-bdec-f69ea79377d9","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_101":151,"_95":152,"_153":154,"_155":156,"_157":139,"_158":159,"_160":161,"_103":162,"_137":32,"_163":164,"_165":166,"_167":20,"_168":-5,"_97":169},"79717e46-a6ad-11f0-b2c9-0224a6c84d84","anchor-api-old.ts","fileId","79717f04-a6ad-11f0-b2c9-0224a6c84d84","parentId","d93537e6-7467-11f0-a68b-0224a6c84d84","branchId","branchVersion",1403,"latest",true,["D",1760192444471],"fileType","script","content","// @val-town anchorAPI\n// Main HTTP API handler for Anchor AppView\nimport { initializeTables } from \"../database/db.ts\";\nimport { CategoryService } from \"../services/category-service.ts\";\nimport { NominatimService } from \"../services/nominatim-service.ts\";\nimport { PlacesNearbyResponse } from \"../models/place-models.ts\";\nimport { createCheckin } from \"./checkins.ts\";\nimport {\n exportUserData as exportUsers,\n getStatsResponse,\n} from \"../services/user-stats-service.ts\";\nimport { createLike, getLikesForCheckin, removeLike } from \"./likes.ts\";\nimport {\n createComment,\n getCommentsForCheckin,\n removeComment,\n} from \"./comments.ts\";\nimport { sessions } from \"../routes/oauth.ts\";\nimport { migrateUserCheckins } from \"../services/checkin-migration-service.ts\";\n\n/**\n * Validates a checkin record against the current lexicon schema\n * Returns true if valid, false otherwise with console warning\n */\nfunction _isValidCheckinRecord(record: any): boolean {\n if (!record.value) {\n console.warn(`⚠️ Invalid checkin ${record.uri}: missing value`);\n return false;\n }\n\n const value = record.value;\n\n // Check required fields according to app.dropanchor.checkin lexicon\n if (!value.text || typeof value.text !== \"string\") {\n console.warn(`⚠️ Invalid checkin ${record.uri}: missing or invalid text`);\n return false;\n }\n\n if (!value.createdAt || typeof value.createdAt !== \"string\") {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: missing or invalid createdAt`,\n );\n return false;\n }\n\n // Validate coordinates structure\n if (!value.coordinates || typeof value.coordinates !== \"object\") {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: missing or invalid coordinates object`,\n );\n return false;\n }\n\n // Coordinates must have both latitude and longitude\n // They should be strings (for DAG-CBOR compliance) that can be parsed as numbers\n const { latitude, longitude } = value.coordinates;\n\n if (!latitude || !longitude) {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: missing latitude or longitude`,\n );\n return false;\n }\n\n // Check if coordinates are valid numbers (whether string or number type)\n const lat = typeof latitude === \"string\" ? parseFloat(latitude) : latitude;\n const lng = typeof longitude === \"string\" ? parseFloat(longitude) : longitude;\n\n if (isNaN(lat) || isNaN(lng)) {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: coordinates are not valid numbers (lat: ${latitude}, lng: ${longitude})`,\n );\n return false;\n }\n\n // Validate coordinate ranges\n if (lat < -90 || lat > 90) {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: latitude out of range: ${lat}`,\n );\n return false;\n }\n\n if (lng < -180 || lng > 180) {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: longitude out of range: ${lng}`,\n );\n return false;\n }\n\n // Validate addressRef if present (required field)\n if (!value.addressRef || typeof value.addressRef !== \"object\") {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: missing or invalid addressRef`,\n );\n return false;\n }\n\n if (!value.addressRef.uri || !value.addressRef.cid) {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: addressRef missing uri or cid`,\n );\n return false;\n }\n\n // Optional fields validation (if present, must be correct type)\n if (value.category && typeof value.category !== \"string\") {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: category must be a string`,\n );\n return false;\n }\n\n if (value.categoryGroup && typeof value.categoryGroup !== \"string\") {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: categoryGroup must be a string`,\n );\n return false;\n }\n\n if (value.categoryIcon && typeof value.categoryIcon !== \"string\") {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: categoryIcon must be a string`,\n );\n return false;\n }\n\n if (value.image && typeof value.image !== \"object\") {\n console.warn(\n `⚠️ Invalid checkin ${record.uri}: image must be an object`,\n );\n return false;\n }\n\n return true;\n}\n\n// Types for better TypeScript support\ninterface CorsHeaders {\n \"Access-Control-Allow-Origin\": string;\n \"Access-Control-Allow-Methods\": string;\n \"Access-Control-Allow-Headers\": string;\n \"Content-Type\": string;\n [key: string]: string;\n}\n\ninterface Profile {\n handle?: string;\n displayName?: string;\n avatar?: string;\n}\n\ninterface CheckinRecord {\n id: string;\n uri: string;\n author: {\n did: string;\n handle: string;\n displayName?: string;\n avatar?: string;\n };\n text: string;\n createdAt: string;\n coordinates?: {\n latitude: number;\n longitude: number;\n };\n address?: {\n name?: string;\n street?: string;\n locality?: string;\n region?: string;\n country?: string;\n postalCode?: string;\n };\n distance?: number;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const corsHeaders: CorsHeaders = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Cookie\",\n \"Content-Type\": \"application/json\",\n };\n\n // Handle CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsHeaders });\n }\n\n // Initialize database tables - let errors bubble up\n await initializeTables();\n\n // Route to appropriate handler - let errors bubble up\n switch (url.pathname) {\n case \"/api/migrate-checkins\":\n if (req.method === \"POST\") {\n return await handleMigrateCheckins(req, corsHeaders);\n }\n break;\n case \"/api/places/nearby\":\n return await getNearbyPlaces(url, corsHeaders);\n case \"/api/places/search\":\n return await searchPlaces(url, corsHeaders);\n case \"/api/places/categories\":\n return getPlaceCategories(corsHeaders);\n case \"/api/stats\":\n return await getStats(corsHeaders);\n case \"/api/stats/export\":\n return await getUserDataExport(corsHeaders);\n case \"/api/user\":\n return await getUserCheckins(req, corsHeaders);\n default: {\n // Handle likes endpoints: /api/checkins/:identifier/:rkey/likes\n // identifier can be either a DID or a handle\n const likesMatch = url.pathname.match(\n /^\\/api\\/checkins\\/([^\\/]+)\\/([^\\/]+)\\/likes$/,\n );\n if (likesMatch) {\n const [, identifier, rkey] = likesMatch;\n\n // For GET requests, resolve identifier to DID\n if (req.method === \"GET\") {\n let did = identifier;\n if (!identifier.startsWith(\"did:\")) {\n const resolvedDid = await resolveHandleToDid(identifier);\n if (!resolvedDid) {\n return new Response(\n JSON.stringify({\n error: `Failed to resolve handle: ${identifier}`,\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n did = resolvedDid;\n }\n return await getLikesForCheckin(did, rkey, corsHeaders);\n }\n\n if (req.method === \"POST\") {\n return await handleCreateLike(identifier, rkey, req, corsHeaders);\n }\n\n if (req.method === \"DELETE\") {\n return await handleRemoveLike(identifier, rkey, req, corsHeaders);\n }\n }\n\n // Handle comments endpoints: /api/checkins/:identifier/:rkey/comments\n // identifier can be either a DID or a handle\n const commentsMatch = url.pathname.match(\n /^\\/api\\/checkins\\/([^\\/]+)\\/([^\\/]+)\\/comments$/,\n );\n if (commentsMatch) {\n const [, identifier, rkey] = commentsMatch;\n\n // For GET requests, resolve identifier to DID\n if (req.method === \"GET\") {\n let did = identifier;\n if (!identifier.startsWith(\"did:\")) {\n const resolvedDid = await resolveHandleToDid(identifier);\n if (!resolvedDid) {\n return new Response(\n JSON.stringify({\n error: `Failed to resolve handle: ${identifier}`,\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n did = resolvedDid;\n }\n return await getCommentsForCheckin(did, rkey, corsHeaders);\n }\n\n if (req.method === \"POST\") {\n return await handleCreateComment(identifier, rkey, req, corsHeaders);\n }\n\n if (req.method === \"DELETE\") {\n return await handleRemoveComment(identifier, rkey, req, corsHeaders);\n }\n }\n\n // Handle DELETE /api/checkins/:did/:rkey (authenticated endpoint)\n if (req.method === \"DELETE\") {\n const deleteMatch = url.pathname.match(\n /^\\/api\\/checkins\\/([^\\/]+)\\/([^\\/]+)$/,\n );\n if (deleteMatch) {\n const [, did, rkey] = deleteMatch;\n return await deleteCheckin(did, rkey, req, corsHeaders);\n }\n }\n // Handle POST /api/checkins (create checkin)\n if (url.pathname === \"/api/checkins\" && req.method === \"POST\") {\n return await handleCreateCheckin(req, corsHeaders);\n }\n\n // Handle GET /api/checkins/:did/:rkey (get specific checkin)\n const checkinMatch = url.pathname.match(\n /^\\/api\\/checkins\\/([^\\/]+)\\/([^\\/]+)$/,\n );\n if (checkinMatch) {\n const [, did, rkey] = checkinMatch;\n return await getCheckinByDidAndRkey(did, rkey, corsHeaders);\n }\n\n // Handle GET /api/checkins/:did (get user checkins)\n const userCheckinsMatch = url.pathname.match(\n /^\\/api\\/checkins\\/([^\\/]+)$/,\n );\n if (userCheckinsMatch) {\n const [, did] = userCheckinsMatch;\n return await getUserCheckinsByDid(did, corsHeaders);\n }\n\n // Legacy /api/checkin/:id route for backward compatibility\n if (url.pathname.startsWith(\"/api/checkin/\")) {\n const checkinId = url.pathname.split(\"/api/checkin/\")[1];\n return await getCheckinById(checkinId, corsHeaders);\n }\n\n // Legacy /api/user/:identifier route handled by main.tsx redirect\n\n return new Response(JSON.stringify({ error: \"Not Found\" }), {\n status: 404,\n headers: corsHeaders,\n });\n }\n }\n}\n\n// Unused database-dependent functions removed - PDS-only architecture\n\nasync function getStats(corsHeaders: CorsHeaders): Promise {\n try {\n const statsResponse = await getStatsResponse();\n\n if (statsResponse.success && statsResponse.data) {\n return new Response(JSON.stringify(statsResponse), {\n headers: corsHeaders,\n });\n } else {\n return new Response(\n JSON.stringify({\n success: false,\n error: statsResponse.error || \"Failed to generate user statistics\",\n timestamp: new Date().toISOString(),\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n } catch (error) {\n console.error(\"Stats endpoint error:\", error);\n return new Response(\n JSON.stringify({\n success: false,\n error: \"Internal server error\",\n timestamp: new Date().toISOString(),\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\nasync function getNearbyPlaces(\n url: URL,\n corsHeaders: CorsHeaders,\n): Promise {\n const lat = parseFloat(url.searchParams.get(\"lat\") || \"0\");\n const lng = parseFloat(url.searchParams.get(\"lng\") || \"0\");\n const radius = Math.min(\n parseFloat(url.searchParams.get(\"radius\") || \"300\"),\n 2000, // max 2km for places search\n );\n const categoriesParam = url.searchParams.get(\"categories\");\n const categories = categoriesParam ? categoriesParam.split(\",\") : [];\n const providerParam = url.searchParams.get(\"provider\") || \"overpass\";\n\n // Validate coordinates\n if (!lat || !lng || Math.abs(lat) > 90 || Math.abs(lng) > 180) {\n return new Response(\n JSON.stringify({\n error:\n \"Valid lat and lng parameters required (lat: -90 to 90, lng: -180 to 180)\",\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n\n try {\n // Get provider instance\n const { PlaceProviderFactory } = await import(\n \"../services/places-provider.ts\"\n );\n const provider = await PlaceProviderFactory.create(providerParam);\n\n console.log(`📍 Using places provider: ${provider.name}`);\n\n // Search for nearby places\n const placesWithDistance = await provider.findNearbyPlacesWithDistance(\n { latitude: lat, longitude: lng },\n radius,\n categories,\n );\n\n // Map backend PlaceWithDistance to API format (distanceMeters -> distance)\n const apiPlaces = placesWithDistance.map((place) => ({\n ...place,\n distance: place.distanceMeters, // Map distanceMeters to distance for mobile client\n // Remove distanceMeters to avoid confusion\n distanceMeters: undefined,\n }));\n\n // Format response\n const response: PlacesNearbyResponse = {\n places: apiPlaces,\n radius: radius, // Changed from searchRadius to radius for mobile client\n center: {\n latitude: lat,\n longitude: lng,\n },\n provider: provider.name, // Include provider name in response\n };\n\n return new Response(JSON.stringify(response), { headers: corsHeaders });\n } catch (error) {\n console.error(\"Places search error:\", error);\n\n return new Response(\n JSON.stringify({\n error: \"Failed to search for nearby places\",\n details: error instanceof Error ? error.message : \"Unknown error\",\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\nfunction getPlaceCategories(corsHeaders: CorsHeaders): Response {\n try {\n // Get all category data for mobile app consumption\n const categories = CategoryService.getAllCategoryObjects();\n const defaultSearchCategories = CategoryService\n .getDefaultSearchCategories();\n const sociallyRelevantCategories = CategoryService\n .getSociallyRelevantCategories();\n\n const response = {\n categories,\n defaultSearch: defaultSearchCategories,\n sociallyRelevant: sociallyRelevantCategories,\n metadata: {\n totalCategories: categories.length,\n defaultSearchCount: defaultSearchCategories.length,\n sociallyRelevantCount: sociallyRelevantCategories.length,\n },\n };\n\n return new Response(JSON.stringify(response), {\n status: 200,\n headers: corsHeaders,\n });\n } catch (error) {\n console.error(\"Error fetching place categories:\", error);\n return new Response(\n JSON.stringify({\n error: \"Failed to fetch place categories\",\n details: error instanceof Error ? error.message : \"Unknown error\",\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\n// Create service instances to reuse\nconst nominatimService = new NominatimService();\n\nasync function searchPlaces(\n url: URL,\n corsHeaders: CorsHeaders,\n): Promise {\n // Parse and validate parameters\n const query = url.searchParams.get(\"q\");\n const lat = parseFloat(url.searchParams.get(\"lat\") || \"0\");\n const lng = parseFloat(url.searchParams.get(\"lng\") || \"0\");\n const country = url.searchParams.get(\"country\");\n const limit = Math.min(\n parseInt(url.searchParams.get(\"limit\") || \"10\"),\n 25, // max 25 results\n );\n\n // Validate required parameters\n if (!query || query.trim() === \"\") {\n return new Response(\n JSON.stringify({ error: \"Query parameter 'q' is required\" }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n\n if (!lat || !lng || lat === 0 || lng === 0) {\n return new Response(\n JSON.stringify({\n error: \"Valid latitude and longitude parameters are required\",\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n\n // Validate coordinate ranges\n if (lat < -90 || lat > 90 || lng < -180 || lng > 180) {\n return new Response(\n JSON.stringify({ error: \"Invalid latitude or longitude values\" }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n\n try {\n console.log(\n `Searching places: \"${query}\" near ${lat}, ${lng} (country: ${\n country || \"any\"\n })`,\n );\n\n // Search for places using Nominatim\n const places = await nominatimService.searchPlaces(\n query.trim(),\n { latitude: lat, longitude: lng },\n {\n country,\n limit,\n radiusKm: 2, // 2km search radius for 4x4km box as requested\n },\n );\n\n console.log(`Found ${places.length} places for query: \"${query}\"`);\n\n // Format response to match the existing places API structure\n const response = {\n places,\n query,\n center: {\n latitude: lat,\n longitude: lng,\n },\n radius: 2000, // 2km in meters\n count: places.length,\n };\n\n return new Response(JSON.stringify(response), { headers: corsHeaders });\n } catch (error) {\n console.error(\"Places search error:\", error);\n const errorResponse = {\n error: \"Failed to search for places\",\n details: error instanceof Error ? error.message : \"Unknown error\",\n };\n\n // Return appropriate status code based on error type\n const status =\n error instanceof Error && error.message.includes(\"Rate limit\")\n ? 429\n : 500;\n\n return new Response(JSON.stringify(errorResponse), {\n status,\n headers: corsHeaders,\n });\n }\n}\n\nasync function getCheckinById(\n checkinId: string,\n corsHeaders: CorsHeaders,\n): Promise {\n try {\n // Parse the checkin ID to extract AT URI\n let atUri: string;\n let did: string;\n let rkey: string;\n\n // Try to decode base64 encoded AT URI first\n try {\n atUri = atob(checkinId);\n const match = atUri.match(\n /at:\\/\\/(did:[^\\/]+)\\/app\\.dropanchor\\.checkin\\/(.+)/,\n );\n if (match) {\n [, did, rkey] = match;\n } else {\n throw new Error(\"Invalid AT URI format\");\n }\n } catch {\n // Fallback: try to parse as did_rkey format\n const parts = checkinId.split(\"_\");\n if (parts.length === 2 && parts[0].startsWith(\"did:\")) {\n did = parts[0];\n rkey = parts[1];\n atUri = `at://${did}/app.dropanchor.checkin/${rkey}`;\n } else {\n return new Response(\n JSON.stringify({ error: \"Invalid checkin ID format\" }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n }\n\n // Resolve the PDS URL for this DID\n const pdsUrl = await resolvePdsUrl(did);\n if (!pdsUrl) {\n return new Response(\n JSON.stringify({ error: \"Could not resolve PDS for user\" }),\n {\n status: 404,\n headers: corsHeaders,\n },\n );\n }\n\n // Fetch the check-in record from PDS (public endpoint, no auth needed)\n const checkinResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.getRecord?repo=${did}&collection=app.dropanchor.checkin&rkey=${rkey}`,\n );\n\n if (!checkinResponse.ok) {\n if (checkinResponse.status === 404) {\n return new Response(JSON.stringify({ error: \"Checkin not found\" }), {\n status: 404,\n headers: corsHeaders,\n });\n }\n throw new Error(`Failed to fetch checkin: ${checkinResponse.status}`);\n }\n\n const checkinData = await checkinResponse.json();\n\n // Resolve profile data for the checkin author\n const profileData = await resolveProfileFromPds(did);\n\n // Build the response object\n // Parse string coordinates back to numbers for API response\n const rawCoords = checkinData.value.coordinates;\n const coordinates = {\n latitude: parseFloat(rawCoords.latitude),\n longitude: parseFloat(rawCoords.longitude),\n };\n\n const checkin: any = {\n id: rkey,\n uri: atUri,\n author: {\n did: did,\n handle: profileData?.handle || did,\n displayName: profileData?.displayName,\n avatar: profileData?.avatar,\n },\n text: checkinData.value.text,\n createdAt: checkinData.value.createdAt,\n coordinates,\n };\n\n // Resolve address if addressRef exists\n if (checkinData.value.addressRef) {\n try {\n const addressRkey = checkinData.value.addressRef.uri.split(\"/\").pop();\n const addressResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.getRecord?repo=${did}&collection=community.lexicon.location.address&rkey=${addressRkey}`,\n );\n\n if (addressResponse.ok) {\n const addressData = await addressResponse.json();\n checkin.address = addressData.value;\n }\n } catch (err) {\n console.warn(\"Failed to resolve address for checkin:\", atUri, err);\n }\n }\n\n // Add image URLs if image exists\n if (checkinData.value.image) {\n const thumbCid = checkinData.value.image.thumb.ref.$link;\n const fullsizeCid = checkinData.value.image.fullsize.ref.$link;\n\n checkin.image = {\n thumbUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${thumbCid}`,\n fullsizeUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${fullsizeCid}`,\n alt: checkinData.value.image.alt,\n };\n }\n\n return new Response(JSON.stringify(checkin), {\n status: 200,\n headers: corsHeaders,\n });\n } catch (error) {\n console.error(\"Get checkin error:\", error);\n return new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: corsHeaders,\n });\n }\n}\n\nasync function getUserDataExport(corsHeaders: CorsHeaders): Promise {\n try {\n const users = await exportUsers();\n\n return new Response(\n JSON.stringify({\n success: true,\n data: {\n users,\n totalUsers: users.length,\n exportedAt: new Date().toISOString(),\n },\n timestamp: new Date().toISOString(),\n }),\n {\n headers: {\n ...corsHeaders,\n \"Content-Type\": \"application/json\",\n },\n },\n );\n } catch (error) {\n console.error(\"User data export error:\", error);\n return new Response(\n JSON.stringify({\n success: false,\n error: \"Failed to export user data\",\n timestamp: new Date().toISOString(),\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\n// Helper function to resolve PDS URL from DID\nexport async function resolvePdsUrl(did: string): Promise {\n try {\n // For bsky.social DIDs, use the main PDS\n if (did.includes(\"bsky.social\")) {\n return \"https://bsky.social\";\n }\n\n // For other DIDs, resolve from DID document\n const didResponse = await fetch(`https://plc.directory/${did}`);\n if (!didResponse.ok) {\n throw new Error(`Failed to resolve DID: ${didResponse.status}`);\n }\n\n const didDoc = await didResponse.json();\n const pdsEndpoint = didDoc.service?.find((s: any) =>\n s.id === \"#atproto_pds\" && s.type === \"AtprotoPersonalDataServer\"\n );\n\n return pdsEndpoint?.serviceEndpoint || null;\n } catch (error) {\n console.error(`Failed to resolve PDS for DID ${did}:`, error);\n return null;\n }\n}\n\nexport async function resolveHandleToDid(\n handle: string,\n): Promise {\n try {\n // Normalize handle (remove @ if present)\n const normalizedHandle = handle.startsWith(\"@\") ? handle.slice(1) : handle;\n\n // Try resolving via Slingshot resolver first\n try {\n const slingshotResponse = await fetch(\n `https://slingshot.microcosm.blue/api/v1/resolve-handle/${\n encodeURIComponent(normalizedHandle)\n }`,\n );\n if (slingshotResponse.ok) {\n const data = await slingshotResponse.json();\n if (data.did) {\n return data.did;\n }\n }\n } catch (slingshotError) {\n console.warn(\n \"Slingshot resolver failed, falling back to bsky.social:\",\n slingshotError,\n );\n }\n\n // Fallback to bsky.social resolver\n const response = await fetch(\n `https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=${normalizedHandle}`,\n );\n if (response.ok) {\n const data = await response.json();\n return data.did || null;\n }\n\n return null;\n } catch (error) {\n console.error(\"Failed to resolve handle to DID:\", error);\n return null;\n }\n}\n\nexport async function resolveProfileFromPds(did: string): Promise<\n {\n handle?: string;\n displayName?: string;\n avatar?: string;\n description?: string;\n } | null\n> {\n try {\n const pdsUrl = await resolvePdsUrl(did);\n if (!pdsUrl) {\n return null;\n }\n\n // Fetch profile record from PDS\n const response = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.getRecord?repo=${did}&collection=app.bsky.actor.profile&rkey=self`,\n );\n\n if (!response.ok) {\n return null;\n }\n\n const profileData = await response.json();\n const profile = profileData.value;\n\n // Also try to get the handle from the DID document\n let handle = did; // fallback to DID\n try {\n const didResponse = await fetch(`https://plc.directory/${did}`);\n if (didResponse.ok) {\n const didDoc = await didResponse.json();\n const handleAlias = didDoc.alsoKnownAs?.find((alias: string) =>\n alias.startsWith(\"at://\")\n );\n if (handleAlias) {\n handle = handleAlias.replace(\"at://\", \"\");\n }\n }\n } catch (error) {\n console.warn(\"Failed to resolve handle from DID:\", error);\n }\n\n // Handle avatar blob reference\n let avatarUrl: string | undefined;\n if (profile?.avatar) {\n if (typeof profile.avatar === \"string\") {\n // Already a URL\n avatarUrl = profile.avatar;\n } else if (profile.avatar.ref && typeof profile.avatar.ref === \"object\") {\n // It's a blob reference - construct the URL\n const blobRef = profile.avatar.ref.$link || profile.avatar.ref;\n if (blobRef) {\n avatarUrl =\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${blobRef}`;\n }\n }\n }\n\n return {\n handle,\n displayName: profile?.displayName,\n avatar: avatarUrl,\n description: profile?.description,\n };\n } catch (error) {\n console.error(\"Failed to resolve profile:\", error);\n return null;\n }\n}\n\nasync function handleCreateCheckin(\n req: Request,\n corsHeaders: CorsHeaders,\n): Promise {\n // Only handle POST requests for checkin creation\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ error: \"Method not allowed\" }), {\n status: 405,\n headers: corsHeaders,\n });\n }\n\n // Create a mock Hono Context for the createCheckin function\n const context = {\n req: {\n header: (name: string) => req.headers.get(name),\n json: () => req.json(),\n },\n json: (data: any, status?: number) =>\n new Response(JSON.stringify(data), {\n status: status || 200,\n headers: corsHeaders,\n }),\n };\n\n return await createCheckin(context as any);\n}\n\n// New PDS-based endpoint to get user's own check-ins\nasync function getUserCheckins(\n req: Request,\n corsHeaders: CorsHeaders,\n): Promise {\n try {\n const url = new URL(req.url);\n let userDid = url.searchParams.get(\"did\");\n const identifier = url.searchParams.get(\"identifier\");\n\n // If we have an identifier, determine if it's a DID or handle\n if (identifier && !userDid) {\n if (identifier.startsWith(\"did:\")) {\n userDid = identifier;\n } else {\n // It's a handle, resolve to DID\n userDid = await resolveHandleToDid(identifier);\n if (!userDid) {\n return new Response(\n JSON.stringify({ error: \"Could not resolve handle to DID\" }),\n {\n status: 404,\n headers: corsHeaders,\n },\n );\n }\n }\n }\n\n // If no DID provided, get from authenticated session\n if (!userDid) {\n const { unsealData } = await import(\"npm:iron-session@8.0.4\");\n\n const COOKIE_SECRET = Deno.env.get(\"COOKIE_SECRET\") ||\n \"anchor-default-secret-for-development-only\";\n\n // Extract cookie value and unseal it to get session data\n const cookieHeader = req.headers.get(\"cookie\");\n if (!cookieHeader || !cookieHeader.includes(\"sid=\")) {\n return new Response(\n JSON.stringify({ error: \"Authentication required\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n const sessionCookie = cookieHeader\n .split(\";\")\n .find((c) => c.trim().startsWith(\"sid=\"))\n ?.split(\"=\")[1];\n\n if (!sessionCookie) {\n return new Response(\n JSON.stringify({ error: \"Authentication required\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n let sessionData: any;\n try {\n sessionData = await unsealData(decodeURIComponent(sessionCookie), {\n password: COOKIE_SECRET,\n });\n } catch (_err) {\n return new Response(JSON.stringify({ error: \"Invalid session\" }), {\n status: 401,\n headers: corsHeaders,\n });\n }\n\n if (!sessionData.userId) {\n return new Response(\n JSON.stringify({ error: \"Authentication required\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n userDid = sessionData.userId;\n }\n\n // Always use public PDS access since check-ins are public data\n const targetDid = url.searchParams.get(\"did\") || userDid;\n if (!targetDid) {\n return new Response(\n JSON.stringify({ error: \"No DID provided and user not authenticated\" }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n\n const pdsUrl = await resolvePdsUrl(targetDid);\n if (!pdsUrl) {\n return new Response(\n JSON.stringify({ error: \"Could not resolve PDS for user\" }),\n {\n status: 404,\n headers: corsHeaders,\n },\n );\n }\n\n // Parse query parameters\n const limit = Math.min(\n parseInt(url.searchParams.get(\"limit\") || \"50\"),\n 100,\n );\n const cursor = url.searchParams.get(\"cursor\");\n\n // Fetch check-ins directly from user's PDS (always public access)\n let listRecordsUrl =\n `${pdsUrl}/xrpc/com.atproto.repo.listRecords?repo=${targetDid}&collection=app.dropanchor.checkin&limit=${limit}`;\n if (cursor) {\n listRecordsUrl += `&cursor=${cursor}`;\n }\n\n const response = await fetch(listRecordsUrl);\n\n if (!response.ok) {\n console.error(\n \"Failed to fetch check-ins from PDS:\",\n response.status,\n await response.text(),\n );\n return new Response(\n JSON.stringify({ error: \"Failed to fetch check-ins\" }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n\n const data = await response.json();\n\n // Resolve profile data once for the user\n const profileData = await resolveProfileFromPds(targetDid);\n\n // Format the check-ins for API response\n const checkins = await Promise.all(\n data.records.map(async (record: any) => {\n // Extract basic info from the record\n const rkey = record.uri.split(\"/\").pop(); // Extract rkey from AT URI\n\n // Parse string coordinates back to numbers for API response\n const rawCoords = record.value.coordinates;\n const coordinates = {\n latitude: parseFloat(rawCoords.latitude),\n longitude: parseFloat(rawCoords.longitude),\n };\n\n const checkin: any = {\n id: rkey, // Use simple rkey for cleaner URLs\n uri: record.uri,\n author: {\n did: targetDid,\n handle: profileData?.handle || targetDid,\n displayName: profileData?.displayName,\n avatar: profileData?.avatar,\n },\n text: record.value.text,\n createdAt: record.value.createdAt,\n coordinates,\n };\n\n // Resolve address if addressRef exists\n if (record.value.addressRef) {\n try {\n const addressResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.getRecord?repo=${targetDid}&collection=community.lexicon.location.address&rkey=${\n record.value.addressRef.uri.split(\"/\").pop()\n }`,\n );\n\n if (addressResponse.ok) {\n const addressData = await addressResponse.json();\n checkin.address = addressData.value;\n }\n } catch (err) {\n console.warn(\n \"Failed to resolve address for checkin:\",\n record.uri,\n err,\n );\n }\n }\n\n // Add image URLs if image exists\n if (record.value.image) {\n const thumbCid = record.value.image.thumb.ref.$link;\n const fullsizeCid = record.value.image.fullsize.ref.$link;\n\n checkin.image = {\n thumbUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${targetDid}&cid=${thumbCid}`,\n fullsizeUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${targetDid}&cid=${fullsizeCid}`,\n alt: record.value.image.alt,\n };\n }\n\n return checkin;\n }),\n );\n\n return new Response(\n JSON.stringify({\n checkins,\n cursor: data.cursor,\n }),\n {\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Get my checkins error:\", error);\n return new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: corsHeaders,\n });\n }\n}\n\n// New REST-style handlers\n\n// GET /api/checkins/:did - Get all checkins for a specific user\nasync function getUserCheckinsByDid(\n did: string,\n corsHeaders: CorsHeaders,\n): Promise {\n try {\n // Validate DID format\n if (!did.startsWith(\"did:\")) {\n // Maybe it's a handle, try to resolve it\n const resolvedDid = await resolveHandleToDid(did);\n if (resolvedDid) {\n did = resolvedDid;\n } else {\n return new Response(\n JSON.stringify({ error: \"Invalid DID or handle\" }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n }\n\n const pdsUrl = await resolvePdsUrl(did);\n if (!pdsUrl) {\n return new Response(\n JSON.stringify({ error: \"Could not resolve PDS for user\" }),\n {\n status: 404,\n headers: corsHeaders,\n },\n );\n }\n\n // Fetch check-ins directly from user's PDS\n const listRecordsUrl =\n `${pdsUrl}/xrpc/com.atproto.repo.listRecords?repo=${did}&collection=app.dropanchor.checkin&limit=50`;\n\n const response = await fetch(listRecordsUrl);\n if (!response.ok) {\n console.error(\n \"Failed to fetch check-ins from PDS:\",\n response.status,\n await response.text(),\n );\n return new Response(\n JSON.stringify({ error: \"Failed to fetch check-ins\" }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n\n const data = await response.json();\n\n // Handle case where user has no checkins yet\n if (!data.records || data.records.length === 0) {\n return new Response(\n JSON.stringify({ checkins: [] }),\n {\n status: 200,\n headers: corsHeaders,\n },\n );\n }\n\n // Auto-migrate numeric coordinates in background if needed\n const needsMigration = data.records.some((r: any) =>\n typeof r.value?.coordinates?.latitude === \"number\" ||\n typeof r.value?.coordinates?.longitude === \"number\"\n );\n\n if (needsMigration) {\n const oauthSession = await sessions.getOAuthSession(did);\n if (oauthSession) {\n migrateUserCheckins(oauthSession).catch(() => {}); // silent background migration\n }\n }\n\n // Use all records, not just valid ones - the parsing handles both strings and numbers\n if (data.records.length === 0) {\n console.log(`✅ No checkins found for ${did}`);\n return new Response(\n JSON.stringify({ checkins: [] }),\n {\n status: 200,\n headers: corsHeaders,\n },\n );\n }\n\n // Resolve profile data once for the user\n const profileData = await resolveProfileFromPds(did);\n\n const checkins = await Promise.all(\n data.records.map(async (record: any) => {\n const rkey = record.uri.split(\"/\").pop(); // Extract rkey from AT URI\n\n // Parse coordinates to numbers for API response (handles both strings and numbers)\n const rawCoords = record.value?.coordinates;\n if (!rawCoords || !rawCoords.latitude || !rawCoords.longitude) {\n console.warn(`⚠️ Skipping checkin ${rkey} with missing coordinates`);\n return null;\n }\n\n const coordinates = {\n latitude: typeof rawCoords.latitude === \"number\"\n ? rawCoords.latitude\n : parseFloat(rawCoords.latitude),\n longitude: typeof rawCoords.longitude === \"number\"\n ? rawCoords.longitude\n : parseFloat(rawCoords.longitude),\n };\n\n // Validate parsed coordinates\n if (isNaN(coordinates.latitude) || isNaN(coordinates.longitude)) {\n console.warn(\n `⚠️ Skipping checkin ${rkey} with invalid coordinates: ${rawCoords.latitude}, ${rawCoords.longitude}`,\n );\n return null;\n }\n\n const checkin: any = {\n id: rkey, // Use simple rkey for cleaner URLs\n uri: record.uri,\n author: {\n did: did,\n handle: profileData?.handle || did,\n displayName: profileData?.displayName,\n avatar: profileData?.avatar,\n },\n text: record.value.text,\n createdAt: record.value.createdAt,\n coordinates,\n };\n\n // Resolve address if addressRef exists\n if (record.value.addressRef) {\n try {\n const addressResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.getRecord?repo=${did}&collection=community.lexicon.location.address&rkey=${\n record.value.addressRef.uri.split(\"/\").pop()\n }`,\n );\n\n if (addressResponse.ok) {\n const addressData = await addressResponse.json();\n checkin.address = addressData.value;\n }\n } catch (err) {\n console.warn(\n \"Failed to resolve address for checkin:\",\n record.uri,\n err,\n );\n }\n }\n\n // Add image URLs if image exists\n if (record.value.image) {\n const thumbCid = record.value.image.thumb.ref.$link;\n const fullsizeCid = record.value.image.fullsize.ref.$link;\n\n checkin.image = {\n thumbUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${thumbCid}`,\n fullsizeUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${fullsizeCid}`,\n alt: record.value.image.alt,\n };\n }\n\n return checkin;\n }),\n );\n\n // Filter out null values (records that failed validation)\n const validCheckins = checkins.filter((c) => c !== null);\n\n return new Response(\n JSON.stringify({\n checkins: validCheckins,\n cursor: data.cursor,\n }),\n {\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Get user checkins error:\", error);\n return new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: corsHeaders,\n });\n }\n}\n\n// GET /api/checkins/:identifier/:rkey - Get a specific checkin (identifier can be DID or handle)\nasync function getCheckinByDidAndRkey(\n identifier: string,\n rkey: string,\n corsHeaders: CorsHeaders,\n): Promise {\n try {\n // Resolve identifier to DID (handle if it doesn't start with \"did:\", otherwise use as-is)\n let did: string;\n if (identifier.startsWith(\"did:\")) {\n did = identifier;\n } else {\n // Treat as handle and resolve to DID\n const resolvedDid = await resolveHandleToDid(identifier);\n if (!resolvedDid) {\n return new Response(\n JSON.stringify({ error: \"Could not resolve handle to DID\" }),\n {\n status: 404,\n headers: corsHeaders,\n },\n );\n }\n did = resolvedDid;\n }\n\n const pdsUrl = await resolvePdsUrl(did);\n if (!pdsUrl) {\n return new Response(\n JSON.stringify({ error: \"Could not resolve PDS for user\" }),\n {\n status: 404,\n headers: corsHeaders,\n },\n );\n }\n\n // Fetch the check-in record from PDS\n const checkinResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.getRecord?repo=${did}&collection=app.dropanchor.checkin&rkey=${rkey}`,\n );\n\n if (!checkinResponse.ok) {\n if (checkinResponse.status === 404) {\n return new Response(JSON.stringify({ error: \"Checkin not found\" }), {\n status: 404,\n headers: corsHeaders,\n });\n }\n throw new Error(`Failed to fetch checkin: ${checkinResponse.status}`);\n }\n\n const checkinData = await checkinResponse.json();\n\n // Resolve profile data for the checkin author\n const profileData = await resolveProfileFromPds(did);\n\n // Build the response object\n // Parse string coordinates back to numbers for API response\n const rawCoords = checkinData.value.coordinates;\n const coordinates = {\n latitude: parseFloat(rawCoords.latitude),\n longitude: parseFloat(rawCoords.longitude),\n };\n\n const checkin: any = {\n id: rkey,\n uri: `at://${did}/app.dropanchor.checkin/${rkey}`,\n author: {\n did: did,\n handle: profileData?.handle || did,\n displayName: profileData?.displayName,\n avatar: profileData?.avatar,\n },\n text: checkinData.value.text,\n createdAt: checkinData.value.createdAt,\n coordinates,\n };\n\n // Resolve address if addressRef exists\n if (checkinData.value.addressRef) {\n try {\n const addressRkey = checkinData.value.addressRef.uri.split(\"/\").pop();\n const addressResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.getRecord?repo=${did}&collection=community.lexicon.location.address&rkey=${addressRkey}`,\n );\n\n if (addressResponse.ok) {\n const addressData = await addressResponse.json();\n checkin.address = addressData.value;\n }\n } catch (err) {\n console.warn(\n \"Failed to resolve address for checkin:\",\n checkin.uri,\n err,\n );\n }\n }\n\n // Add image URLs if image exists\n if (checkinData.value.image) {\n const thumbCid = checkinData.value.image.thumb.ref.$link;\n const fullsizeCid = checkinData.value.image.fullsize.ref.$link;\n\n checkin.image = {\n thumbUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${thumbCid}`,\n fullsizeUrl:\n `${pdsUrl}/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${fullsizeCid}`,\n alt: checkinData.value.image.alt,\n };\n }\n\n return new Response(JSON.stringify(checkin), {\n status: 200,\n headers: corsHeaders,\n });\n } catch (error) {\n console.error(\"Get checkin by DID and rkey error:\", error);\n return new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: corsHeaders,\n });\n }\n}\n\nasync function deleteCheckin(\n did: string,\n rkey: string,\n req: Request,\n corsHeaders: Record,\n): Promise {\n try {\n // Check authentication - only the owner can delete their checkin\n const cookieHeader = req.headers.get(\"cookie\");\n console.log(\"DELETE request - Cookie header:\", cookieHeader);\n\n if (!cookieHeader || !cookieHeader.includes(\"sid=\")) {\n console.log(\"DELETE request - No valid session cookie found\");\n return new Response(\n JSON.stringify({ error: \"Authentication required\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n const sessionCookie = cookieHeader\n .split(\";\")\n .find((c) => c.trim().startsWith(\"sid=\"))\n ?.split(\"=\")[1];\n\n console.log(\n \"DELETE request - Session cookie extracted:\",\n sessionCookie ? \"Found\" : \"Not found\",\n );\n\n if (!sessionCookie) {\n return new Response(\n JSON.stringify({ error: \"Authentication required\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n // Get session data using iron-session\n const { unsealData } = await import(\"npm:iron-session@8.0.4\");\n const COOKIE_SECRET = Deno.env.get(\"COOKIE_SECRET\") ||\n \"anchor-default-secret-for-development-only\";\n\n console.log(\"DELETE request - About to unseal session data\");\n let sessionData: any;\n try {\n sessionData = await unsealData(decodeURIComponent(sessionCookie), {\n password: COOKIE_SECRET,\n });\n console.log(\"DELETE request - Session unsealed successfully\");\n console.log(\n \"DELETE request - Session data keys:\",\n Object.keys(sessionData || {}),\n );\n console.log(\n \"DELETE request - Full session data:\",\n JSON.stringify(sessionData, null, 2),\n );\n console.log(\"DELETE request - userId field:\", sessionData?.userId);\n console.log(\"DELETE request - did field:\", sessionData?.did);\n console.log(\"DELETE request - sub field:\", sessionData?.sub);\n } catch (err) {\n console.log(\"DELETE request - Session unseal failed:\", err.message);\n return new Response(JSON.stringify({ error: \"Invalid session\" }), {\n status: 401,\n headers: corsHeaders,\n });\n }\n\n // The session might have different structure - let's check for common user identifier fields\n const userDid = sessionData?.did || sessionData?.userId || sessionData?.sub;\n\n if (!userDid) {\n console.log(\"DELETE request - No user identifier found in session data\");\n return new Response(\n JSON.stringify({ error: \"Authentication required\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n console.log(\n \"DELETE request - Session validation passed, checking DID ownership\",\n );\n\n // Verify that the authenticated user owns the checkin\n console.log(\"DELETE request - Comparing DID ownership:\", {\n sessionUserDid: userDid,\n targetDid: did,\n });\n if (userDid !== did) {\n console.log(\"DELETE request - DID ownership check failed\");\n return new Response(\n JSON.stringify({\n error: \"Forbidden: Can only delete your own checkins\",\n }),\n {\n status: 403,\n headers: corsHeaders,\n },\n );\n }\n\n console.log(\n \"DELETE request - DID ownership confirmed, proceeding with deletion\",\n );\n\n // Get user's PDS URL\n const pdsUrl = await resolvePdsUrl(did);\n if (!pdsUrl) {\n return new Response(\n JSON.stringify({ error: \"Could not resolve PDS for user\" }),\n {\n status: 404,\n headers: corsHeaders,\n },\n );\n }\n\n // Get the stored OAuth session data for API access\n let oauthSession = await sessions.getOAuthSession(did);\n if (!oauthSession) {\n console.log(`DELETE request - No OAuth session found for ${did}`);\n return new Response(\n JSON.stringify({ error: \"OAuth session not found\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n console.log(\n `DELETE request - OAuth session found, attempting to delete from PDS: ${pdsUrl}`,\n );\n console.log(\n `DELETE request - OAuth session structure:`,\n JSON.stringify(oauthSession, null, 2),\n );\n\n // Check if this is a DPoP token (has DPoP keys)\n const sessionAny = oauthSession as any;\n\n // Extract the access token from the correct location (data property)\n let accessToken = oauthSession.accessToken ||\n sessionAny.data?.accessToken;\n\n console.log(\n `DELETE request - AccessToken found:`,\n !!accessToken,\n );\n console.log(\n `DELETE request - AccessToken length:`,\n accessToken?.length,\n );\n console.log(\n `DELETE request - AccessToken prefix:`,\n accessToken?.substring(0, 20) + \"...\",\n );\n\n // Try different ways to access the DPoP keys\n console.log(\n `DELETE request - Direct access to dpopPrivateKeyJWK:`,\n !!sessionAny.dpopPrivateKeyJWK,\n );\n console.log(`DELETE request - All session keys:`, Object.keys(sessionAny));\n console.log(\n `DELETE request - Session own properties:`,\n Object.getOwnPropertyNames(sessionAny),\n );\n\n // Access DPoP keys through the data property\n const oauthSessionData = sessionAny.data;\n console.log(`DELETE request - Session data exists:`, !!oauthSessionData);\n console.log(\n `DELETE request - Session data keys:`,\n oauthSessionData ? Object.keys(oauthSessionData) : \"none\",\n );\n\n let dpopPrivateKey = oauthSessionData?.dpopPrivateKeyJWK;\n let dpopPublicKey = oauthSessionData?.dpopPublicKeyJWK;\n\n console.log(`DELETE request - DPoP private key found:`, !!dpopPrivateKey);\n console.log(`DELETE request - DPoP public key found:`, !!dpopPublicKey);\n\n const hasDpopKeys = !!(dpopPrivateKey && dpopPublicKey);\n console.log(`DELETE request - Token uses DPoP:`, hasDpopKeys);\n\n // Create headers for the request\n const headers: Record = {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${accessToken}`,\n };\n\n // If this is a DPoP token, we need to create a DPoP proof header\n if (hasDpopKeys) {\n try {\n console.log(\"DELETE request - Creating DPoP proof header...\");\n\n // Import necessary modules for DPoP\n const { SignJWT } = await import(\"https://esm.sh/jose@5.4.0\");\n\n // Use the keys we found through iteration\n if (!dpopPrivateKey || !dpopPublicKey) {\n throw new Error(\"DPoP keys not found despite hasDpopKeys being true\");\n }\n\n // Calculate JWK thumbprint for DPoP proof\n const { calculateJwkThumbprint } = await import(\n \"https://esm.sh/jose@5.4.0\"\n );\n let jkt = await calculateJwkThumbprint(dpopPublicKey, \"sha256\");\n\n console.log(\"DELETE request - Calculated JWK thumbprint:\", jkt);\n\n // Check if JWK thumbprint matches the token's expected value\n // Decode the access token to get the expected jkt\n let expectedJkt = null;\n try {\n const tokenParts = accessToken.split(\".\");\n const payload = JSON.parse(atob(tokenParts[1]));\n expectedJkt = payload.cnf?.jkt;\n } catch (e) {\n console.log(\n \"DELETE request - Could not decode token to check jkt:\",\n e.message,\n );\n }\n\n console.log(\n \"DELETE request - Expected JWK thumbprint from token:\",\n expectedJkt,\n );\n\n // If thumbprints don't match, we need to refresh the token first\n if (expectedJkt && jkt !== expectedJkt) {\n console.log(\n \"DELETE request - JWK thumbprint mismatch, forcing token refresh...\",\n );\n\n // Force a token refresh by getting a fresh session\n oauthSession = await sessions.getOAuthSession(did);\n if (!oauthSession) {\n return new Response(\n JSON.stringify({ error: \"Failed to refresh OAuth session\" }),\n { status: 401, headers: corsHeaders },\n );\n }\n\n // Update session data with refreshed session\n const refreshedSessionAny = oauthSession as any;\n const refreshedSessionData = refreshedSessionAny.data;\n accessToken = refreshedSessionData?.accessToken;\n dpopPrivateKey = refreshedSessionData?.dpopPrivateKeyJWK;\n dpopPublicKey = refreshedSessionData?.dpopPublicKeyJWK;\n\n // Recalculate JWK thumbprint with refreshed keys\n const refreshedJkt = await calculateJwkThumbprint(\n dpopPublicKey,\n \"sha256\",\n );\n console.log(\n \"DELETE request - Refreshed JWK thumbprint:\",\n refreshedJkt,\n );\n\n // Update jkt for the DPoP proof\n jkt = refreshedJkt;\n }\n\n // Calculate access token hash for DPoP proof\n const encoder = new TextEncoder();\n const accessTokenBytes = encoder.encode(accessToken);\n const hashBuffer = await crypto.subtle.digest(\n \"SHA-256\",\n accessTokenBytes,\n );\n const hashArray = new Uint8Array(hashBuffer);\n const ath = btoa(String.fromCharCode(...hashArray))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n\n console.log(\"DELETE request - Access token hash (ath):\", ath);\n\n // Extract aud from access token to match its format (needed for DPoP proof)\n let tokenAud = pdsUrl;\n try {\n const tokenParts = accessToken.split(\".\");\n const payload = JSON.parse(atob(tokenParts[1]));\n if (payload.aud) {\n tokenAud = payload.aud;\n console.log(\"DELETE request - Using token aud for DPoP:\", tokenAud);\n }\n } catch (_e) {\n console.log(\n \"DELETE request - Could not extract aud from token, using PDS URL\",\n );\n }\n\n // Try getting DPoP nonce by making a failed authenticated request first\n console.log(\n \"DELETE request - Getting DPoP nonce with failed request strategy...\",\n );\n let dpopNonce = null;\n try {\n // Make a DPoP request without nonce to get a nonce in the error response\n const tempNow = Math.floor(Date.now() / 1000);\n const tempDpopProof = await new SignJWT({\n htm: \"POST\",\n htu: `${pdsUrl}/xrpc/com.atproto.repo.deleteRecord`,\n jkt: jkt,\n ath: ath,\n iat: tempNow,\n jti: crypto.randomUUID(),\n aud: tokenAud,\n })\n .setProtectedHeader({\n alg: \"ES256\",\n typ: \"dpop+jwt\",\n jwk: dpopPublicKey,\n })\n .sign(\n await crypto.subtle.importKey(\n \"jwk\",\n dpopPrivateKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n ),\n );\n\n const nonceResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.deleteRecord`,\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${accessToken}`,\n \"DPoP\": tempDpopProof,\n },\n body: JSON.stringify({\n repo: did,\n collection: \"app.dropanchor.checkin\",\n rkey: rkey,\n }),\n },\n );\n\n // Check for DPoP-Nonce in response headers - this should be the standard two-step process\n dpopNonce = nonceResponse.headers.get(\"DPoP-Nonce\");\n\n // Also check response body for specific DPoP nonce error\n if (!dpopNonce && !nonceResponse.ok) {\n try {\n const errorBody = await nonceResponse.json();\n console.log(\"DELETE request - Error response body:\", errorBody);\n if (errorBody.error === \"use_dpop_nonce\") {\n // This is the expected first response - server requires nonce\n console.log(\n \"DELETE request - Server requires nonce (use_dpop_nonce error)\",\n );\n dpopNonce = nonceResponse.headers.get(\"DPoP-Nonce\");\n }\n } catch (_e) {\n // Ignore JSON parsing errors\n console.log(\"DELETE request - Could not parse error response\");\n }\n }\n\n console.log(\n \"DELETE request - Received DPoP nonce from failed request:\",\n dpopNonce || \"none\",\n );\n if (dpopNonce) {\n console.log(\n \"DELETE request - Successfully obtained nonce via two-step process\",\n );\n }\n } catch (e) {\n console.log(\n \"DELETE request - Failed to get nonce with failed request:\",\n e.message,\n );\n }\n\n // Create DPoP proof using the tokenAud extracted earlier\n const now = Math.floor(Date.now() / 1000);\n const dpopPayload: any = {\n htm: \"POST\",\n htu: `${pdsUrl}/xrpc/com.atproto.repo.deleteRecord`,\n jkt: jkt,\n ath: ath,\n iat: now,\n jti: crypto.randomUUID(),\n aud: tokenAud,\n };\n\n // Add nonce if we received one, or try empty string as fallback\n if (dpopNonce) {\n dpopPayload.nonce = dpopNonce;\n console.log(\n \"DELETE request - Including nonce in DPoP proof:\",\n dpopNonce,\n );\n } else {\n // Try including empty nonce since server returned InvalidToken instead of use_dpop_nonce\n dpopPayload.nonce = \"\";\n console.log(\n \"DELETE request - No server nonce, trying empty nonce fallback\",\n );\n }\n\n const dpopProof = await new SignJWT(dpopPayload)\n .setProtectedHeader({\n alg: \"ES256\",\n typ: \"dpop+jwt\",\n jwk: dpopPublicKey,\n })\n .sign(\n await crypto.subtle.importKey(\n \"jwk\",\n dpopPrivateKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n ),\n );\n\n headers[\"DPoP\"] = dpopProof;\n console.log(\"DELETE request - DPoP proof created successfully\");\n console.log(\n \"DELETE request - DPoP proof headers:\",\n JSON.stringify(headers),\n );\n } catch (dpopError) {\n console.error(\n \"DELETE request - DPoP proof creation failed:\",\n dpopError,\n );\n // Continue without DPoP and see what happens\n }\n }\n\n // Delete the checkin record via AT Protocol\n const deleteUrl = `${pdsUrl}/xrpc/com.atproto.repo.deleteRecord`;\n const deleteBody = {\n repo: did,\n collection: \"app.dropanchor.checkin\",\n rkey: rkey,\n };\n\n console.log(\"DELETE request - Request URL:\", deleteUrl);\n console.log(\"DELETE request - Request body:\", JSON.stringify(deleteBody));\n\n let deleteResponse = await fetch(deleteUrl, {\n method: \"POST\",\n headers,\n body: JSON.stringify(deleteBody),\n });\n\n console.log(\n `DELETE request - Delete response status: ${deleteResponse.status}`,\n );\n console.log(`DELETE request - Delete response ok: ${deleteResponse.ok}`);\n\n // If we get a 401 or 400 token error, try to refresh the token and retry\n if (\n !deleteResponse.ok &&\n (deleteResponse.status === 401 || deleteResponse.status === 400)\n ) {\n console.log(\n \"DELETE request - Token might be expired, attempting to refresh...\",\n );\n\n try {\n // Try to refresh the token by getting a fresh session\n oauthSession = await sessions.getOAuthSession(did);\n\n if (oauthSession) {\n console.log(\"DELETE request - Got fresh session, retrying delete...\");\n\n // Extract the refreshed access token and DPoP keys\n const refreshSessionAny = oauthSession as any;\n const refreshedAccessToken = oauthSession.accessToken ||\n refreshSessionAny.data?.accessToken;\n\n // Create headers for retry request\n const retryHeaders: Record = {\n \"Content-Type\": \"application/json\",\n \"Authorization\": `Bearer ${refreshedAccessToken}`,\n };\n\n // If this is a DPoP token, create a new DPoP proof for the retry\n const retryDpopPrivateKey = refreshSessionAny.data?.dpopPrivateKeyJWK;\n const retryDpopPublicKey = refreshSessionAny.data?.dpopPublicKeyJWK;\n const hasRefreshDpopKeys =\n !!(retryDpopPrivateKey && retryDpopPublicKey);\n\n if (hasRefreshDpopKeys) {\n try {\n console.log(\"DELETE request - Creating DPoP proof for retry...\");\n\n const { SignJWT, calculateJwkThumbprint } = await import(\n \"https://esm.sh/jose@5.4.0\"\n );\n\n // Calculate JWK thumbprint for retry DPoP proof\n const retryJkt = await calculateJwkThumbprint(\n retryDpopPublicKey,\n \"sha256\",\n );\n\n // Calculate access token hash for retry DPoP proof\n const retryEncoder = new TextEncoder();\n const retryAccessTokenBytes = retryEncoder.encode(\n refreshedAccessToken,\n );\n const retryHashBuffer = await crypto.subtle.digest(\n \"SHA-256\",\n retryAccessTokenBytes,\n );\n const retryHashArray = new Uint8Array(retryHashBuffer);\n const retryAth = btoa(String.fromCharCode(...retryHashArray))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n\n // Get fresh DPoP nonce for retry\n console.log(\n \"DELETE request - Getting fresh DPoP nonce for retry with HEAD request...\",\n );\n let retryDpopNonce = null;\n try {\n // Try HEAD request to base XRPC endpoint for retry\n const retryNonceResponse = await fetch(`${pdsUrl}/xrpc/`, {\n method: \"HEAD\",\n });\n retryDpopNonce = retryNonceResponse.headers.get(\"DPoP-Nonce\");\n\n if (!retryDpopNonce) {\n // Try token endpoint for retry nonce\n const retryTokenNonceResponse = await fetch(\n `${pdsUrl}/oauth/token`,\n {\n method: \"HEAD\",\n },\n );\n retryDpopNonce = retryTokenNonceResponse.headers.get(\n \"DPoP-Nonce\",\n );\n }\n\n console.log(\n \"DELETE request - Received retry DPoP nonce:\",\n retryDpopNonce || \"none\",\n );\n } catch (e) {\n console.log(\n \"DELETE request - Failed to get retry nonce:\",\n e.message,\n );\n }\n\n const retryNow = Math.floor(Date.now() / 1000);\n\n // Extract aud from refreshed access token for retry\n let retryTokenAud = pdsUrl;\n try {\n const retryTokenParts = refreshedAccessToken.split(\".\");\n const retryPayload = JSON.parse(atob(retryTokenParts[1]));\n if (retryPayload.aud) {\n retryTokenAud = retryPayload.aud;\n console.log(\n \"DELETE request - Using retry token aud for DPoP:\",\n retryTokenAud,\n );\n }\n } catch (_e) {\n console.log(\n \"DELETE request - Could not extract aud from retry token, using PDS URL\",\n );\n }\n\n const retryDpopPayload: any = {\n htm: \"POST\",\n htu: `${pdsUrl}/xrpc/com.atproto.repo.deleteRecord`,\n jkt: retryJkt,\n ath: retryAth,\n iat: retryNow,\n jti: crypto.randomUUID(),\n aud: retryTokenAud,\n };\n\n // Add nonce if we received one for retry\n if (retryDpopNonce) {\n retryDpopPayload.nonce = retryDpopNonce;\n }\n\n const dpopProof = await new SignJWT(retryDpopPayload)\n .setProtectedHeader({\n alg: \"ES256\",\n typ: \"dpop+jwt\",\n jwk: retryDpopPublicKey,\n })\n .sign(\n await crypto.subtle.importKey(\n \"jwk\",\n retryDpopPrivateKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"sign\"],\n ),\n );\n\n retryHeaders[\"DPoP\"] = dpopProof;\n console.log(\n \"DELETE request - DPoP proof for retry created successfully\",\n );\n } catch (dpopError) {\n console.error(\n \"DELETE request - DPoP proof creation for retry failed:\",\n dpopError,\n );\n }\n }\n\n // Retry the delete with the potentially refreshed token\n deleteResponse = await fetch(\n `${pdsUrl}/xrpc/com.atproto.repo.deleteRecord`,\n {\n method: \"POST\",\n headers: retryHeaders,\n body: JSON.stringify({\n repo: did,\n collection: \"app.dropanchor.checkin\",\n rkey: rkey,\n }),\n },\n );\n }\n } catch (refreshError) {\n console.error(\"DELETE request - Token refresh failed:\", refreshError);\n }\n }\n\n if (!deleteResponse.ok) {\n console.error(\"Failed to delete checkin:\", await deleteResponse.text());\n return new Response(\n JSON.stringify({ error: \"Failed to delete checkin\" }),\n {\n status: deleteResponse.status,\n headers: corsHeaders,\n },\n );\n }\n\n return new Response(\n JSON.stringify({\n success: true,\n message: \"Checkin deleted successfully\",\n }),\n {\n status: 200,\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Delete checkin error:\", error);\n return new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: corsHeaders,\n });\n }\n}\n\n// Handler for creating a like\nasync function handleCreateLike(\n checkinIdentifier: string, // Can be either a DID or a handle\n checkinRkey: string,\n req: Request,\n corsHeaders: Record,\n): Promise {\n try {\n // Check authentication\n const authResult = await getAuthenticatedUserDid(req);\n if (!authResult.success) {\n console.error(\n \"Like auth failed:\",\n authResult.error,\n \"Cookie:\",\n req.headers.get(\"Cookie\"),\n );\n return new Response(JSON.stringify({ error: authResult.error }), {\n status: 401,\n headers: corsHeaders,\n });\n }\n\n const authorDid = authResult.did;\n const oauthSession = authResult.oauthSession;\n\n if (!oauthSession) {\n return new Response(\n JSON.stringify({ error: \"OAuth session not found\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n // Resolve identifier to DID (handles both DIDs and handles)\n let checkinDid = checkinIdentifier;\n if (!checkinIdentifier.startsWith(\"did:\")) {\n // It's a handle, resolve it to a DID\n const resolvedDid = await resolveHandleToDid(checkinIdentifier);\n if (!resolvedDid) {\n return new Response(\n JSON.stringify({\n error: `Failed to resolve handle: ${checkinIdentifier}`,\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n checkinDid = resolvedDid;\n }\n\n // Create the like using OAuth session (handles token refresh and DPoP automatically)\n const result = await createLike(\n checkinDid,\n checkinRkey,\n authorDid,\n oauthSession,\n );\n\n return new Response(\n JSON.stringify({\n success: true,\n like: {\n uri: result.uri,\n createdAt: new Date().toISOString(),\n },\n }),\n {\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Create like error:\", error);\n return new Response(\n JSON.stringify({\n error: error instanceof Error ? error.message : \"Internal server error\",\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\n// Handler for removing a like\nasync function handleRemoveLike(\n checkinIdentifier: string, // Can be either a DID or a handle\n checkinRkey: string,\n req: Request,\n corsHeaders: Record,\n): Promise {\n try {\n // Check authentication\n const authResult = await getAuthenticatedUserDid(req);\n if (!authResult.success) {\n return new Response(JSON.stringify({ error: authResult.error }), {\n status: 401,\n headers: corsHeaders,\n });\n }\n\n const authorDid = authResult.did;\n const oauthSession = authResult.oauthSession;\n\n if (!oauthSession) {\n return new Response(\n JSON.stringify({ error: \"OAuth session not found\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n // Resolve identifier to DID (handles both DIDs and handles)\n let checkinDid = checkinIdentifier;\n if (!checkinIdentifier.startsWith(\"did:\")) {\n // It's a handle, resolve it to a DID\n const resolvedDid = await resolveHandleToDid(checkinIdentifier);\n if (!resolvedDid) {\n return new Response(\n JSON.stringify({\n error: `Failed to resolve handle: ${checkinIdentifier}`,\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n checkinDid = resolvedDid;\n }\n\n // Remove the like using OAuth session (handles token refresh and DPoP automatically)\n await removeLike(\n checkinDid,\n checkinRkey,\n authorDid,\n oauthSession,\n );\n\n return new Response(\n JSON.stringify({\n success: true,\n message: \"Like removed successfully\",\n }),\n {\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Remove like error:\", error);\n return new Response(\n JSON.stringify({\n error: error instanceof Error ? error.message : \"Internal server error\",\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\n// Handler for creating a comment\nasync function handleCreateComment(\n checkinIdentifier: string, // Can be either a DID or a handle\n checkinRkey: string,\n req: Request,\n corsHeaders: Record,\n): Promise {\n try {\n // Check authentication\n const authResult = await getAuthenticatedUserDid(req);\n if (!authResult.success) {\n return new Response(JSON.stringify({ error: authResult.error }), {\n status: 401,\n headers: corsHeaders,\n });\n }\n\n const authorDid = authResult.did;\n const oauthSession = authResult.oauthSession;\n\n if (!oauthSession) {\n return new Response(\n JSON.stringify({ error: \"OAuth session not found\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n // Resolve identifier to DID (handles both DIDs and handles)\n let checkinDid = checkinIdentifier;\n if (!checkinIdentifier.startsWith(\"did:\")) {\n // It's a handle, resolve it to a DID\n const resolvedDid = await resolveHandleToDid(checkinIdentifier);\n if (!resolvedDid) {\n return new Response(\n JSON.stringify({\n error: `Failed to resolve handle: ${checkinIdentifier}`,\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n checkinDid = resolvedDid;\n }\n\n // Parse request body\n const body = await req.json();\n const commentText = body.text;\n\n if (\n !commentText || typeof commentText !== \"string\" ||\n commentText.trim().length === 0\n ) {\n return new Response(\n JSON.stringify({ error: \"Comment text is required\" }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n\n // Create the comment using OAuth session (handles token refresh and DPoP automatically)\n const result = await createComment(\n checkinDid,\n checkinRkey,\n authorDid,\n commentText,\n oauthSession,\n );\n\n return new Response(\n JSON.stringify({\n success: true,\n comment: {\n uri: result.uri,\n text: commentText,\n createdAt: new Date().toISOString(),\n },\n }),\n {\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Create comment error:\", error);\n return new Response(\n JSON.stringify({\n error: error instanceof Error ? error.message : \"Internal server error\",\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\n// Handler for removing a comment\nasync function handleRemoveComment(\n checkinIdentifier: string, // Can be either a DID or a handle\n checkinRkey: string,\n req: Request,\n corsHeaders: Record,\n): Promise {\n try {\n // Check authentication\n const authResult = await getAuthenticatedUserDid(req);\n if (!authResult.success) {\n return new Response(JSON.stringify({ error: authResult.error }), {\n status: 401,\n headers: corsHeaders,\n });\n }\n\n const authorDid = authResult.did;\n const oauthSession = authResult.oauthSession;\n\n if (!oauthSession) {\n return new Response(\n JSON.stringify({ error: \"OAuth session not found\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n // Resolve identifier to DID (handles both DIDs and handles)\n let checkinDid = checkinIdentifier;\n if (!checkinIdentifier.startsWith(\"did:\")) {\n // It's a handle, resolve it to a DID\n const resolvedDid = await resolveHandleToDid(checkinIdentifier);\n if (!resolvedDid) {\n return new Response(\n JSON.stringify({\n error: `Failed to resolve handle: ${checkinIdentifier}`,\n }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n checkinDid = resolvedDid;\n }\n\n // Parse request body to get comment rkey\n const body = await req.json();\n const commentRkey = body.commentRkey;\n\n if (!commentRkey || typeof commentRkey !== \"string\") {\n return new Response(\n JSON.stringify({ error: \"Comment rkey is required\" }),\n {\n status: 400,\n headers: corsHeaders,\n },\n );\n }\n\n // Remove the comment using OAuth session (handles token refresh and DPoP automatically)\n await removeComment(\n checkinDid,\n checkinRkey,\n commentRkey,\n authorDid,\n oauthSession,\n );\n\n return new Response(\n JSON.stringify({\n success: true,\n message: \"Comment removed successfully\",\n }),\n {\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Remove comment error:\", error);\n return new Response(\n JSON.stringify({\n error: error instanceof Error ? error.message : \"Internal server error\",\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n\n// Helper function to get authenticated user DID and OAuth session\nasync function getAuthenticatedUserDid(req: Request): Promise<{\n success: boolean;\n did?: string;\n oauthSession?: any;\n error?: string;\n}> {\n try {\n // Extract session cookie (OAuth package uses \"sid\" as cookie name)\n const cookieHeader = req.headers.get(\"cookie\");\n if (!cookieHeader || !cookieHeader.includes(\"sid=\")) {\n return { success: false, error: \"Authentication required\" };\n }\n\n const sessionCookie = cookieHeader\n .split(\";\")\n .find((c) => c.trim().startsWith(\"sid=\"))\n ?.split(\"=\")[1];\n\n if (!sessionCookie) {\n console.error(\"No sid cookie found in:\", cookieHeader);\n return { success: false, error: \"Authentication required\" };\n }\n\n // Unseal session data\n const { unsealData } = await import(\"npm:iron-session@8.0.4\");\n const COOKIE_SECRET = Deno.env.get(\"COOKIE_SECRET\") ||\n \"anchor-default-secret-for-development-only\";\n\n const sessionData = await unsealData(decodeURIComponent(sessionCookie), {\n password: COOKIE_SECRET,\n });\n\n const userDid = (sessionData as any)?.did || (sessionData as any)?.userId ||\n (sessionData as any)?.sub;\n if (!userDid) {\n console.error(\"No DID in session data:\", sessionData);\n return { success: false, error: \"Authentication required\" };\n }\n\n // Get OAuth session using sessions manager (provides makeRequest and other methods)\n const { sessions } = await import(\"../routes/oauth.ts\");\n const oauthSession = await sessions.getOAuthSession(userDid);\n\n if (!oauthSession) {\n console.error(\"No OAuth session found for DID:\", userDid);\n return { success: false, error: \"OAuth session not found\" };\n }\n\n return { success: true, did: userDid, oauthSession };\n } catch (error) {\n console.error(\"Authentication error:\", error);\n return { success: false, error: \"Authentication failed\" };\n }\n}\n\n/**\n * Handler for POST /api/migrate-checkins\n * Migrates user's checkins to ensure coordinates are strings (DAG-CBOR compliance)\n */\nasync function handleMigrateCheckins(\n req: Request,\n corsHeaders: Record,\n): Promise {\n try {\n // Check authentication\n const authResult = await getAuthenticatedUserDid(req);\n if (!authResult.success) {\n return new Response(JSON.stringify({ error: authResult.error }), {\n status: 401,\n headers: corsHeaders,\n });\n }\n\n const oauthSession = authResult.oauthSession;\n if (!oauthSession) {\n return new Response(\n JSON.stringify({ error: \"OAuth session not found\" }),\n {\n status: 401,\n headers: corsHeaders,\n },\n );\n }\n\n console.log(`🔧 Starting migration for ${authResult.did}`);\n\n // Run migration\n const result = await migrateUserCheckins(oauthSession);\n\n return new Response(\n JSON.stringify({\n success: true,\n migrated: result.migrated,\n failed: result.failed,\n errors: result.errors,\n }),\n {\n status: 200,\n headers: corsHeaders,\n },\n );\n } catch (error) {\n console.error(\"Migration endpoint error:\", error);\n return new Response(\n JSON.stringify({\n error: \"Migration failed\",\n details: error instanceof Error ? error.message : String(error),\n }),\n {\n status: 500,\n headers: corsHeaders,\n },\n );\n }\n}\n","deleted","label",[170,171,152],"backend","api","permalink","https://www.val.town/x/tijs/location-feed-generator/code/backend/api/anchor-api-old.ts","extension","actionData","errors"]