Радар рекламных лидов

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","umgroupkzcommits","name","uls-radar-reklamy","path","src/dash/auth.ts","project",{"_22":49,"_11":12,"_35":50,"_51":-5,"_52":44,"_53":54,"_55":54,"_56":57,"_58":-5,"_59":60,"_61":62,"_63":34,"_64":-5,"_65":-5,"_66":38,"_67":68,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/umgroupkzcommits/uls-radar-reklamy/code/src/dash/auth.ts","extension","id","d121e752-e585-4a1f-a1b7-b94b65f9d6a9","auth.ts","fileId","7e4c5be8-aac6-11f1-b22f-1607ee4eb77e","parentId","ea2bc655-318f-4a1f-8393-ec5c5fa3f307","branchId","bfd39142-8f6a-4087-8abb-f6da5f96742a","branchVersion",10,"latest",true,"createdAt",["D",1788790492401],"version",0,"fileType","script","content","/** На странице телефоны клиентов, поэтому вход закрыт паролем (Д11). Пароль\n * живёт в переменной окружения и в разметку никогда не попадает.\n * В куке хранится подписанный токен, не сам пароль (Critical). */\n\n/** Сравнивает две строки устойчиво ко времени (constant-time). Экспортирована\n * для входа по паролю в dash.ts: обычное === посимвольно раскрывает совпавший\n * префикс через время ответа (находка 2 ревью задачи 11). */\nexport function сравнитьУстойчиво(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n\n let разница = 0;\n for (let i = 0; i < a.length; i++) {\n разница |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return разница === 0;\n}\n\n/** Кодирует массив байт в base64url без выравнивающих знаков. */\nfunction base64url(bytes: Uint8Array): string {\n const binary = Array.from(bytes).map((b) => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\n/** Подписывает срок для куки. Возвращает строку вида «срок.подпись». */\nexport async function подписать(пароль: string, срок: number): Promise {\n const сообщение = `dash-v1|${срок}`;\n const ключ = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(пароль),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const подпись_bytes = await crypto.subtle.sign(\n \"HMAC\",\n ключ,\n new TextEncoder().encode(сообщение),\n );\n const подпись = base64url(new Uint8Array(подпись_bytes));\n return `${срок}.${подпись}`;\n}\n\n/** Проверяет токен куки. Возвращает true если токен верен и не просрочен. */\nexport async function проверить(\n пароль: string,\n токен: string,\n сейчас: number,\n): Promise {\n const части = токен.split(\".\");\n if (части.length !== 2) return false;\n\n const [сроквтексте, подпись_полученная] = части;\n if (!/^\\d+$/.test(сроквтексте)) return false;\n\n const срок = Number(сроквтексте);\n if (!Number.isSafeInteger(срок)) return false;\n if (String(срок) !== сроквтексте) return false;\n if (срок <= сейчас) return false;\n\n const подпись_ожидаемая = await подписать(пароль, срок);\n return сравнитьУстойчиво(\n подпись_ожидаемая.split(\".\")[1]!,\n подпись_полученная,\n );\n}\n\nexport async function пропущен(\n req: Request,\n пароль: string,\n сейчас: number = Date.now(),\n): Promise {\n // Пустой пароль никогда не открывает вход\n if (пароль === \"\") return false;\n\n const cookie = req.headers.get(\"cookie\") ?? \"\";\n for (const кусок of cookie.split(\";\")) {\n const [имя, ...остальное] = кусок.trim().split(\"=\");\n if (имя === \"__Host-dash\") {\n const токен = остальное.join(\"=\");\n return await проверить(пароль, токен, сейчас);\n }\n }\n return false;\n}\n\nexport async function ответСКукой(\n пароль: string,\n куда: string,\n сейчас: number = Date.now(),\n): Promise {\n // Пустой пароль — это ошибка развёртывания (Important)\n if (пароль === \"\") {\n throw new Error(\"Пароль не должен быть пустым\");\n }\n\n // Только локальные пути: начинаться с одной /, не с двух, без обратных слэшей\n if (!куда.startsWith(\"/\") || куда.startsWith(\"//\") || куда.includes(\"\\\\\")) {\n throw new Error(\"Неверный путь редиректа\");\n }\n\n const срок = сейчас + 7 * 24 * 60 * 60 * 1000; // неделя в мс\n const токен = await подписать(пароль, срок);\n\n return new Response(null, {\n status: 302,\n headers: {\n \"location\": куда,\n \"set-cookie\":\n `__Host-dash=${токен}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=604800`,\n },\n });\n}\n\n/** Экранирует HTML символы в строке для безопасной вставки в разметку. */\nfunction экранировать(текст: string): string {\n return текст\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nexport function страницаВхода(ошибка?: string): Response {\n const ошибка_экранирована = ошибка ? экранировать(ошибка) : \"\";\n const html = `\nРадар рекламных лидов\n\n`;\n return new Response(html, {\n status: 401,\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n","deleted",false,"label",[47,48,24],"src","dash","0d66920f-8240-4395-a231-63f86e6c3888",["D",1788790280130],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Радар рекламных лидов ULS: живая страница из Битрикс24","imageUrl","userId","ce244983-5dfc-4662-ad1a-ca34d2e798a0","pinnedFileId","426b02f0-aac6-11f1-9f81-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019fa853-4d22-71bf-b5fe-af55df9678e6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":102},"org",{"_9":10,"_99":100,"_101":102,"_59":60,"_103":104,"_105":44},"branch",{"_37":89,"_11":90,"_22":30,"_91":49,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",54,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","umgroupkz-commits","avatar","https://avatars.githubusercontent.com/u/279207781?v=4","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_140":141,"_142":143,"_144":145,"_146":44,"_147":44,"_148":44,"_149":34,"_150":-5,"_151":-7,"_152":-7,"_153":38,"_154":44,"_155":44,"_156":-5,"_157":44,"_158":44,"_159":44,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":90,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]