[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_109":110,"_111":112},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","voidmarket","name","sami-tech-retours","path","backend/access.ts","project",{"_22":48,"_11":12,"_35":49,"_50":-5,"_51":44,"_52":53,"_54":53,"_55":56,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":38,"_66":67,"_68":69,"_70":71,"_72":73,"_74":-5,"_75":76,"_77":76,"_78":79,"_80":79,"_81":79,"_82":76,"_83":76,"_84":85,"_86":87,"_88":89,"_90":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/voidmarket/sami-tech-retours/code/backend/access.ts","extension","id","45232bfa-011c-48a2-9b91-3626695b9180","access.ts","fileId","7673ba6c-b154-11f1-ac17-1607ee4eb77e","parentId","cb9b26c6-3552-462f-9d4a-105dd9b5b222","branchId","ff158aab-0096-40a5-8840-6ecf75e68750","branchVersion",4,"latest",true,"createdAt",["D",1789511174778],"version",0,"fileType","script","content","/**\n * Verrouillage de l'application par schéma Android 3x3 + sessions.\n *\n * - Le schéma est stocké sous forme de hash PBKDF2-SHA256 salé (jamais en clair).\n * - Les sessions vivent en base (app_sessions) et sont portées par le cookie\n * `sami_access` (HttpOnly, Secure, ~12 h). Le cookie ne contient qu'un token\n * aléatoire : seul son SHA-256 est stocké.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureSchema, getSetting, setSetting } from \"./db.ts\";\n\nconst PATTERN_KEY = \"access_pattern_hash\";\nconst SESSION_COOKIE = \"sami_access\";\nconst SESSION_TTL_MS = 12 * 60 * 60 * 1000; // ~12 heures\nconst PBKDF2_ITERATIONS = 100_000;\nconst encoder = new TextEncoder();\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(byteLength: number): string {\n const buffer = new Uint8Array(byteLength);\n crypto.getRandomValues(buffer);\n return toHex(buffer);\n}\n\nasync function sha256Hex(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n return toHex(new Uint8Array(digest));\n}\n\nasync function pbkdf2Hex(secret: string, salt: string, iterations: number): Promise {\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt: encoder.encode(salt), iterations },\n key,\n 256,\n );\n return toHex(new Uint8Array(bits));\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n/** Vrai si un schéma a déjà été configuré. */\nexport async function isPatternConfigured(): Promise {\n return (await getSetting(PATTERN_KEY)) !== null;\n}\n\n/** Enregistre un nouveau schéma et invalide toutes les sessions existantes. */\nexport async function setPattern(pattern: string): Promise {\n const salt = randomHex(16);\n const hash = await pbkdf2Hex(pattern, salt, PBKDF2_ITERATIONS);\n await setSetting(PATTERN_KEY, `pbkdf2$${PBKDF2_ITERATIONS}$${salt}$${hash}`);\n await deleteAllSessions();\n}\n\n/** Vérifie un schéma saisi contre le hash stocké. */\nexport async function verifyPattern(pattern: string): Promise {\n const stored = await getSetting(PATTERN_KEY);\n if (!stored) return false;\n const [scheme, iterationsRaw, salt, hash] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\" || !iterationsRaw || !salt || !hash) return false;\n const candidate = await pbkdf2Hex(pattern, salt, Number(iterationsRaw));\n return timingSafeEqual(candidate, hash);\n}\n\n/** Crée une session et retourne le token à poser en cookie. */\nexport async function createSession(): Promise<{ token: string; maxAge: number }> {\n await ensureSchema();\n const token = randomHex(32);\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n await sqlite.execute({\n sql: \"INSERT INTO app_sessions (token_hash, expires_at, created_at) VALUES (?, ?, ?)\",\n args: [tokenHash, now + SESSION_TTL_MS, now],\n });\n return { token, maxAge: Math.floor(SESSION_TTL_MS / 1000) };\n}\n\n/** Vrai si la requête porte une session valide et non expirée. */\nexport async function hasValidSession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return false;\n await ensureSchema();\n const tokenHash = await sha256Hex(token);\n const result = await sqlite.execute({\n sql: \"SELECT expires_at FROM app_sessions WHERE token_hash = ?\",\n args: [tokenHash],\n });\n const row = result.rows[0] as unknown as { expires_at?: number } | undefined;\n if (!row) return false;\n if (Number(row.expires_at) < Date.now()) {\n await sqlite.execute({ sql: \"DELETE FROM app_sessions WHERE token_hash = ?\", args: [tokenHash] });\n return false;\n }\n return true;\n}\n\n/** Invalide la session portée par la requête. */\nexport async function destroySession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return;\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM app_sessions WHERE token_hash = ?\",\n args: [await sha256Hex(token)],\n });\n}\n\n/** Invalide toutes les sessions (purge à la reconfiguration du schéma). */\nexport async function deleteAllSessions(): Promise {\n await ensureSchema();\n await sqlite.execute(\"DELETE FROM app_sessions\");\n}\n\n/** Garde-fou : retourne une réponse 401 si la session est absente, sinon null. */\nexport async function requireSession(request: Request): Promise {\n if (await hasValidSession(request)) return null;\n return Response.json({ ok: false, code: \"UNAUTHORIZED\" }, { status: 401 });\n}\n\nexport function sessionCookieHeader(token: string, maxAge: number): string {\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${maxAge}`;\n}\n\nexport function clearCookieHeader(): string {\n return `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n const header = request.headers.get(\"cookie\") ?? \"\";\n for (const part of header.split(\";\")) {\n const index = part.indexOf(\"=\");\n if (index === -1) continue;\n if (part.slice(0, index).trim() === name) return part.slice(index + 1).trim();\n }\n return null;\n}","deleted",false,"label",[47,24],"backend","ad65941b-e0c0-4a5b-89cf-11fa973d849a",["D",1789511143425],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Scanner QR retours Ecotrack / OM Express + validation","imageUrl","userId","0afb5d64-ebeb-4598-bd32-72c469e46178","pinnedFileId","7d7be91a-b154-11f1-ac17-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a0a729-dd66-7509-8ac1-c1c985b77337","tursoName","ad65941be0c04a5b89cf11fa973d849a","tursoHostname","ad65941be0c04a5b89cf11fa973d849a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789696237964],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_108":104},"org",{"_9":10,"_101":102,"_103":104,"_58":59,"_105":106,"_107":44},"branch",{"_37":91,"_11":92,"_22":30,"_93":48,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":12,"_100":10},"isOwned",85,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sam rad","avatar","https://lh3.googleusercontent.com/a/ACg8ocLICX6mI-c9kDJUPFWRkbqww500mXryFODjCM8HOcTYTBsqIA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_84":-5,"_142":143,"_144":145,"_146":147,"_148":44,"_149":44,"_150":44,"_151":34,"_152":-5,"_153":-7,"_154":-7,"_155":38,"_156":44,"_157":44,"_158":-5,"_159":44,"_160":44,"_161":44,"_162":-5},"ENV",{"_113":114,"_115":116,"_117":92,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139,"_140":141},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]