${escapeHtml(options.title)} · Soccer Rotation Planner

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","wburningham","name","soccer-rotation-planner","path","app.http.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/wburningham/soccer-rotation-planner/code/app.http.ts","extension","id","cffb9cdc-e9e0-443e-a527-fd23b6dfab2b","fileId","dea48668-a0b3-11f1-ad00-1607ee4eb77e","parentId","branchId","84e21a39-2706-4607-aa82-1c89630fc6cf","branchVersion",680,"latest",true,"createdAt",["D",1787893066339],"version",23,"fileType","http","content","import { serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\nimport {\n type AppState,\n createGame,\n deleteGame,\n deletePlayer,\n loadState,\n saveGame,\n savePlayer,\n saveSettings,\n StateError,\n} from \"./lib/state.ts\";\nimport {\n authenticatedUsername,\n teamsForUser,\n userExists,\n} from \"./lib/auth-db.ts\";\nimport {\n clearSessionCookie,\n clearTeamCookie,\n type CookieAuthConfig,\n cookieAuthConfig,\n createSessionCookie,\n createTeamCookie,\n hasTeamCookie,\n selectedTeam,\n sessionUsername,\n} from \"./lib/cookie-auth.ts\";\nimport {\n selectedTeamPath,\n teamPickerPath,\n type TeamRedirectSegment,\n teamRedirectSegment,\n} from \"./lib/team-redirect.ts\";\n\nfunction withCacheControl(response: Response, value: string): Response {\n const headers = new Headers(response.headers);\n headers.set(\"Cache-Control\", value);\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n}\n\nfunction isRecord(value: unknown): value is Record {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Add server-derived authorization metadata without persisting it to Blob. */\nfunction stateForClient(\n state: AppState,\n teams: readonly string[],\n): AppState & { teamCount: number } {\n return { ...state, teamCount: teams.length };\n}\n\nexport default async function (request: Request): Promise {\n const url = new URL(request.url);\n const pathname = url.pathname;\n\n try {\n if (pathname === \"/logout\") {\n return redirect(\"/login\", [clearSessionCookie(), clearTeamCookie()]);\n }\n\n const auth = cookieAuthConfig(\n Deno.env.get(\"JWT_SIGINING_TOKEN\"),\n Deno.env.get(\"AUTH_SALT\"),\n );\n\n if (pathname === \"/login\") {\n return await handleLogin(request, auth);\n }\n\n if (!auth) return redirect(\"/login\");\n\n const cookieHeader = request.headers.get(\"Cookie\");\n const username = await sessionUsername(cookieHeader, auth.signingToken);\n if (!username || !(await userExists(username))) {\n return redirect(\"/login\", [clearSessionCookie(), clearTeamCookie()]);\n }\n\n if (pathname === \"/switch-teams\") {\n return redirect(\n teamPickerPath(teamRedirectSegment(url.searchParams.get(\"redirect\"))),\n clearTeamCookie(),\n );\n }\n\n if (pathname === \"/team-picker\") {\n return await handleTeamPicker(request, username);\n }\n\n const teams = await teamsForUser(username);\n const team = selectedTeam(cookieHeader);\n if (!team || !teams.includes(team)) {\n return teamSelectionRedirect(teams, cookieHeader);\n }\n\n if (pathname === \"/\") {\n if (request.method !== \"GET\") return methodNotAllowed();\n return redirect(\"/games\");\n }\n\n if (pathname === \"/api/team\") {\n if (request.method !== \"GET\") return methodNotAllowed();\n return Response.json({ team, teamCount: teams.length }, {\n headers: { \"Cache-Control\": \"no-store\" },\n });\n }\n\n if (pathname === \"/api/state\" && request.method === \"GET\") {\n return Response.json(stateForClient(await loadState(team), teams));\n }\n\n if (pathname === \"/api/state\" && request.method === \"PUT\") {\n const body = await request.json() as unknown;\n if (!isRecord(body) || !(\"settings\" in body)) {\n return Response.json({ error: \"settings is required\" }, {\n status: 400,\n });\n }\n\n return Response.json(\n stateForClient(await saveSettings(team, body.settings), teams),\n );\n }\n\n if (pathname === \"/api/games\" && request.method === \"POST\") {\n const body = await request.json() as unknown;\n if (!isRecord(body) || !(\"game\" in body)) {\n return Response.json({ error: \"game is required\" }, { status: 400 });\n }\n\n const result = await createGame(team, body.game);\n return Response.json({\n ...result,\n state: stateForClient(result.state, teams),\n }, { status: 201 });\n }\n\n const gameMatch = /^\\/api\\/games\\/([^/]+)$/.exec(pathname);\n if (gameMatch) {\n const gameId = decodeURIComponent(gameMatch[1]);\n\n if (request.method === \"DELETE\") {\n return Response.json({\n state: stateForClient(await deleteGame(team, gameId), teams),\n });\n }\n\n if (request.method === \"PUT\") {\n const body = await request.json() as unknown;\n if (!isRecord(body) || !(\"game\" in body)) {\n return Response.json({ error: \"game is required\" }, { status: 400 });\n }\n\n const result = await saveGame(team, gameId, body.game);\n return Response.json({\n ...result,\n state: stateForClient(result.state, teams),\n });\n }\n\n return methodNotAllowed();\n }\n\n const playerMatch = /^\\/api\\/players\\/([^/]+)$/.exec(pathname);\n if (playerMatch) {\n const playerNumber = decodeURIComponent(playerMatch[1]);\n\n if (request.method === \"DELETE\") {\n return Response.json({\n state: stateForClient(await deletePlayer(team, playerNumber), teams),\n });\n }\n\n if (request.method === \"PUT\") {\n const body = await request.json() as unknown;\n if (!isRecord(body) || !(\"player\" in body)) {\n return Response.json({ error: \"player is required\" }, {\n status: 400,\n });\n }\n\n const result = await savePlayer(team, playerNumber, body.player);\n return Response.json({\n ...result,\n state: stateForClient(result.state, teams),\n });\n }\n\n return methodNotAllowed();\n }\n\n if (pathname.startsWith(\"/api/\")) {\n return new Response(\"Not found\", { status: 404 });\n }\n\n if (pathname.startsWith(\"/assets/\")) {\n return withCacheControl(\n await serveFile(\"/public\" + pathname, import.meta.url),\n \"public, max-age=31536000, immutable\",\n );\n }\n\n if (request.method !== \"GET\") return methodNotAllowed();\n\n // The Svelte router handles all application paths after the SPA shell loads.\n return withCacheControl(\n await serveFile(\"/public/index.html\", import.meta.url),\n \"no-cache\",\n );\n } catch (error) {\n console.error(error);\n if (error instanceof StateError) {\n return Response.json({ error: error.message }, { status: error.status });\n }\n const message = error instanceof Error ? error.message : \"Unknown error\";\n return Response.json({ error: message }, { status: 500 });\n }\n}\n\nasync function handleLogin(\n request: Request,\n auth: CookieAuthConfig | undefined,\n): Promise {\n if (!auth) {\n return loginPage(\n \"Authentication is not configured. Set AUTH_SALT and JWT_SIGINING_TOKEN.\",\n 500,\n );\n }\n\n const cookieHeader = request.headers.get(\"Cookie\");\n\n if (request.method === \"POST\") {\n let form: FormData;\n try {\n form = await request.formData();\n } catch {\n return loginPage(\"Invalid sign-in request.\", 400);\n }\n\n const username = await authenticatedUsername(\n form.get(\"username\"),\n form.get(\"password\"),\n auth.authSalt,\n );\n if (!username) {\n return loginPage(\"Incorrect username or password.\", 401);\n }\n\n const teams = await teamsForUser(username);\n return teamSelectionRedirect(teams, cookieHeader, [\n await createSessionCookie(auth.signingToken, username),\n ]);\n }\n\n if (request.method === \"GET\") {\n const username = await sessionUsername(cookieHeader, auth.signingToken);\n if (!username) return loginPage();\n\n if (!(await userExists(username))) {\n return loginPage(undefined, 200, [\n clearSessionCookie(),\n clearTeamCookie(),\n ]);\n }\n\n return teamSelectionRedirect(await teamsForUser(username), cookieHeader);\n }\n\n return methodNotAllowed();\n}\n\nasync function handleTeamPicker(\n request: Request,\n username: string,\n): Promise {\n const cookieHeader = request.headers.get(\"Cookie\");\n const redirectSegment = teamRedirectSegment(\n new URL(request.url).searchParams.get(\"redirect\"),\n );\n const selectedTeamRedirect = selectedTeamPath(redirectSegment || \"games\");\n const teams = await teamsForUser(username);\n const existingTeam = selectedTeam(cookieHeader);\n const clearInvalidTeamCookie = hasTeamCookie(cookieHeader) &&\n (!existingTeam || !teams.includes(existingTeam));\n const cookies = clearInvalidTeamCookie ? [clearTeamCookie()] : [];\n\n if (request.method === \"GET\") {\n if (teams.length === 1) {\n return redirect(selectedTeamRedirect, [\n ...cookies,\n createTeamCookie(teams[0]),\n ]);\n }\n\n return teamPickerPage(\n teams,\n teams.length === 0\n ? \"You are not assigned to a team. Ask an administrator to add a coach mapping.\"\n : undefined,\n teams.length === 0 ? 403 : 200,\n cookies,\n redirectSegment,\n );\n }\n\n if (request.method === \"POST\") {\n let form: FormData;\n try {\n form = await request.formData();\n } catch {\n return teamPickerPage(\n teams,\n \"Invalid team selection.\",\n 400,\n cookies,\n redirectSegment,\n );\n }\n\n const team = form.get(\"team\");\n if (typeof team === \"string\" && teams.includes(team)) {\n return redirect(selectedTeamRedirect, [\n ...cookies,\n createTeamCookie(team),\n ]);\n }\n\n return teamPickerPage(\n teams,\n \"Choose a team that is assigned to you.\",\n 403,\n cookies,\n redirectSegment,\n );\n }\n\n return methodNotAllowed();\n}\n\nfunction teamSelectionRedirect(\n teams: string[],\n cookieHeader: string | null,\n additionalCookies: string[] = [],\n): Response {\n const currentTeam = selectedTeam(cookieHeader);\n if (currentTeam && teams.includes(currentTeam)) {\n return redirect(\"/games\", additionalCookies);\n }\n\n const cookies = [...additionalCookies];\n if (hasTeamCookie(cookieHeader)) cookies.push(clearTeamCookie());\n\n if (teams.length === 1) {\n cookies.push(createTeamCookie(teams[0]));\n return redirect(\"/games\", cookies);\n }\n\n return redirect(teamPickerPath(\"\"), cookies);\n}\n\nfunction methodNotAllowed(): Response {\n return new Response(\"Method not allowed\", { status: 405 });\n}\n\nfunction redirect(\n location: string,\n cookies: string | readonly string[] = [],\n): Response {\n const headers = new Headers({\n Location: location,\n \"Cache-Control\": \"no-store\",\n });\n for (const cookie of typeof cookies === \"string\" ? [cookies] : cookies) {\n headers.append(\"Set-Cookie\", cookie);\n }\n return new Response(null, { status: 302, headers });\n}\n\nfunction escapeHtml(value: string): string {\n return value.replace(/[&<>\"']/g, (character) => {\n const entities: Record = {\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n };\n return entities[character];\n });\n}\n\nfunction loginPage(\n error?: string,\n status = 200,\n cookies: readonly string[] = [],\n): Response {\n const message = error\n ? `

${escapeHtml(error)}

`\n : \"\";\n\n return authPage({\n title: \"Sign in\",\n heading: \"Soccer Rotation Planner\",\n content: ``,\n status,\n cookies,\n });\n}\n\nfunction teamPickerPage(\n teams: string[],\n error?: string,\n status = 200,\n cookies: readonly string[] = [],\n redirectSegment: TeamRedirectSegment = \"\",\n): Response {\n const message = error\n ? `

${escapeHtml(error)}

`\n : \"\";\n const teamButtons = teams.map((team) => {\n const escapedTeam = escapeHtml(team);\n return ``;\n }).join(\"\\n\");\n const content = teams.length > 0\n ? `${message}\n `\n : `

There are no teams available to select.

\n ${message}`;\n\n return authPage({\n title: \"Choose a team\",\n heading: \"Choose a team\",\n content,\n script: `\n const teamList = document.querySelector(\".team-list\");\n let selectingTeam = false;\n\n teamList?.addEventListener(\"submit\", (event) => {\n const submitter = event.submitter;\n if (!(submitter instanceof HTMLButtonElement)) return;\n\n if (selectingTeam) {\n event.preventDefault();\n return;\n }\n\n selectingTeam = true;\n const selectedTeam = document.createElement(\"input\");\n selectedTeam.type = \"hidden\";\n selectedTeam.name = \"team\";\n selectedTeam.value = submitter.value;\n teamList.append(selectedTeam);\n\n teamList.dataset.submitting = \"true\";\n teamList.querySelectorAll(\"button.team-option\").forEach((button) => {\n button.disabled = true;\n });\n submitter.classList.add(\"is-loading\");\n submitter.setAttribute(\"aria-busy\", \"true\");\n });\n `,\n status,\n cookies,\n });\n}\n\nfunction authPage(options: {\n title: string;\n heading: string;\n content: string;\n script?: string;\n status: number;\n cookies: readonly string[];\n}): Response {\n const headers = new Headers({\n \"Cache-Control\": \"no-store\",\n \"Content-Security-Policy\": `default-src 'none'; style-src 'unsafe-inline';${\n options.script ? \" script-src 'unsafe-inline';\" : \"\"\n } form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,\n \"Content-Type\": \"text/html; charset=utf-8\",\n });\n for (const cookie of options.cookies) headers.append(\"Set-Cookie\", cookie);\n\n return new Response(\n `\n\n \n \n \n ${escapeHtml(options.title)} · Soccer Rotation Planner\n \n \n \n

${escapeHtml(options.heading)}

\n ${options.content}\n

\n ${options.script ? `` : \"\"}\n \n`,\n { status: options.status, headers },\n );\n}\n","deleted",false,"label",[14],"7b40c42c-959e-4a6c-85d2-f4e626c5d81f",["D",1787682980052],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","4a415601-dc61-4e6d-94d0-5b763ba35b1a","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","72eec1aa-7e71-4c4d-9cb8-754a0abcc683","tursoName","7b40c42c959e4a6c85d2f4e626c5d81f","tursoHostname","7b40c42c959e4a6c85d2f4e626c5d81f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789461042390],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_98":-5,"_99":100,"_55":56,"_101":102,"_103":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",1360,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://images.clerk.dev/oauth_github/img_2RnQDG5pRmkpwFm1cGIqdMpkt4n.png","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":89,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]