Throne Gelt Ledger

\n\n

Throne Gelt Ledger

Warrant of Von Brandt · Hive Solenne

\n\n\n

\n\n

\n\n\n\n\n\n`;\n","children",[],[178],["D",1789371391103],[],[18],"e2b4f8cb-a746-4ba9-943f-f7f39e79bedd","db.ts","b5278fa0-b00e-11f1-8702-1607ee4eb77e",3,["D",1789371264023],"/**\n * Schema and data access.\n *\n * Money is stored as INTEGER thrones. No floats for balances — payout\n * rates are floats, but every credit is floored to a whole throne before\n * it touches a balance.\n *\n * Every balance change also writes a `ledger` row, so the books can\n * always be reconciled against the users table.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword } from \"./auth.ts\";\n\nexport const STARTING_BALANCE = 1000;\n\nlet initialised = false;\n\nexport async function initDb(): Promise {\n if (initialised) return;\n\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL COLLATE NOCASE UNIQUE,\n password_hash TEXT NOT NULL,\n balance INTEGER NOT NULL DEFAULT ${STARTING_BALANCE},\n is_admin INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token_digest TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS bets (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n closes_at TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'open',\n winning_option_id INTEGER,\n created_by INTEGER,\n created_at TEXT NOT NULL,\n resolved_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS bet_options (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n bet_id INTEGER NOT NULL,\n label TEXT NOT NULL,\n payout_rate REAL NOT NULL,\n sort_order INTEGER NOT NULL DEFAULT 0\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_options_bet ON bet_options(bet_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS wagers (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n bet_id INTEGER NOT NULL,\n option_id INTEGER NOT NULL,\n stake INTEGER NOT NULL,\n payout_rate REAL NOT NULL,\n status TEXT NOT NULL DEFAULT 'pending',\n payout INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_user ON wagers(user_id)` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_bet ON wagers(bet_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS ledger (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n delta INTEGER NOT NULL,\n reason TEXT NOT NULL,\n ref TEXT,\n created_at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_ledger_user ON ledger(user_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS login_attempts (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL,\n at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_attempts ON login_attempts(username, at)` },\n ]);\n\n await ensureAdmin();\n initialised = true;\n}\n\n/**\n * Create or update the admin account from environment variables.\n * The credentials never appear in source. If ADMIN_PASSWORD changes,\n * the stored hash is updated on next boot.\n */\nasync function ensureAdmin(): Promise {\n const username = Deno.env.get(\"ADMIN_USERNAME\");\n const password = Deno.env.get(\"ADMIN_PASSWORD\");\n if (!username || !password) {\n console.warn(\"ADMIN_USERNAME / ADMIN_PASSWORD not set — no admin account.\");\n return;\n }\n\n const hash = await hashPassword(password);\n const now = new Date().toISOString();\n const existing = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username = ?\",\n args: [username],\n });\n\n if (existing.rows.length === 0) {\n await sqlite.execute({\n sql: `INSERT INTO users (username, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, 0, 1, ?)`,\n args: [username, hash, now],\n });\n } else {\n await sqlite.execute({\n sql: \"UPDATE users SET password_hash = ?, is_admin = 1 WHERE id = ?\",\n args: [hash, existing.rows[0].id as number],\n });\n }\n}\n\nexport const nowIso = () => new Date().toISOString();\n\n/** Record a balance change and its audit row atomically. */\nexport function creditStatements(\n userId: number,\n delta: number,\n reason: string,\n ref: string | null,\n) {\n return [\n {\n sql: \"UPDATE users SET balance = balance + ? WHERE id = ?\",\n args: [delta, userId],\n },\n {\n sql: `INSERT INTO ledger (user_id, delta, reason, ref, created_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [userId, delta, reason, ref, nowIso()],\n },\n ];\n}\n\nexport { sqlite };\n",[],[190],"a9d77305-8592-418d-8486-8b521c6fd867","auth.ts","a744625a-b00e-11f1-b65d-1607ee4eb77e",["D",1789371240670],"/**\n * Password hashing and session tokens.\n *\n * Passwords: PBKDF2-SHA256, per-user random salt, stored as\n * pbkdf2$$$\n * Nothing reversible is ever written to the database.\n *\n * Sessions: 32 random bytes given to the browser, only the SHA-256\n * digest is stored. A database leak does not yield usable sessions.\n */\n\nconst PBKDF2_ITERATIONS = 210_000;\nconst SALT_BYTES = 16;\nconst KEY_BITS = 256;\n\nfunction toB64(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes));\n}\n\nfunction fromB64(s: string): Uint8Array {\n return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations },\n key,\n KEY_BITS,\n );\n return new Uint8Array(bits);\n}\n\n/** Hash a password for storage. */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n const hash = await pbkdf2(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toB64(salt)}$${toB64(hash)}`;\n}\n\n/** Constant-time byte comparison. */\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** Verify a password against a stored hash. */\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n try {\n const [scheme, iterStr, saltB64, hashB64] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\") return false;\n const iterations = parseInt(iterStr, 10);\n if (!Number.isFinite(iterations) || iterations < 1000) return false;\n const candidate = await pbkdf2(password, fromB64(saltB64), iterations);\n return timingSafeEqual(candidate, fromB64(hashB64));\n } catch {\n return false;\n }\n}\n\n/**\n * Burn roughly the same time as a real verification when the username\n * doesn't exist, so response timing doesn't reveal which handles are real.\n */\nexport async function dummyVerify(): Promise {\n const salt = new Uint8Array(SALT_BYTES);\n await pbkdf2(\"decoy-value-for-timing\", salt, PBKDF2_ITERATIONS);\n}\n\n/** A fresh session token. Returns the plaintext (for the cookie) and its digest (for the DB). */\nexport async function newSessionToken(): Promise<{ token: string; digest: string }> {\n const raw = crypto.getRandomValues(new Uint8Array(32));\n const token = toB64(raw).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n return { token, digest: await digestToken(token) };\n}\n\n/** SHA-256 of a session token, hex encoded. */\nexport async function digestToken(token: string): Promise {\n const bytes = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(token),\n );\n return Array.from(new Uint8Array(bytes))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nexport const SESSION_TTL_DAYS = 30;\nexport const SESSION_COOKIE = \"tg_session\";\n",[],[198],["D",1789371222313],["D",1789545678485],{"_11":12,"_132":70},{"_11":12,"_127":128,"_69":70,"_30":68,"_129":130,"_131":24},{"_39":118,"_13":16,"_33":36,"_119":80,"_120":-5,"_121":-5,"_122":-5,"_123":-5,"_124":-5,"_125":14,"_126":12},"ctx",{"_53":-5,"_151":242,"_243":244,"_245":246,"_247":24,"_248":24,"_249":24,"_250":92,"_251":-5,"_252":-7,"_253":-7,"_254":26,"_255":24,"_256":24,"_257":-5,"_258":24,"_259":24,"_260":24,"_261":-5},"ENV",{"_213":214,"_215":216,"_217":16,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · main.tsx