[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_156":157,"_158":159},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_104":85,"_27":105,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":122,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",14,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","67bc8412-7d57-11f1-9eb4-1607ee4eb77e","name","fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\n// Generates exactly 256-bits of randomness, base64url encoded\nfunction generateVerifier() {\n const arr = new Uint8Array(32);\n crypto.getRandomValues(arr);\n return btoa(String.fromCharCode(...arr))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n}\n\n// Hashes the exact string above using SHA-256\nasync function generateChallenge(verifier: string) {\n const buffer = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n const bytes = new Uint8Array(buffer);\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) {\n binary += String.fromCharCode(bytes[i]);\n }\n return btoa(binary)\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const redirectUri = `${url.origin}/callback`;\n const clientId = Deno.env.get(\"CLIENT_ID\")?.trim();\n const clientSecret = Deno.env.get(\"CLIENT_SECRET\")?.trim();\n\n if (!clientId || !clientSecret) {\n return new Response(\"Missing keys.\", { status: 500 });\n }\n\n const authHeader = btoa(`${clientId}:${clientSecret}`);\n\n // --- ROUTE 1: THE INITIATION (/connect) ---\n if (url.pathname === \"/connect\") {\n const verifier = generateVerifier();\n const challenge = await generateChallenge(verifier);\n\n const stateArr = new Uint8Array(16);\n crypto.getRandomValues(stateArr);\n const state = btoa(String.fromCharCode(...stateArr)).replace(\n /[^a-zA-Z0-9]/g,\n \"\",\n );\n\n // FIX: Force explicit JSON object so Val Town doesn't mangle string quotes\n await blob.setJSON(`guava_state_${state}`, { verifier: verifier });\n\n const parParams = new URLSearchParams({\n client_id: clientId,\n response_type: \"code\",\n code_challenge: challenge,\n code_challenge_method: \"S256\",\n scope: \"profile offline_access\",\n state: state,\n redirect_uri: redirectUri,\n });\n\n const parResponse = await fetch(\n \"https://api-test.guavahealth.com/oauth/par\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Basic ${authHeader}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: parParams,\n },\n );\n\n const data = await parResponse.json();\n if (!parResponse.ok) {\n return new Response(`PAR Error: ${JSON.stringify(data)}`, {\n status: 400,\n });\n }\n\n return Response.redirect(\n `https://guavahealth.com/oauth/authorize?client_id=${clientId}&request_uri=${\n encodeURIComponent(data.request_uri)\n }`,\n 302,\n );\n }\n\n // --- ROUTE 2: THE CALLBACK HANDSHAKE (/callback) ---\n if (url.pathname === \"/callback\") {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n\n if (!code || !state) {\n return new Response(\"Missing code or state.\", { status: 400 });\n }\n\n // FIX: Retrieve the exact explicit JSON object\n const savedData = await blob.getJSON(`guava_state_${state}`);\n if (!savedData || !savedData.verifier) {\n return new Response(\"Session expired or mismatched.\", { status: 400 });\n }\n\n const cleanVerifier = savedData.verifier;\n await blob.delete(`guava_state_${state}`);\n\n const tokenParams = new URLSearchParams({\n grant_type: \"authorization_code\",\n code: code,\n code_verifier: cleanVerifier,\n redirect_uri: redirectUri,\n });\n\n const tokenResponse = await fetch(\n \"https://api-test.guavahealth.com/oauth/token\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Basic ${authHeader}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: tokenParams,\n },\n );\n\n const data = await tokenResponse.json();\n return new Response(JSON.stringify(data, null, 2), {\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n\n return new Response(\n `\n

\n Connect to Guava Sandbox\n

\n `,\n { headers: { \"Content-Type\": \"text/html\" } },\n );\n}","import { blob } from \"https://esm.town/v/std/blob\";\n\n// Generates exactly 256-bits of randomness, base64url encoded\nfunction generateVerifier() {\n const arr = new Uint8Array(32);\n crypto.getRandomValues(arr);\n return btoa(String.fromCharCode(...arr))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n}\n\n// Hashes the exact string above using SHA-256\nasync function generateChallenge(verifier: string) {\n const buffer = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n const bytes = new Uint8Array(buffer);\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) {\n binary += String.fromCharCode(bytes[i]);\n }\n return btoa(binary)\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const redirectUri = `${url.origin}/callback`;\n const clientId = Deno.env.get(\"CLIENT_ID\")?.trim();\n const clientSecret = Deno.env.get(\"CLIENT_SECRET\")?.trim();\n\n if (!clientId || !clientSecret) {\n return new Response(\"Missing keys.\", { status: 500 });\n }\n\n const authHeader = btoa(`${clientId}:${clientSecret}`);\n\n // --- ROUTE 1: THE INITIATION (/connect) ---\n if (url.pathname === \"/connect\") {\n const verifier = generateVerifier();\n const challenge = await generateChallenge(verifier);\n\n const stateArr = new Uint8Array(16);\n crypto.getRandomValues(stateArr);\n const state = btoa(String.fromCharCode(...stateArr)).replace(\n /[^a-zA-Z0-9]/g,\n \"\",\n );\n\n await blob.setJSON(`guava_state_${state}`, { verifier: verifier });\n\n const parParams = new URLSearchParams({\n client_id: clientId,\n response_type: \"code\",\n code_challenge: challenge,\n code_challenge_method: \"S256\",\n // UPGRADED CLEARANCE: Requesting read access (.rs) to multiple health categories\n scope:\n \"profile patient/sleep.rs patient/activities.rs patient/water.rs patient/nutrition.rs offline_access\",\n state: state,\n redirect_uri: redirectUri,\n });\n\n const parResponse = await fetch(\n \"https://api-test.guavahealth.com/oauth/par\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Basic ${authHeader}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: parParams,\n },\n );\n\n const data = await parResponse.json();\n if (!parResponse.ok) {\n return new Response(`PAR Error: ${JSON.stringify(data)}`, {\n status: 400,\n });\n }\n\n return Response.redirect(\n `https://guavahealth.com/oauth/authorize?client_id=${clientId}&request_uri=${\n encodeURIComponent(data.request_uri)\n }`,\n 302,\n );\n }\n\n // --- ROUTE 2: THE CALLBACK HANDSHAKE (/callback) ---\n if (url.pathname === \"/callback\") {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n\n if (!code || !state) {\n return new Response(\"Missing code or state.\", { status: 400 });\n }\n\n const savedData = await blob.getJSON(`guava_state_${state}`);\n if (!savedData || !savedData.verifier) {\n return new Response(\"Session expired or mismatched.\", { status: 400 });\n }\n\n const cleanVerifier = savedData.verifier;\n await blob.delete(`guava_state_${state}`);\n\n const tokenParams = new URLSearchParams({\n grant_type: \"authorization_code\",\n code: code,\n code_verifier: cleanVerifier,\n redirect_uri: redirectUri,\n });\n\n const tokenResponse = await fetch(\n \"https://api-test.guavahealth.com/oauth/token\",\n {\n method: \"POST\",\n headers: {\n \"Authorization\": `Basic ${authHeader}`,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: tokenParams,\n },\n );\n\n const tokenData = await tokenResponse.json();\n if (!tokenResponse.ok) {\n return new Response(`Token Error: ${JSON.stringify(tokenData)}`, {\n status: 400,\n });\n }\n\n // Lock the new tokens in the permanent vault\n await blob.setJSON(\"guava_tokens\", {\n access_token: tokenData.access_token,\n refresh_token: tokenData.refresh_token,\n });\n\n // Send the user directly to the new data dashboard\n return Response.redirect(`${url.origin}/dashboard`, 302);\n }\n\n // --- ROUTE 3: THE DATA DASHBOARD (/dashboard) ---\n if (url.pathname === \"/dashboard\") {\n // Retrieve the keys we just saved\n const tokens = await blob.getJSON(\"guava_tokens\");\n if (!tokens || !tokens.access_token) {\n return new Response(\n \"No access token found. Please connect to Guava first.\",\n { status: 401 },\n );\n }\n\n const authHeaderBearer = {\n \"Authorization\": `Bearer ${tokens.access_token}`,\n };\n\n try {\n // 1. Fetch Profile (GET)\n const profileReq = await fetch(\"https://api-test.guavahealth.com/v1/me\", {\n headers: authHeaderBearer,\n });\n const profileData = await profileReq.json();\n\n // 2. Fetch Sleep Records (POST)\n const sleepReq = await fetch(\n \"https://api-test.guavahealth.com/v1/sleep/_search\",\n {\n method: \"POST\",\n headers: authHeaderBearer,\n },\n );\n const sleepData = await sleepReq.json();\n\n // 3. Fetch Activities (POST)\n const actReq = await fetch(\n \"https://api-test.guavahealth.com/v1/activities/_search\",\n {\n method: \"POST\",\n headers: authHeaderBearer,\n },\n );\n const actData = await actReq.json();\n\n // Combine everything into one clear readout\n const dashboardData = {\n User_Profile: profileData,\n Sleep_Logs: sleepData,\n Activity_Logs: actData,\n };\n\n return new Response(JSON.stringify(dashboardData, null, 2), {\n headers: { \"Content-Type\": \"application/json\" },\n });\n } catch (err) {\n return new Response(`Error fetching vault data: ${err.message}`, {\n status: 500,\n });\n }\n }\n\n // --- DEFAULT LANDING PAGE ---\n return new Response(\n `\n

Guava Sandbox Courier

\n Connect & Fetch All Data\n

\n `,\n { headers: { \"Content-Type\": \"text/html\" } },\n );\n}","createdAt",["D",1784385388429],"branchVersion","branchId","17b09b73-1b10-4f7a-b4ec-a5e9ae180fcc","id","962372eb-b250-43d4-b2be-33822c7498b1","GuavaHealth",["D",1783794978091],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","my health","imageUrl","ba5eef21-587f-4c86-8ddd-fcd2856ea119","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f5275-a7a2-708b-bf28-155b38ffc5fc","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_103":99},"org",{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned",30,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","anabelle","handle","displayName","Anabelle","avatar","https://lh3.googleusercontent.com/a/ACg8ocK_z4QvhXTJ5SNALmuD5YNnnsr2ThXrv8-RRzow19D_jHWeGJyeoA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":152,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":153,"_79":154,"_81":155,"_83":25},"tree",[147],"files",[147],"counts",{"_135":61,"_136":137,"_138":61,"_139":140,"_141":142},"contents",[127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":131,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_27":134},"6ca1221d-9621-4ef1-82da-6f56271d7653","parentId","latest",["D",1784385388429],13,"label",[28],"pulls","branches",1,"forks","envVars",{"_143":145,"_146":61},"connections",{"_143":61,"_144":61},"count","unfilledCount",2,"emptyCount",{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":148,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_149":150,"_27":151},["D",1784385388429],"children",[],[28],["D",1783794978091],{"_95":94,"_103":99},{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_77":-5,"_124":189,"_190":191,"_192":193,"_194":25,"_195":25,"_196":25,"_197":122,"_198":-5,"_199":-7,"_200":-7,"_201":61,"_202":25,"_203":25,"_204":-5,"_205":25,"_206":25,"_207":25,"_208":-5},"ENV",{"_160":161,"_162":163,"_164":85,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v14