[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_150":151,"_152":153},"routes/_app.x.$handle.$name",{"_92":91,"_31":43,"_100":82,"_26":101,"_13":14,"_102":-5,"_11":103,"_104":105,"_106":107,"_108":109,"_110":111,"_20":-5,"_112":-5,"_113":-5,"_114":24,"_115":116,"_117":118,"_119":-5,"_120":-5,"_121":122},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":76,"_77":78,"_79":80,"_81":24},"version",1,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","oauth-callback.ts","latestPath","fileId","8125e970-5548-11f1-89b2-ee650bb23af1","name","fileType","http","content","// Anotherland AI — Shopify Public App OAuth callback handler\n//\n// Lives at: https://anotherland--.web.val.run/\n// Used as both `application_url` and `redirect_url` in shopify.app.toml.\n//\n// Flow:\n// 1. Merchant clicks install URL → Shopify shows install prompt\n// 2. Merchant approves → Shopify redirects here with ?code= + ?shop= + ?hmac= + ?state=\n// 3. We verify HMAC (proves Shopify sent the request)\n// 4. We POST {client_id, client_secret, code} to {shop}/admin/oauth/access_token\n// 5. We store the returned access_token keyed by shop domain in Val Town blob\n// 6. We show the merchant a \"successfully installed\" page\n//\n// Hitting this URL without ?code= just shows a simple landing page (used as application_url).\n//\n// Secrets required (set via Val Town env vars):\n// SHOPIFY_CLIENT_ID — public app's client_id\n// SHOPIFY_CLIENT_SECRET — app's secret (used for HMAC verify + token exchange)\n//\n// Stored tokens are accessible via Val Town blob key \"shopify_tokens_v1\":\n// { \"trustgodbroclothing.myshopify.com\": \"shpat_...\", ... }\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst CLIENT_ID = Deno.env.get(\"SHOPIFY_CLIENT_ID\") || \"\";\nconst CLIENT_SECRET = Deno.env.get(\"SHOPIFY_CLIENT_SECRET\") || \"\";\nconst TOKENS_BLOB_KEY = \"shopify_tokens_v1\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const params = url.searchParams;\n\n // Landing page (no OAuth code present)\n if (!params.get(\"code\")) {\n return new Response(landingHtml(), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n // OAuth callback path\n if (!CLIENT_ID || !CLIENT_SECRET) {\n return errResponse(\"Server config error: SHOPIFY_CLIENT_ID or SHOPIFY_CLIENT_SECRET not set in Val Town env.\", 500);\n }\n\n const shop = params.get(\"shop\") || \"\";\n const code = params.get(\"code\") || \"\";\n const hmac = params.get(\"hmac\") || \"\";\n\n if (!shop || !shop.endsWith(\".myshopify.com\") || !/^[a-z0-9-]+\\.myshopify\\.com$/.test(shop)) {\n return errResponse(\"Invalid 'shop' parameter.\", 400);\n }\n if (!code || !hmac) {\n return errResponse(\"Missing required OAuth params.\", 400);\n }\n\n // 1. Verify HMAC — ensures this redirect came from Shopify\n const hmacOk = await verifyHmac(params, CLIENT_SECRET);\n if (!hmacOk) return errResponse(\"HMAC verification failed.\", 401);\n\n // 2. Exchange auth code for permanent access token\n let tokenJson: { access_token?: string; scope?: string };\n try {\n const tokenResp = await fetch(`https://${shop}/admin/oauth/access_token`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n client_id: CLIENT_ID,\n client_secret: CLIENT_SECRET,\n code,\n }),\n });\n if (!tokenResp.ok) {\n const body = await tokenResp.text();\n return errResponse(`Token exchange failed: HTTP ${tokenResp.status} ${body.slice(0, 200)}`, 500);\n }\n tokenJson = await tokenResp.json();\n } catch (e) {\n return errResponse(`Token exchange threw: ${String(e).slice(0, 200)}`, 500);\n }\n\n const accessToken = tokenJson.access_token;\n if (!accessToken) return errResponse(\"No access_token in Shopify response.\", 500);\n\n // 3. Persist the token (per-shop) in Val Town blob\n const existing = (await blob.getJSON(TOKENS_BLOB_KEY)) as Record | null;\n const tokens = existing || {};\n tokens[shop] = {\n token: accessToken,\n scope: tokenJson.scope || \"\",\n installed_at: new Date().toISOString(),\n };\n await blob.setJSON(TOKENS_BLOB_KEY, tokens);\n\n // 4. Show merchant a success page\n return new Response(successHtml(shop), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}\n\nasync function verifyHmac(params: URLSearchParams, secret: string): Promise {\n const provided = params.get(\"hmac\") || \"\";\n // Build message: all params except hmac, sorted alphabetically, joined as key=value&key=value\n const entries: [string, string][] = [];\n params.forEach((v, k) => {\n if (k !== \"hmac\" && k !== \"signature\") entries.push([k, v]);\n });\n entries.sort((a, b) => a[0].localeCompare(b[0]));\n const message = entries.map(([k, v]) => `${k}=${v}`).join(\"&\");\n\n const enc = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(message));\n const computed = Array.from(new Uint8Array(sig))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n // Constant-time compare\n if (computed.length !== provided.length) return false;\n let diff = 0;\n for (let i = 0; i < computed.length; i++) diff |= computed.charCodeAt(i) ^ provided.charCodeAt(i);\n return diff === 0;\n}\n\nfunction errResponse(msg: string, status: number): Response {\n console.error(\"[Shopify OAuth callback]\", msg);\n return new Response(\n `Anotherland AI — Error

Install error

${escapeHtml(msg)}

Reach out to johnny@anotherland.com if this persists.

`,\n { status, headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n\nfunction landingHtml(): string {\n return `Anotherland AI

Anotherland AI

Internal Shopify integration used by the Anotherland team to manage artist storefronts, theme code, and customer data syncs.

To install on your store, use the install link shared by the Anotherland team.

`;\n}\n\nfunction successHtml(shop: string): string {\n return `Anotherland AI installed

Anotherland AI installed

Successfully connected to ${escapeHtml(shop)}. You can close this window — the Anotherland team will take it from here.

`;\n}\n\nfunction escapeHtml(s: string): string {\n return s.replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c]!));\n}\n","createdAt",["D",1779390531782],"branchVersion","branchId","700ec3f0-5548-11f1-a776-ee650bb23af1","id","700e16e4-5548-11f1-a776-ee650bb23af1","anotherland-shopify",["D",1779390503117],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Anotherland Shopify admin tools","imageUrl","019cd548-d024-7281-9fdc-3f8ceaba3793","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019cd548-d024-7281-9fdc-414edecd892a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_92":91,"_99":95},"org",{"_92":91,"_93":-5,"_94":95,"_18":53,"_96":97,"_98":24},"branch",{"_13":14,"_31":82,"_41":40,"_83":42,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":43,"_90":91},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","anotherland","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzNBalQ4Z3N0TlF2Rk1qdjhhVWtob2trc0lwMyJ9","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":146,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":147,"_77":148,"_79":149,"_81":24},"tree",[141],"files",[141],"counts",{"_130":59,"_131":14,"_132":59,"_133":134,"_135":136},"contents",[123],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_41":124,"_31":27,"_29":30,"_125":-5,"_39":40,"_38":14,"_126":118,"_36":127,"_13":59,"_32":33,"_34":35,"_23":24,"_128":-5,"_26":129},"8125e8c6-5548-11f1-89b2-ee650bb23af1","parentId","latest",["D",1779390531782],"label",[27],"pulls","branches","forks","envVars",{"_137":139,"_140":59},"connections",{"_137":59,"_138":59},"count","unfilledCount",2,"emptyCount",{"_41":124,"_31":27,"_29":30,"_125":-5,"_39":40,"_38":14,"_126":118,"_36":142,"_13":59,"_32":33,"_34":35,"_23":24,"_128":-5,"_143":144,"_26":145},["D",1779390531782],"children",[],[27],["D",1779390503117],{"_92":91,"_99":95},{"_92":91,"_93":-5,"_94":95,"_18":53,"_96":97,"_98":24},{"_13":14,"_31":82,"_41":40,"_83":42,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":43,"_90":91},"ctx",{"_75":-5,"_120":183,"_184":185,"_186":187,"_188":24,"_189":24,"_190":24,"_191":118,"_192":-5,"_193":-7,"_194":-7,"_195":59,"_196":24,"_197":24,"_198":-5,"_199":24,"_200":24,"_201":24,"_202":-5},"ENV",{"_154":155,"_156":157,"_158":82,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v1