Welcome, {user.name || user.login}!

\n $\"Avatar\"$ \n \n

\n ) : (\n

Please sign in

\n \n

\n )}\n

\n );\n}\n\nexport default App;\n```\n\n## Backend Integration (Node.js/Express)\n\n```javascript\nconst express = require('express');\nconst fetch = require('node-fetch');\n\nconst app = express();\nconst AUTH_SERVICE_URL = 'https://your-auth-service.web.val.run';\n\n// Middleware to validate auth token\nasync function validateAuth(req, res, next) {\n const token = req.headers.authorization?.replace('Bearer ', '');\n \n if (!token) {\n return res.status(401).json({ error: 'No token provided' });\n }\n\n try {\n const response = await fetch(`${AUTH_SERVICE_URL}/auth/validate?token=${token}`);\n const data = await response.json();\n \n if (data.valid) {\n req.user = data.user;\n next();\n } else {\n res.status(401).json({ error: 'Invalid token' });\n }\n } catch (error) {\n res.status(500).json({ error: 'Token validation failed' });\n }\n}\n\n// Protected route\napp.get('/api/profile', validateAuth, (req, res) => {\n res.json({ user: req.user });\n});\n\napp.listen(3000);\n```\n\n## Security Best Practices\n\n1. **Token Storage**: Store tokens securely (httpOnly cookies for web apps)\n2. **Token Validation**: Always validate tokens on the server side for protected routes\n3. **HTTPS Only**: Only use this service over HTTPS in production\n4. **Token Expiry**: Tokens expire after 7 days - implement refresh logic\n5. **Environment Variables**: Never expose your GitHub client secret\n\n## Error Handling\n\n```javascript\n// Handle common errors\nasync function handleAuthError(error) {\n if (error.message.includes('Invalid token')) {\n // Token expired or invalid - redirect to sign in\n localStorage.removeItem('auth_token');\n signInWithGitHub();\n } else if (error.message.includes('Network')) {\n // Network error - show retry option\n showRetryDialog();\n } else {\n // Other errors\n console.error('Auth error:', error);\n }\n}\n```","deleted",false,"label",[19,36],"ad831688-3b3a-11f0-984c-9e149126039e","directory",["D",1748378365359],[19],{"_34":114,"_13":115,"_37":116,"_39":-5,"_41":42,"_43":117,"_45":46,"_47":118,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":119,"_18":120},{"_34":57,"_13":19,"_37":40,"_39":-5,"_41":42,"_43":44,"_45":46,"_47":107,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":108,"_18":109},{"_34":92,"_13":93,"_37":94,"_39":-5,"_41":42,"_43":95,"_45":46,"_47":96,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":97,"_18":98},{"_34":76,"_13":77,"_37":78,"_39":-5,"_41":42,"_43":79,"_45":46,"_47":80,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":81,"_18":82},{"_34":66,"_13":67,"_37":68,"_39":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":71,"_50":24,"_51":72,"_53":54,"_55":-5,"_73":74,"_18":75},"bbc17d02-3b3a-11f0-93e0-9e149126039e","README.md","47d0ef0e-3b3a-11f0-9a11-9e149126039e",15,["D",1748378389257],1,"# GitHub OAuth Authentication Service\n\nA Val Town service for handling GitHub OAuth authentication with redirect support for external applications.\n\n## Features\n\n- GitHub OAuth sign-in flow\n- JWT token generation for authenticated users\n- Redirect support for external applications\n- Secure token validation\n- User profile retrieval\n- Graceful handling of missing configuration\n\n## Setup\n\n### 1. Create a GitHub OAuth App\n\n1. Go to GitHub Settings > Developer settings > OAuth Apps\n2. Click \"New OAuth App\"\n3. Fill in the details:\n - **Application name**: Your app name\n - **Homepage URL**: Your main application URL\n - **Authorization callback URL**: `https://[your-val-url]/auth/callback`\n4. Click \"Register application\"\n5. Note down your **Client ID** and generate a **Client Secret**\n\n### 2. Configure Environment Variables\n\nIn your Val Town environment, set these variables:\n\n- `GITHUB_CLIENT_ID`: Your GitHub OAuth app client ID\n- `GITHUB_CLIENT_SECRET`: Your GitHub OAuth app client secret \n- `JWT_SECRET`: A secure random string for signing JWT tokens (generate with `openssl rand -base64 32`)\n\n### 3. Test the Service\n\nVisit your Val Town URL to see the auth page and verify configuration.\n\n## Usage\n\n### Sign In Flow\n\n1. Redirect users to: `https://[your-val-url]/auth/signin?redirect_uri=[your-app-url]`\n2. Users will be redirected to GitHub for authentication\n3. After successful auth, users are redirected back to your app with a token: `[your-app-url]?token=[jwt-token]`\n\n### Token Validation\n\nMake a GET request to: `https://[your-val-url]/auth/validate?token=[jwt-token]`\n\nReturns user profile if token is valid:\n\n```json\n{\n \"valid\": true,\n \"user\": {\n \"id\": 12345,\n \"login\": \"username\",\n \"name\": \"User Name\",\n \"email\": \"user@example.com\",\n \"avatar_url\": \"https://avatars.githubusercontent.com/u/12345\",\n \"html_url\": \"https://github.com/username\"\n },\n \"expires_at\": 1640995200\n}\n```\n\n## API Endpoints\n\n- `GET /` - Auth page UI with configuration status\n- `GET /auth/signin?redirect_uri=URL` - Initiate GitHub OAuth flow\n- `GET /auth/callback` - Handle GitHub OAuth callback (internal)\n- `GET /auth/validate?token=JWT` - Validate JWT token and return user info\n- `GET /health` - Health check with configuration status\n\n## Integration Examples\n\nSee `/examples/client-integration.md` for detailed integration examples including:\n\n- JavaScript/TypeScript frontend integration\n- React component example\n- Node.js backend middleware\n- Security best practices\n\n## File Structure\n\n```\n├── backend/\n│ └── index.ts # Main Hono server with OAuth routes\n├── frontend/\n│ └── index.html # Auth page UI\n├── shared/\n│ └── types.ts # Shared TypeScript types\n├── examples/\n│ └── client-integration.md # Integration examples\n└── README.md # This file\n```\n\n## Security Features\n\n- JWT tokens with 7-day expiration\n- State parameter validation to prevent CSRF\n- Secure token signing with configurable secret\n- Input validation and error handling\n- HTTPS-only operation in production\n\n## Error Handling\n\nThe service provides clear error messages for:\n\n- Missing configuration\n- Invalid redirect URIs\n- GitHub OAuth errors\n- Token validation failures\n- Network issues\n\n## Development\n\nThe service gracefully handles missing environment variables during development, showing configuration warnings in the UI and API responses.","children",[],[67],"4df6514e-3b3a-11f0-b246-9e149126039e","shared","39885a88-d8a3-4095-87bd-5bd287e5cbc3",3,["D",1748378205053],[83],[77],{"_34":84,"_13":85,"_37":86,"_39":78,"_41":42,"_43":79,"_45":46,"_47":87,"_17":49,"_50":88,"_51":89,"_53":54,"_55":-5,"_73":90,"_18":91},"4df5f6f4-3b3a-11f0-b246-9e149126039e","types.ts","4df5f7b2-3b3a-11f0-b246-9e149126039e",["D",1748378205053],"script","// Shared types for GitHub OAuth authentication\n\nexport interface GitHubUser {\n id: number;\n login: string;\n name: string | null;\n email: string | null;\n avatar_url: string;\n html_url: string;\n}\n\nexport interface AuthToken {\n user: GitHubUser;\n iat: number;\n exp: number;\n}\n\nexport interface GitHubTokenResponse {\n access_token: string;\n token_type: string;\n scope: string;\n}\n\nexport interface AuthError {\n error: string;\n error_description?: string;\n}",[],[77,85],"70f53b88-3b3a-11f0-80d6-9e149126039e","frontend","90b9c8f1-c38a-4131-8404-ddca091f8c60",5,["D",1748378263766],[99],[93],{"_34":100,"_13":101,"_37":102,"_39":94,"_41":42,"_43":95,"_45":46,"_47":103,"_17":49,"_50":24,"_51":104,"_53":54,"_55":-5,"_73":105,"_18":106},"70f4f5b0-3b3a-11f0-80d6-9e149126039e","index.html","70f4f68c-3b3a-11f0-80d6-9e149126039e",["D",1748378263766],"\n\n\n \n \n GitHub Authentication\n \n \n\n\n

\n \n

\n GitHub Authentication\n

\n Secure authentication service for your applications\n

\n\n

\n \n Redirect URI (where to send users after auth)\n \n \n

\n\n \n

\n\n

\n \n

\n\n

This service provides secure GitHub OAuth authentication.

After authentication, you'll be redirected back to your application with a secure token.

\n\n \n

API Usage

Initiate Sign In:

\n \n GET /auth/signin?redirect_uri=YOUR_APP_URL\n \n

Validate Token:

\n \n GET /auth/validate?token=JWT_TOKEN\n \n

Required Environment Variables:

GITHUB_CLIENT_ID
GITHUB_CLIENT_SECRET
JWT_SECRET

\n\n \n\n",[],[93,101],["D",1748378365359],[110],[19],{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":111,"_17":49,"_50":24,"_51":52,"_53":54,"_55":-5,"_73":112,"_18":113},["D",1748378365359],[],[19,36],"5a6ed45a-3b3a-11f0-bec7-9e149126039e","backend","bf332b80-887e-4688-9890-891be88c7019",4,["D",1748378225973],[121],[115],{"_34":122,"_13":123,"_37":124,"_39":116,"_41":42,"_43":125,"_45":46,"_47":126,"_17":127,"_50":128,"_51":129,"_53":54,"_55":-5,"_73":130,"_18":131},"9a11f5d8-3b3a-11f0-84c6-9e149126039e","index.ts","5a6eaba6-3b3a-11f0-bec7-9e149126039e",13,["D",1748378332692],7,"http","import { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { readFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\nimport { sign, verify } from \"https://esm.sh/jsonwebtoken@9.0.2\";\nimport type { GitHubUser, GitHubTokenResponse, AuthToken, AuthError } from \"../shared/types.ts\";\n\nconst app = new Hono();\n\n// Unwrap Hono errors to see original error details\napp.onError((err, c) => {\n throw err;\n});\n\n// Environment variables\nconst GITHUB_CLIENT_ID = Deno.env.get('GITHUB_CLIENT_ID');\nconst GITHUB_CLIENT_SECRET = Deno.env.get('GITHUB_CLIENT_SECRET');\nconst JWT_SECRET = Deno.env.get('JWT_SECRET');\n\n// Check if environment variables are configured\nconst isConfigured = GITHUB_CLIENT_ID && GITHUB_CLIENT_SECRET && JWT_SECRET;\n\n// Serve the auth page\napp.get(\"/\", async (c) => {\n const html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n if (!isConfigured) {\n // Inject configuration warning\n const warningScript = ``;\n \n return c.html(html.replace(\"\", `${warningScript}`));\n }\n \n return c.html(html);\n});\n\n// Initiate GitHub OAuth flow\napp.get(\"/auth/signin\", (c) => {\n if (!isConfigured) {\n return c.json({ error: 'Service not configured. Please set environment variables.' }, 500);\n }\n\n const redirectUri = c.req.query('redirect_uri');\n \n if (!redirectUri) {\n return c.json({ error: 'redirect_uri parameter is required' }, 400);\n }\n\n // Store redirect URI in state parameter (base64 encoded for URL safety)\n const state = btoa(redirectUri);\n \n const githubAuthUrl = new URL('https://github.com/login/oauth/authorize');\n githubAuthUrl.searchParams.set('client_id', GITHUB_CLIENT_ID!);\n githubAuthUrl.searchParams.set('redirect_uri', `${c.req.url.split('/auth/signin')[0]}/auth/callback`);\n githubAuthUrl.searchParams.set('scope', 'user:email');\n githubAuthUrl.searchParams.set('state', state);\n\n return new Response(null, {\n status: 302,\n headers: { Location: githubAuthUrl.toString() }\n });\n});\n\n// Handle GitHub OAuth callback\napp.get(\"/auth/callback\", async (c) => {\n if (!isConfigured) {\n return c.json({ error: 'Service not configured. Please set environment variables.' }, 500);\n }\n\n const code = c.req.query('code');\n const state = c.req.query('state');\n const error = c.req.query('error');\n\n if (error) {\n const errorDescription = c.req.query('error_description') || 'GitHub OAuth error';\n return c.json({ error, error_description: errorDescription }, 400);\n }\n\n if (!code || !state) {\n return c.json({ error: 'Missing code or state parameter' }, 400);\n }\n\n try {\n // Decode redirect URI from state\n const redirectUri = atob(state);\n\n // Exchange code for access token\n const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {\n method: 'POST',\n headers: {\n 'Accept': 'application/json',\n 'Content-Type': 'application/json',\n },\n body: JSON.stringify({\n client_id: GITHUB_CLIENT_ID!,\n client_secret: GITHUB_CLIENT_SECRET!,\n code,\n }),\n });\n\n const tokenData: GitHubTokenResponse = await tokenResponse.json();\n\n if (!tokenData.access_token) {\n return c.json({ error: 'Failed to obtain access token' }, 400);\n }\n\n // Get user information from GitHub\n const userResponse = await fetch('https://api.github.com/user', {\n headers: {\n 'Authorization': `Bearer ${tokenData.access_token}`,\n 'Accept': 'application/vnd.github.v3+json',\n },\n });\n\n const userData: GitHubUser = await userResponse.json();\n\n // Create JWT token\n const jwtPayload: Omit = {\n user: userData,\n };\n\n const token = sign(jwtPayload, JWT_SECRET!, { expiresIn: '7d' });\n\n // Redirect back to the original app with the token\n const finalRedirectUrl = new URL(redirectUri);\n finalRedirectUrl.searchParams.set('token', token);\n\n return new Response(null, {\n status: 302,\n headers: { Location: finalRedirectUrl.toString() }\n });\n\n } catch (error) {\n console.error('OAuth callback error:', error);\n return c.json({ error: 'Authentication failed' }, 500);\n }\n});\n\n// Validate JWT token and return user info\napp.get(\"/auth/validate\", (c) => {\n if (!isConfigured) {\n return c.json({ error: 'Service not configured. Please set environment variables.' }, 500);\n }\n\n const token = c.req.query('token');\n\n if (!token) {\n return c.json({ error: 'Token parameter is required' }, 400);\n }\n\n try {\n const decoded = verify(token, JWT_SECRET!) as AuthToken;\n return c.json({\n valid: true,\n user: decoded.user,\n expires_at: decoded.exp,\n });\n } catch (error) {\n return c.json({ \n valid: false, \n error: 'Invalid or expired token' \n }, 401);\n }\n});\n\n// Health check endpoint\napp.get(\"/health\", (c) => {\n return c.json({ \n status: 'ok', \n timestamp: new Date().toISOString(),\n configured: isConfigured,\n missing_vars: isConfigured ? [] : [\n !GITHUB_CLIENT_ID && 'GITHUB_CLIENT_ID',\n !GITHUB_CLIENT_SECRET && 'GITHUB_CLIENT_SECRET', \n !JWT_SECRET && 'JWT_SECRET'\n ].filter(Boolean)\n });\n});\n\n// Export the Hono app\nexport default app.fetch;",[],[115,123],"a9e6453c-3b39-11f0-a3ac-9e149126039e",["D",1748377929808],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","21f2e37e-8066-4730-9dc7-d27cf8d3c9f3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","0630d977-f678-453e-926c-52043293f59f","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_184":180},"org",{"_11":12,"_178":-5,"_179":180,"_141":142,"_181":182,"_183":54},"branch",{"_17":69,"_13":16,"_34":42,"_170":132,"_171":-5,"_172":-5,"_173":-5,"_174":-5,"_175":-5,"_176":14,"_177":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yb2RJNlc1czZ1NlpZRmoxdGJ2eFVNNVhmeTYifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":132,"_13":14,"_47":245,"_134":-5,"_135":54,"_136":137,"_138":137,"_139":-5,"_140":-5,"_141":142,"_143":124,"_144":46,"_145":46,"_146":-5,"_147":71,"_148":149,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":155,"_156":155,"_157":158,"_159":158,"_160":158,"_161":155,"_162":155,"_163":246,"_165":247,"_167":248,"_169":54},[218,220,222,224,226],"files",[218,219,220,221,222,223,224,225,226],"counts",{"_209":49,"_210":71,"_211":49,"_32":212,"_213":214},[207],{"_34":57,"_13":19,"_37":40,"_39":-5,"_41":42,"_43":44,"_45":46,"_47":205,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_18":206},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{"_124":204},"auth.parc.land",["D",1748378365359],[19],{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":24,"_51":52,"_53":54,"_55":-5,"_18":208},[19,36],"pulls","branches","forks",{"_215":79,"_217":49},"connections",{"_215":49,"_216":49},"count","unfilledCount","emptyCount",{"_34":114,"_13":115,"_37":116,"_39":-5,"_41":42,"_43":117,"_45":46,"_47":118,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":243,"_18":244},{"_34":122,"_13":123,"_37":124,"_39":116,"_41":42,"_43":125,"_45":46,"_47":126,"_17":127,"_50":128,"_51":129,"_53":54,"_55":-5,"_73":241,"_18":242},{"_34":57,"_13":19,"_37":40,"_39":-5,"_41":42,"_43":44,"_45":46,"_47":107,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":239,"_18":240},{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":111,"_17":49,"_50":24,"_51":52,"_53":54,"_55":-5,"_73":237,"_18":238},{"_34":92,"_13":93,"_37":94,"_39":-5,"_41":42,"_43":95,"_45":46,"_47":96,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":235,"_18":236},{"_34":100,"_13":101,"_37":102,"_39":94,"_41":42,"_43":95,"_45":46,"_47":103,"_17":49,"_50":24,"_51":104,"_53":54,"_55":-5,"_73":233,"_18":234},{"_34":76,"_13":77,"_37":78,"_39":-5,"_41":42,"_43":79,"_45":46,"_47":80,"_17":49,"_50":58,"_51":-5,"_53":54,"_55":-5,"_73":231,"_18":232},{"_34":84,"_13":85,"_37":86,"_39":78,"_41":42,"_43":79,"_45":46,"_47":87,"_17":49,"_50":88,"_51":89,"_53":54,"_55":-5,"_73":229,"_18":230},{"_34":66,"_13":67,"_37":68,"_39":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":71,"_50":24,"_51":72,"_53":54,"_55":-5,"_73":227,"_18":228},[],[67],[],[77,85],[225],[77],[],[93,101],[223],[93],[],[19,36],[221],[19],[],[115,123],[219],[115],["D",1748377929808],{"_11":12,"_184":180},{"_11":12,"_178":-5,"_179":180,"_141":142,"_181":182,"_183":54},{"_17":69,"_13":16,"_34":42,"_170":132,"_171":-5,"_172":-5,"_173":-5,"_174":-5,"_175":-5,"_176":14,"_177":12},"ctx",{"_163":-5,"_201":282,"_283":284,"_285":286,"_287":54,"_288":54,"_289":54,"_290":46,"_291":-5,"_292":-7,"_293":-7,"_294":49,"_295":54,"_296":54,"_297":-5,"_298":54,"_299":54,"_300":54,"_301":-5},"ENV",{"_253":254,"_255":256,"_257":16,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]