Hi

\"\n});\n```\n\n## Val Town Utility Functions\n\nVal Town provides several utility functions to help with common project tasks.\n\n### Importing Utilities\n\nAlways import utilities with version pins to avoid breaking changes:\n\n```ts\nimport { parseProject, readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n```\n\n### Available Utilities\n\n\n#### **serveFile** - Serve project files with proper content types\n\nFor example, in Hono:\n\n```ts\n// serve all files in frontend/ and shared/\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n```\n\n#### **readFile** - Read files from within the project:\n\n```ts\n// Read a file from the project\nconst fileContent = await readFile(\"/frontend/index.html\", import.meta.url);\n```\n\n#### **listFiles** - List all files in the project\n\n```ts\nconst files = await listFiles(import.meta.url);\n```\n\n#### **parseProject** - Extract information about the current project from import.meta.url\n\nThis is useful for including info for linking back to a val, ie in \"view source\" urls:\n\n```ts\nconst projectVal = parseProject(import.meta.url);\nconsole.log(projectVal.username); // Owner of the project\nconsole.log(projectVal.name); // Project name\nconsole.log(projectVal.version); // Version number\nconsole.log(projectVal.branch); // Branch name\nconsole.log(projectVal.links.self.project); // URL to the project page\n```\n\nHowever, it's *extremely importing* to note that `parseProject` and other Standard Library utilities ONLY RUN ON THE SERVER.\nIf you need access to this data on the client, run it in the server and pass it to the client by splicing it into the HTML page\nor by making an API request for it.\n\n## Val Town Platform Specifics\n\n- **Redirects:** Use `return new Response(null, { status: 302, headers: { Location: \"/place/to/redirect\" }})` instead of `Response.redirect` which is broken\n- **Images:** Avoid external images or base64 images. Use emojis, unicode symbols, or icon fonts/libraries instead\n- **AI Image:** To inline generate an AI image use: `

`\n- **Storage:** DO NOT use the Deno KV module for storage\n- **Browser APIs:** DO NOT use the `alert()`, `prompt()`, or `confirm()` methods\n- **Weather Data:** Use open-meteo for weather data (doesn't require API keys) unless otherwise specified\n- **View Source:** Add a view source link by importing & using `import.meta.url.replace(\"ems.sh\", \"val.town)\"` (or passing this data to the client) and include `target=\"_top\"` attribute\n- **Error Debugging:** Add `` to HTML to capture client-side errors\n- **Error Handling:** Only use try...catch when there's a clear local resolution; Avoid catches that merely log or return 500s. Let errors bubble up with full context\n- **Environment Variables:** Use `Deno.env.get('keyname')` when you need to, but generally prefer APIs that don't require keys\n- **Imports:** Use `https://esm.sh` for npm and Deno dependencies to ensure compatibility on server and browser\n- **Storage Strategy:** Only use backend storage if explicitly required; prefer simple static client-side sites\n- **React Configuration:** When using React libraries, pin versions with `?deps=react@18.2.0,react-dom@18.2.0` and start the file with `/** @jsxImportSource https://esm.sh/react@18.2.0 */`\n- Ensure all React dependencies and sub-dependencies are pinned to the same version\n- **Styling:** Default to using TailwindCSS via `` unless otherwise specified\n\n## Project Structure and Design Patterns\n\n### Recommended Directory Structure\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts # Schema definitions\n│ │ ├── queries.ts # DB query functions\n│ │ └── README.md\n│ └── routes/ # Route modules\n│ ├── [route].ts\n│ └── static.ts # Static file serving\n│ ├── index.ts # Main entry point\n│ └── README.md\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html # Main HTML template\n│ ├── index.tsx # Frontend JS entry point\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n ├── README.md\n └── utils.ts # Shared types and functions\n```\n\n### Backend (Hono) Best Practices\n\n- Hono is the recommended API framework\n- Main entry point should be `backend/index.ts`\n- **Static asset serving:** Use the utility functions to read and serve project files:\n ```ts\n import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n \n // serve all files in frontend/ and shared/\n app.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\n app.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n \n // For index.html, often you'll want to bootstrap with initial data\n app.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Inject data to avoid extra round-trips\n const initialData = await fetchInitialData();\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n });\n ```\n- Create RESTful API routes for CRUD operations\n- Always include this snippet at the top-level Hono app to re-throwing errors to see full stack traces:\n ```ts\n // Unwrap Hono errors to see original error details\n app.onError((err, c) => {\n throw err;\n });\n ```\n\n### Database Patterns\n- Run migrations on startup or comment out for performance\n- Change table names when modifying schemas rather than altering\n- Export clear query functions with proper TypeScript typing\n\n## Common Gotchas and Solutions\n\n1. **Environment Limitations:** \n - Val Town runs on Deno in a serverless context, not Node.js\n - Code in `shared/` must work in both frontend and backend environments\n - Cannot use `Deno` keyword in shared code\n - Use `https://esm.sh` for imports that work in both environments\n\n2. **SQLite Peculiarities:**\n - Limited support for ALTER TABLE operations\n - Create new tables with updated schemas and copy data when needed\n - Always run table creation before querying\n\n3. **React Configuration:**\n - All React dependencies must be pinned to 18.2.0\n - Always include `@jsxImportSource https://esm.sh/react@18.2.0` at the top of React files\n - Rendering issues often come from mismatched React versions\n\n4. **File Handling:**\n - Val Town only supports text files, not binary\n - Use the provided utilities to read files across branches and forks\n - For files in the project, use `readFile` helpers\n\n5. **API Design:**\n - `fetch` handler is the entry point for HTTP vals\n - Run the Hono app with `export default app.fetch // This is the entry point for HTTP vals`\n\n# Project description\n\nThis is a val.town library of authentication flows.\n\n# Auth Architecture for Val Town\n\n## High‑level directory layout\n\n```\nauth/\n├── core/\n│ ├── signer.ts # JWT & HMAC helpers (shared)\n│ ├── adapters.ts # Wraps each implementation behind a common interface\n│ └── types.ts\n├── react/\n│ ├── createHook.ts # factory that turns any adapter into a React hook\n│ ├── createComponents.ts# factory that turns a hook into UI\n│ ├── valAuth.tsx # useValAuth + \n│ ├── github.tsx # useGitHubAuth + \n│ └── password.tsx # usePasswordAuth + \n├── hono/\n│ ├── createMiddleware.ts# shared validator/issuer\n│ ├── valAuth.ts # valAuthMiddleware()\n│ ├── github.ts # githubAuthMiddleware()\n│ └── password.ts # passwordAuthMiddleware()\n└── index.ts # re‑exports everything\n```\n\n---\n\n## Mapping requirements → code\n\n| Requirement | How it’s met |\n|-------------|--------------|\n| **Exportable React hooks with showcase components** | `createHook()` produces `useXAuth()`; `createComponents()` wraps it into a button/form. Each provider is its own short *val* (`valAuth.tsx`, `github.tsx`, `password.tsx`). |\n| **Exportable Hono middleware** | `createMiddleware()` turns the same adapter into `valAuthMiddleware()`, `githubAuthMiddleware()`, `passwordAuthMiddleware()` that attach `ctx.var.user`. |\n\n---\n\n## Adapter interface\n\n```ts\nexport interface AuthAdapter {\n id: \"val\" | \"github\" | \"password\";\n initiate?(ctx: Context): Promise; // optional redirect step\n exchange?(ctx: Context): Promise; // optional callback step\n verify(token: string): Promise; // must validate credential\n issue?(user: User): Promise; // optional server‑side login\n}\n```\n\n### Concrete adapters\n\n* **Val.town API key** – thin wrapper around \n \n* **GitHub OAuth** – based on \n \n* **Password** – uses \n \n\nAll issue/verify the **same JWT shape** (`sub`, `exp`, `iat`, `adapterId`), sharing `core/signer.ts`.\n\n---\n\n## Swappable provider example\n\n### 1 · Pick the adapter once\n\n```ts\n// config.ts\nimport { valAdapter } from \"yourname.valAuth\";\nimport { githubAdapter } from \"yourname.githubAuth\";\nimport { passwordAdapter } from \"yourname.passwordAuth\";\n\ntype Provider = \"val\" | \"github\" | \"password\";\nconst CHOSEN: Provider = (process.env.AUTH_PROVIDER as Provider) ?? \"val\";\n\nexport const adapter = {\n val: valAdapter,\n github: githubAdapter,\n password: passwordAdapter,\n}[CHOSEN];\n```\n\n### 2 · Generate React + Hono glue\n\n```ts\n// auth.ts\nimport { createHook } from \"yourname.auth/react/createHook\";\nimport { createComponents } from \"yourname.auth/react/createComponents\";\nimport { createMiddleware } from \"yourname.auth/hono/createMiddleware\";\nimport { adapter } from \"./config\";\n\nexport const { useAuth, AuthButton } = createComponents(createHook(adapter));\nexport const authMiddleware = createMiddleware(adapter);\n```\n\n### 3 · Use it everywhere\n\n```tsx\n// ui.tsx\nimport { AuthButton } from \"./auth\";\n\nexport const Login = () => (\n alert(u.email)} />\n);\n```\n\n```ts\n// api.val.ts\nimport { Hono } from \"hono\";\nimport { authMiddleware } from \"./auth\";\n\nexport const app = new Hono()\n .use(\"/api/*\", authMiddleware) \n .get(\"/api/user\", c => c.json(c.var.user));\n```\n\n### 4 · Switch provider with an env var\n\n```bash\n# .env\nAUTH_PROVIDER=github # or \"password\", etc.\n```\n\nThat one line flips both the **frontend hook/component** and the **backend middleware** without touching application code.\n\n# Step 0 - Implement a GitHub OAuth page - IN PROGRESS\n\nFor now, other methods can just have placeholders that throw a not implemented error.\n\n## Step 0.1 - Extract code served at `GET /` to a file - IN PROGRESS \n\nWe're running into an import issue on val.town: adapters.ts import fails since the val.town returns 404.\n\nUse .tsx imports in val-town style.\n",[146],"1481738a-59d0-11f0-8126-f69ea79377d9","deno.json","75a65a6a-59c4-11f0-ab77-f69ea79377d9",74,["D",1751741068051],2,"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\n \"https://www.val.town/types/valtown.d.ts\"\n ],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"files\": {\n \"include\": [\n \"deno:/https/esm.town/**/*\"\n ]\n },\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\"\n ]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}",[154],"1de3ec86-59c7-11f0-a4e1-f69ea79377d9","README.md","1de3ed30-59c7-11f0-a4e1-f69ea79377d9",25,["D",1751737218291],"# Val Town Authentication Library\n\nA modular authentication library for Val Town with support for multiple OAuth providers.\n\n## Step 0 Implementation - GitHub OAuth\n\nThis implementation provides a complete GitHub OAuth 2.0 flow with the following features:\n\n### ✅ Implemented Features\n\n- **GitHub OAuth 2.0 Authorization Code Flow** - Secure OAuth implementation\n- **JWT-based Session Management** - Stateless authentication tokens\n- **CSRF Protection** - State parameter validation to prevent attacks\n- **Secure HTTP-only Cookies** - Prevents XSS token theft\n- **Hono Middleware** - Easy integration with Hono applications\n- **React Hooks & Components** - Ready-to-use frontend components\n- **Modular Architecture** - Adapter pattern for multiple auth providers\n\n### 🏗️ Architecture\n\n```\nauth/\n├── core/\n│ ├── types.ts # TypeScript interfaces\n│ ├── signer.ts # JWT signing/verification\n│ └── adapters.ts # Auth provider implementations\n├── hono/\n│ ├── createMiddleware.ts # Middleware factory\n│ └── github.ts # GitHub-specific routes\n├── react/\n│ ├── createHook.ts # React hook factory\n│ ├── createComponents.ts # Component factory\n│ └── github.tsx # GitHub components\n└── index.ts # Main exports\n```\n\n### 🔧 Setup\n\n1. **Environment Variables**\n ```bash\n GITHUB_CLIENT_ID=your_github_client_id\n GITHUB_CLIENT_SECRET=your_github_client_secret\n JWT_SECRET=your_secure_jwt_secret\n ```\n\n2. **GitHub OAuth App Configuration**\n - Authorization callback URL: `https://your-domain.com/auth/github/callback`\n - Requested scopes: `user:email`, `read:user`\n\n### 🚀 Usage\n\n```typescript\nimport { Hono } from \"hono\";\nimport { createGitHubAuthRoutes, githubAuthMiddleware } from \"./auth/hono/github.ts\";\n\nconst app = new Hono();\n\n// Add auth routes\nconst authRoutes = createGitHubAuthRoutes();\napp.route(\"/\", authRoutes);\n\n// Protect API routes\napp.get(\"/api/me\", githubAuthMiddleware, (c) => {\n const user = c.get(\"user\");\n return c.json(user);\n});\n```\n\n### 🔒 Security Features\n\n- **CSRF Protection**: State parameter validation\n- **Secure Cookies**: HttpOnly, Secure, SameSite=Lax\n- **JWT Validation**: Proper token verification with expiration\n- **Environment Variables**: No hardcoded secrets\n- **Error Handling**: Proper error bubbling and logging\n\n### ⏳ Placeholder Implementations\n\n- **Val Town Adapter**: Throws \"not implemented\" error\n- **Password Adapter**: Throws \"not implemented\" error\n\nThese will be implemented in future steps.\n\n### 🧪 Demo\n\nRun the main.tsx file to see a working demonstration of the GitHub OAuth flow with a beautiful UI built using React and TailwindCSS.\n\n### 📝 Next Steps\n\n1. Implement Val Town API key authentication\n2. Implement password-based authentication\n3. Add refresh token support\n4. Add user profile management\n5. Add role-based access control\n",[162],"759fb444-59c4-11f0-87e6-f69ea79377d9",".vtignore","759fb58e-59c4-11f0-87e6-f69ea79377d9",3,["D",1751736077028],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor",[169],"c1a003ec-59d0-11f0-b28f-f69ea79377d9","lib","c1a004dc-59d0-11f0-b28f-f69ea79377d9",76,["D",1751741358497],[176],"52cea2ba-59c7-11f0-b59b-f69ea79377d9","frontend","52cea4c2-59c7-11f0-b59b-f69ea79377d9",28,["D",1751737307106],[182],"364f70c0-59c6-11f0-bdc8-f69ea79377d9","auth","364f716a-59c6-11f0-bdc8-f69ea79377d9",7,["D",1751736829802],[188],"pulls","branches",1,"forks","envVars",{"_201":195,"_203":60},"connections",{"_201":60,"_202":60},"count","unfilledCount","emptyCount",{"_41":187,"_31":188,"_29":189,"_135":-5,"_39":40,"_38":190,"_137":24,"_36":368,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":369,"_26":370},{"_41":363,"_31":256,"_29":341,"_135":189,"_39":40,"_38":364,"_137":24,"_36":365,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":366,"_26":367},{"_41":355,"_31":356,"_29":357,"_135":341,"_39":40,"_38":358,"_137":24,"_36":359,"_13":150,"_33":270,"_35":360,"_23":24,"_142":-5,"_229":361,"_26":362},{"_41":347,"_31":348,"_29":349,"_135":341,"_39":40,"_38":350,"_137":24,"_36":351,"_13":158,"_33":270,"_35":352,"_23":24,"_142":-5,"_229":353,"_26":354},{"_41":338,"_31":339,"_29":340,"_135":341,"_39":40,"_38":342,"_137":24,"_36":343,"_13":158,"_33":270,"_35":344,"_23":24,"_142":-5,"_229":345,"_26":346},{"_41":333,"_31":249,"_29":319,"_135":189,"_39":40,"_38":334,"_137":24,"_36":335,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":336,"_26":337},{"_41":325,"_31":326,"_29":327,"_135":319,"_39":40,"_38":328,"_137":24,"_36":329,"_13":195,"_33":270,"_35":330,"_23":24,"_142":-5,"_229":331,"_26":332},{"_41":316,"_31":317,"_29":318,"_135":319,"_39":40,"_38":320,"_137":24,"_36":321,"_13":291,"_33":270,"_35":322,"_23":24,"_142":-5,"_229":323,"_26":324},{"_41":311,"_31":32,"_29":288,"_135":189,"_39":40,"_38":312,"_137":24,"_36":313,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":314,"_26":315},{"_41":303,"_31":304,"_29":305,"_135":288,"_39":40,"_38":306,"_137":24,"_36":307,"_13":195,"_33":270,"_35":308,"_23":24,"_142":-5,"_229":309,"_26":310},{"_41":295,"_31":296,"_29":297,"_135":288,"_39":40,"_38":298,"_137":24,"_36":299,"_13":195,"_33":270,"_35":300,"_23":24,"_142":-5,"_229":301,"_26":302},{"_41":285,"_31":286,"_29":287,"_135":288,"_39":40,"_38":289,"_137":24,"_36":290,"_13":291,"_33":270,"_35":292,"_23":24,"_142":-5,"_229":293,"_26":294},{"_41":181,"_31":182,"_29":183,"_135":-5,"_39":40,"_38":184,"_137":56,"_36":282,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":283,"_26":284},{"_41":274,"_31":275,"_29":276,"_135":183,"_39":40,"_38":277,"_137":56,"_36":278,"_13":60,"_33":20,"_35":279,"_23":24,"_142":-5,"_229":280,"_26":281},{"_41":265,"_31":266,"_29":267,"_135":183,"_39":40,"_38":268,"_137":24,"_36":269,"_13":158,"_33":270,"_35":271,"_23":24,"_142":-5,"_229":272,"_26":273},{"_41":175,"_31":176,"_29":177,"_135":-5,"_39":40,"_38":178,"_137":56,"_36":262,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":263,"_26":264},{"_41":255,"_31":256,"_29":257,"_135":177,"_39":40,"_38":258,"_137":56,"_36":259,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":260,"_26":261},{"_41":248,"_31":249,"_29":250,"_135":177,"_39":40,"_38":251,"_137":56,"_36":252,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":253,"_26":254},{"_41":244,"_31":32,"_29":30,"_135":177,"_39":40,"_38":14,"_137":56,"_36":245,"_13":60,"_33":34,"_35":-5,"_23":24,"_142":-5,"_229":246,"_26":247},{"_41":168,"_31":169,"_29":170,"_135":-5,"_39":40,"_38":171,"_137":56,"_36":241,"_13":60,"_33":20,"_35":173,"_23":24,"_142":-5,"_229":242,"_26":243},{"_41":161,"_31":162,"_29":163,"_135":-5,"_39":40,"_38":164,"_137":56,"_36":238,"_13":60,"_33":20,"_35":166,"_23":24,"_142":-5,"_229":239,"_26":240},{"_41":153,"_31":154,"_29":155,"_135":-5,"_39":40,"_38":156,"_137":56,"_36":235,"_13":158,"_33":20,"_35":159,"_23":24,"_142":-5,"_229":236,"_26":237},{"_41":145,"_31":146,"_29":147,"_135":-5,"_39":40,"_38":148,"_137":56,"_36":232,"_13":150,"_33":20,"_35":151,"_23":24,"_142":-5,"_229":233,"_26":234},{"_41":133,"_31":134,"_29":54,"_135":-5,"_39":40,"_38":136,"_137":24,"_36":228,"_13":139,"_33":140,"_35":141,"_23":24,"_142":143,"_229":230,"_26":231},["D",1751741082661],"children",[],[134],["D",1751740342293],[],[146],["D",1751741068051],[],[154],["D",1751737218291],[],[162],["D",1751736077028],[],[169],"c1e5dffc-59d0-11f0-abe8-f69ea79377d9",["D",1751741358957],[],[176,32],"c1cfd2c0-59d0-11f0-abe8-f69ea79377d9","hono","c1cfd360-59d0-11f0-abe8-f69ea79377d9",78,["D",1751741358813],[],[176,249],"c1b8b900-59d0-11f0-a755-f69ea79377d9","core","c1b8b9a0-59d0-11f0-a755-f69ea79377d9",77,["D",1751741358658],[],[176,256],["D",1751741358497],[220,221,222],[176],"06e5c55c-59ce-11f0-b6fa-f69ea79377d9","index.tsx","52ea817e-59c7-11f0-a95d-f69ea79377d9",49,["D",1751740186065],"script","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client\";\nimport { GitHubAuthButton } from \"../auth/react/github.ts\";\n\n// Main App Component\nfunction App() {\n return React.createElement(\"div\", {\n className: \"container mx-auto px-4 py-8\",\n }, [\n React.createElement(\"div\", {\n key: \"header\",\n className: \"text-center mb-8\",\n }, [\n React.createElement(\"h1\", {\n key: \"title\",\n className: \"text-4xl font-bold text-gray-900 mb-4\",\n }, \"Val Town Authentication Library\"),\n React.createElement(\"p\", {\n key: \"subtitle\",\n className: \"text-xl text-gray-600 mb-8\",\n }, \"GitHub OAuth Demo - Step 0.1 Implementation\"),\n ]),\n React.createElement(\"div\", {\n key: \"demo\",\n className: \"max-w-md mx-auto\",\n }, [\n React.createElement(\"div\", {\n key: \"card\",\n className: \"bg-white rounded-lg shadow-lg p-8 text-center\",\n }, [\n React.createElement(\"h2\", {\n key: \"card-title\",\n className: \"text-2xl font-semibold mb-6\",\n }, \"GitHub Authentication\"),\n React.createElement(GitHubAuthButton, {\n key: \"auth-button\",\n onSuccess: (user) => {\n console.log(\"User authenticated:\", user);\n },\n }),\n ]),\n ]),\n React.createElement(\"div\", {\n key: \"info\",\n className: \"mt-12 max-w-2xl mx-auto\",\n }, [\n React.createElement(\"div\", {\n key: \"info-card\",\n className: \"bg-white rounded-lg shadow-lg p-6\",\n }, [\n React.createElement(\"h3\", {\n key: \"info-title\",\n className: \"text-xl font-semibold mb-4\",\n }, \"Implementation Details\"),\n React.createElement(\"ul\", {\n key: \"info-list\",\n className: \"space-y-2 text-gray-700\",\n }, [\n React.createElement(\n \"li\",\n { key: \"1\" },\n \"✅ GitHub OAuth 2.0 Authorization Code Flow\",\n ),\n React.createElement(\n \"li\",\n { key: \"2\" },\n \"✅ JWT-based session management\",\n ),\n React.createElement(\n \"li\",\n { key: \"3\" },\n \"✅ Secure HTTP-only cookies\",\n ),\n React.createElement(\n \"li\",\n { key: \"4\" },\n \"✅ Hono middleware for authentication\",\n ),\n React.createElement(\n \"li\",\n { key: \"5\" },\n \"✅ Reusable React hooks and components\",\n ),\n React.createElement(\n \"li\",\n { key: \"6\" },\n \"⏳ Val Town adapter (placeholder)\",\n ),\n React.createElement(\n \"li\",\n { key: \"7\" },\n \"⏳ Password adapter (placeholder)\",\n ),\n ]),\n ]),\n ]),\n ]);\n}\n\n// Initialize the app\nconst root = createRoot(document.getElementById(\"root\"));\nroot.render(React.createElement(App));\n",[],[182,266],"52e55eec-59c7-11f0-af34-f69ea79377d9","index.html","52e55fb4-59c7-11f0-af34-f69ea79377d9",29,["D",1751737307253],"\n\n\n \n \n GitHub OAuth Demo - Val Town Auth\n \n \n \n\n\n

\n \n\n\n",[],[182,275],["D",1751737307106],[217,218],[182],"cd8d8266-59cf-11f0-bdbf-f69ea79377d9","github.ts","66a4ba3c-59c6-11f0-adc2-f69ea79377d9","36937522-59c6-11f0-bbf7-f69ea79377d9",68,["D",1751740949010],4,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { githubAdapter } from \"../core/adapters.tsx\";\nimport { createHook } from \"./createHook.tsx\";\nimport { createComponents } from \"./createComponents.tsx\";\n\nexport const useGitHubAuth = createHook(githubAdapter);\nexport const { AuthButton: GitHubAuthButton } = createComponents(useGitHubAuth);\n",[],[188,32,286],"75559f50-59cc-11f0-8786-f69ea79377d9","createHook.tsx","36c7cdf4-59c6-11f0-a47d-f69ea79377d9",39,["D",1751739512467],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState, useEffect } from \"https://esm.sh/react@18.2.0\";\nimport type { AuthAdapter, User } from \"../core/types.tsx\";\n\nexport function createHook(adapter: AuthAdapter) {\n return function useAuth() {\n const [user, setUser] = useState(null);\n const [loading, setLoading] = useState(true);\n const [error, setError] = useState(null);\n \n useEffect(() => {\n checkAuthStatus();\n }, []);\n \n const checkAuthStatus = async () => {\n try {\n const response = await fetch(\"/api/me\");\n if (response.ok) {\n const userData = await response.json();\n setUser(userData);\n }\n } catch (err) {\n setError(\"Failed to check authentication status\");\n } finally {\n setLoading(false);\n }\n };\n \n const login = () => {\n window.location.href = `/auth/${adapter.id}`;\n };\n \n const logout = async () => {\n try {\n await fetch(\"/auth/logout\", { method: \"POST\" });\n setUser(null);\n window.location.reload();\n } catch (err) {\n setError(\"Failed to logout\");\n }\n };\n \n return {\n user,\n loading,\n error,\n login,\n logout,\n isAuthenticated: !!user,\n };\n };\n}\n",[],[188,32,296],"756a31f4-59cc-11f0-8cf0-f69ea79377d9","createComponents.tsx","66d64b42-59c6-11f0-be05-f69ea79377d9",41,["D",1751739512466],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport React from \"https://esm.sh/react@18.2.0\";\n\nexport function createComponents(useAuth: () => any) {\n const AuthButton = ({ onSuccess, className = \"\" }: { \n onSuccess?: (user: any) => void;\n className?: string;\n }) => {\n const { user, login, logout, loading, isAuthenticated } = useAuth();\n \n React.useEffect(() => {\n if (user && onSuccess) {\n onSuccess(user);\n }\n }, [user, onSuccess]);\n \n if (loading) {\n return React.createElement(\"button\", {\n disabled: true,\n className: `px-4 py-2 bg-gray-300 text-gray-500 rounded ${className}`,\n }, \"Loading...\");\n }\n \n if (isAuthenticated) {\n return React.createElement(\"div\", {\n className: \"flex items-center gap-2\",\n }, [\n React.createElement(\"span\", { key: \"welcome\" }, `Welcome, ${user.name}!`),\n React.createElement(\"button\", {\n key: \"logout\",\n onClick: logout,\n className: `px-4 py-2 bg-red-500 text-white rounded hover:bg-red-600 ${className}`,\n }, \"Logout\"),\n ]);\n }\n \n return React.createElement(\"button\", {\n onClick: login,\n className: `px-4 py-2 bg-blue-500 text-white rounded hover:bg-blue-600 ${className}`,\n }, \"Login\");\n };\n \n return { AuthButton };\n}\n",[],[188,32,304],"3693741e-59c6-11f0-bbf7-f69ea79377d9",10,["D",1751736830242],[213,214,215],[188,32],"b8be9faa-59cf-11f0-924b-f69ea79377d9","github.tsx","36b0a728-59c6-11f0-8b54-f69ea79377d9","367c566c-59c6-11f0-8fe6-f69ea79377d9",67,["D",1751740914098],"import { Hono } from \"https://esm.sh/hono@4.0.0\";\nimport { getCookie, setCookie } from \"https://esm.sh/hono@4.0.0/cookie\";\nimport { githubAdapter } from \"../core/adapters.tsx\";\nimport { createMiddleware } from \"./createMiddleware.tsx\";\n\nexport const githubAuthMiddleware = createMiddleware(githubAdapter);\n\nexport function createGitHubAuthRoutes() {\n const app = new Hono();\n\n // Initiate GitHub OAuth flow\n app.get(\"/auth/github\", async (c) => {\n // Add setCookie and getCookie methods to context\n const contextWithCookies = {\n ...c,\n setCookie: (name: string, value: string, options: any) =>\n setCookie(c, name, value, options),\n getCookie: (name: string) => getCookie(c, name),\n };\n\n const redirectUrl = await githubAdapter.initiate!(contextWithCookies);\n return new Response(null, {\n status: 302,\n headers: { Location: redirectUrl },\n });\n });\n\n // Handle GitHub OAuth callback\n app.get(\"/auth/github/callback\", async (c) => {\n // Add setCookie and getCookie methods to context\n const contextWithCookies = {\n ...c,\n setCookie: (name: string, value: string, options: any) =>\n setCookie(c, name, value, options),\n getCookie: (name: string) => getCookie(c, name),\n };\n\n const user = await githubAdapter.exchange!(contextWithCookies);\n const token = await githubAdapter.issue!(user);\n\n // Set secure cookie\n setCookie(c, \"auth_token\", token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24, // 24 hours\n path: \"/\",\n });\n\n return new Response(null, {\n status: 302,\n headers: { Location: \"/\" },\n });\n });\n\n // Logout route\n app.post(\"/auth/logout\", (c) => {\n setCookie(c, \"auth_token\", \"\", {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 0,\n path: \"/\",\n });\n\n return c.json({ success: true });\n });\n\n return app;\n}\n",[],[188,249,317],"755f7f48-59cc-11f0-8a6e-f69ea79377d9","createMiddleware.tsx","36abf098-59c6-11f0-bbf7-f69ea79377d9",40,["D",1751739512516],"import { getCookie, setCookie } from \"https://esm.sh/hono@4.0.0/cookie\";\nimport type { Context } from \"https://esm.sh/hono@4.0.0\";\nimport type { AuthAdapter, User } from \"../core/types.tsx\";\n\nexport function createMiddleware(adapter: AuthAdapter) {\n return async (c: Context, next: () => Promise) => {\n const token = getCookie(c, \"auth_token\");\n \n if (token) {\n try {\n const user = await adapter.verify(token);\n c.set(\"user\", user);\n } catch (error) {\n // Token is invalid, clear it\n setCookie(c, \"auth_token\", \"\", {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 0,\n path: \"/\",\n });\n }\n }\n \n await next();\n };\n}\n",[],[188,249,326],"367c55a4-59c6-11f0-8fe6-f69ea79377d9",9,["D",1751736830094],[210,211],[188,249],"7533dac8-59cc-11f0-aff3-f69ea79377d9","types.tsx","36dd6b32-59c6-11f0-91ff-f69ea79377d9","3665be20-59c6-11f0-af38-f69ea79377d9",34,["D",1751739512295],"export interface User {\n id: string;\n email: string;\n name: string;\n avatar?: string;\n githubId?: number;\n}\n\nexport interface AuthAdapter {\n id: \"val\" | \"github\" | \"password\";\n initiate?(ctx: any): Promise; // optional redirect step - returns URL\n exchange?(ctx: any): Promise; // optional callback step\n verify(token: string): Promise; // must validate credential\n issue?(user: User): Promise; // optional server‑side login\n}\n\nexport interface JWTPayload {\n sub: string; // user id\n exp: number; // expiration timestamp\n iat: number; // issued at timestamp\n adapterId: \"val\" | \"github\" | \"password\";\n email?: string;\n name?: string;\n}\n",[],[188,256,339],"7536ed4e-59cc-11f0-8e9b-f69ea79377d9","signer.tsx","36c48bbc-59c6-11f0-abe9-f69ea79377d9",35,["D",1751739512301],"import { sign, verify } from \"https://esm.sh/jsonwebtoken@9.0.2\";\nimport type { JWTPayload, User } from \"./types.tsx\";\n\nconst JWT_SECRET = Deno.env.get(\"JWT_SECRET\");\nif (!JWT_SECRET) {\n throw new Error(\"JWT_SECRET environment variable is required\");\n}\n\nexport async function signJWT(user: User, adapterId: \"val\" | \"github\" | \"password\"): Promise {\n const payload: JWTPayload = {\n sub: user.id,\n exp: Math.floor(Date.now() / 1000) + (60 * 60 * 24), // 24 hours\n iat: Math.floor(Date.now() / 1000),\n adapterId,\n email: user.email,\n name: user.name,\n };\n\n return new Promise((resolve, reject) => {\n sign(payload, JWT_SECRET, { algorithm: \"HS256\" }, (err, token) => {\n if (err) reject(err);\n else resolve(token as string);\n });\n });\n}\n\nexport async function verifyJWT(token: string): Promise {\n return new Promise((resolve, reject) => {\n verify(token, JWT_SECRET, { algorithms: [\"HS256\"] }, (err, decoded) => {\n if (err) reject(err);\n else resolve(decoded as JWTPayload);\n });\n });\n}\n",[],[188,256,348],"a384e680-59cf-11f0-aa46-f69ea79377d9","adapters.tsx","36b7d7e6-59c6-11f0-94a7-f69ea79377d9",66,["D",1751740878486],"import type { AuthAdapter, User } from \"./types.tsx\";\nimport { signJWT, verifyJWT } from \"./signer.tsx\";\n\n// GitHub OAuth Adapter\nexport const githubAdapter: AuthAdapter = {\n id: \"github\",\n\n async initiate(ctx: any): Promise {\n const clientId = Deno.env.get(\"GITHUB_CLIENT_ID\");\n if (!clientId) {\n throw new Error(\"GITHUB_CLIENT_ID environment variable is required\");\n }\n\n const redirectUri = `${new URL(ctx.req.url).origin}/auth/github/callback`;\n const scope = \"user:email read:user\";\n const state = crypto.randomUUID();\n\n // Store state in secure cookie for CSRF protection\n ctx.setCookie(\"oauth_state\", state, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 10, // 10 minutes\n path: \"/\",\n });\n\n const githubUrl = new URL(\"https://github.com/login/oauth/authorize\");\n githubUrl.searchParams.set(\"client_id\", clientId);\n githubUrl.searchParams.set(\"redirect_uri\", redirectUri);\n githubUrl.searchParams.set(\"scope\", scope);\n githubUrl.searchParams.set(\"state\", state);\n\n return githubUrl.toString();\n },\n\n async exchange(ctx: any): Promise {\n const url = new URL(ctx.req.url);\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n const storedState = ctx.getCookie(\"oauth_state\");\n\n if (!code) {\n throw new Error(\"Authorization code not provided\");\n }\n\n if (!state || !storedState || state !== storedState) {\n throw new Error(\"Invalid state parameter - possible CSRF attack\");\n }\n\n // Clear the state cookie\n ctx.setCookie(\"oauth_state\", \"\", {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 0,\n path: \"/\",\n });\n\n // Exchange code for access token\n const clientId = Deno.env.get(\"GITHUB_CLIENT_ID\");\n const clientSecret = Deno.env.get(\"GITHUB_CLIENT_SECRET\");\n\n if (!clientId || !clientSecret) {\n throw new Error(\"GitHub OAuth credentials not configured\");\n }\n\n const tokenResponse = await fetch(\n \"https://github.com/login/oauth/access_token\",\n {\n method: \"POST\",\n headers: {\n \"Accept\": \"application/json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n client_id: clientId,\n client_secret: clientSecret,\n code,\n }),\n },\n );\n\n const tokenData = await tokenResponse.json();\n\n if (!tokenData.access_token) {\n throw new Error(\"Failed to obtain access token\");\n }\n\n // Fetch user data from GitHub\n const userResponse = await fetch(\"https://api.github.com/user\", {\n headers: {\n \"Authorization\": `Bearer ${tokenData.access_token}`,\n \"Accept\": \"application/vnd.github.v3+json\",\n },\n });\n\n const userData = await userResponse.json();\n\n // Fetch user email (might be private)\n const emailResponse = await fetch(\"https://api.github.com/user/emails\", {\n headers: {\n \"Authorization\": `Bearer ${tokenData.access_token}`,\n \"Accept\": \"application/vnd.github.v3+json\",\n },\n });\n\n const emailData = await emailResponse.json();\n const primaryEmail = emailData.find((email: any) => email.primary)?.email ||\n userData.email;\n\n return {\n id: userData.id.toString(),\n email: primaryEmail,\n name: userData.name || userData.login,\n avatar: userData.avatar_url,\n githubId: userData.id,\n };\n },\n\n async verify(token: string): Promise {\n const payload = await verifyJWT(token);\n\n if (payload.adapterId !== \"github\") {\n throw new Error(\"Invalid adapter ID in token\");\n }\n\n return {\n id: payload.sub,\n email: payload.email || \"\",\n name: payload.name || \"\",\n avatar: undefined, // Avatar not stored in JWT for security\n };\n },\n\n async issue(user: User): Promise {\n return await signJWT(user, \"github\");\n },\n};\n\n// Placeholder adapters\nexport const valAdapter: AuthAdapter = {\n id: \"val\",\n async verify(): Promise {\n throw new Error(\"Val adapter not implemented\");\n },\n async initiate(): Promise {\n throw new Error(\"Val adapter not implemented\");\n },\n async exchange(): Promise {\n throw new Error(\"Val adapter not implemented\");\n },\n async issue(): Promise {\n throw new Error(\"Val adapter not implemented\");\n },\n};\n\nexport const passwordAdapter: AuthAdapter = {\n id: \"password\",\n async verify(): Promise {\n throw new Error(\"Password adapter not implemented\");\n },\n async initiate(): Promise {\n throw new Error(\"Password adapter not implemented\");\n },\n async exchange(): Promise {\n throw new Error(\"Password adapter not implemented\");\n },\n async issue(): Promise {\n throw new Error(\"Password adapter not implemented\");\n },\n};\n",[],[188,256,356],"3665bd3a-59c6-11f0-af38-f69ea79377d9",8,["D",1751736829944],[206,207,208],[188,256],["D",1751736829802],[205,209,212],[188],["D",1751735988946],{"_94":93,"_102":98},{"_94":93,"_95":96,"_97":98,"_18":52,"_99":100,"_101":24},{"_13":83,"_31":84,"_41":40,"_85":42,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":43,"_92":93},"ctx",{"_76":-5,"_122":408,"_409":410,"_411":412,"_413":24,"_414":24,"_415":24,"_416":56,"_417":-5,"_418":-7,"_419":-7,"_420":60,"_421":24,"_422":24,"_423":-5,"_424":24,"_425":24,"_426":24,"_427":-5},"ENV",{"_379":380,"_381":382,"_383":84,"_384":385,"_386":387,"_388":389,"_390":391,"_392":393,"_394":395,"_396":397,"_398":399,"_400":401,"_402":403,"_404":405,"_406":407},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v79