Click the link below to log in to ${this.appName}:

This link can be used multiple times and expires in 15 minutes.

`,\n };\n await this._send(body);\n }\n\n async sendInvite(email: string, magicLinkUrl: string): Promise {\n const tpl = this.templates?.invite?.(email, magicLinkUrl);\n const body = {\n from: this.from,\n to: [{ email }],\n project_id: this.projectId,\n subject: tpl?.subject ?? `You're invited to ${this.appName}`,\n text: tpl?.text ?? `You've been invited to use ${this.appName}!\\n\\nClick this link to create your account and get started:\\n\\n${magicLinkUrl}\\n\\nThis link can be used multiple times and expires in 15 minutes.`,\n html: tpl?.html ?? `

You've been invited to use ${this.appName}!

Click the link below to create your account and get started:

Join ${this.appName}

This link can be used multiple times and expires in 15 minutes.

`,\n };\n await this._send(body);\n }\n\n async sendChangeEmailLink(newEmail: string, changeUrl: string): Promise {\n const tpl = this.templates?.emailChange?.(newEmail, changeUrl);\n const body = {\n from: this.from,\n to: [{ email: newEmail }],\n project_id: this.projectId,\n subject: tpl?.subject ?? `Confirm your new ${this.appName} email address`,\n text: tpl?.text ?? `Click this link to confirm your new email address:\\n\\n${changeUrl}\\n\\nThis link expires in 15 minutes and can only be used once. If you did not request this change, you can ignore this email.`,\n html: tpl?.html ?? `

Click the link below to confirm your new email address for ${this.appName}:

Confirm new email address

This link expires in 15 minutes and can only be used once. If you did not request this change, you can ignore this email.

`,\n };\n await this._send(body);\n }\n\n private async _send(body: object): Promise {\n const response = await fetch(`${this.apiUrl}/emails`, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-Auth-Token\": this.apiKey,\n },\n body: JSON.stringify(body),\n });\n\n if (!response.ok) {\n const errorData = await response.json().catch(() => ({}));\n console.warn(\"Scaleway Transactional Email returned error\", errorData);\n throw new Error(`Failed to send magic link email: HTTP ${response.status}`);\n }\n }\n}\n\nexport function createDefaultEmailService(appName: string, templates?: AuthConfig[\"emailTemplates\"]): EmailService {\n const scalewayConfigured = Deno.env.get(\"SCW_SECRET_KEY\") && Deno.env.get(\"SCW_PROJECT_ID\");\n return scalewayConfigured\n ? new ScalewayEmailService({ appName, templates })\n : new ConsoleEmailService();\n}\n",[],[206,213],{"_104":221,"_97":222,"_160":223,"_162":207,"_163":145,"_164":224,"_166":167,"_106":225,"_101":208,"_169":216,"_171":226,"_172":22,"_173":-5,"_174":227,"_100":228},"888c0f24-22d9-11f1-86c9-42dde27851f2","index.ts","a2a3949c-22b9-11f1-897b-42dde27851f2",13,["D",1773845311918],"import type { Hono } from \"npm:hono\";\nimport type { AuthConfig, StudioKareUser } from \"../types.ts\";\nimport { createAuthQueries } from \"./queries.ts\";\nimport { createAuthMigrations } from \"./migrations.ts\";\nimport { createSessionService } from \"./session.ts\";\nimport { createMagicLinkService } from \"./magic-link.ts\";\nimport { createAuthMiddleware } from \"./middleware.ts\";\nimport { createAuthRoutes } from \"./routes.ts\";\nimport { createDefaultEmailService, ConsoleEmailService } from \"./email.ts\";\nimport { createOAuthQueries } from \"./oauth-queries.ts\";\nimport { createOAuthRoutes } from \"./oauth-routes.ts\";\n\nconst THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;\nconst FIFTEEN_MINUTES_MS = 15 * 60 * 1000;\nconst ONE_HOUR_MS = 60 * 60 * 1000;\nconst TEN_MINUTES_MS = 10 * 60 * 1000;\n\nexport function createAuthApp(config: AuthConfig) {\n const prefix = config.tablePrefix ?? \"studiokare\";\n const cookieName = config.cookieName ?? \"studiokare_session\";\n const sessionLifetimeMs = config.sessionLifetimeMs ?? THIRTY_DAYS_MS;\n const magicLinkTtlMs = config.magicLinkTtlMs ?? FIFTEEN_MINUTES_MS;\n\n const queries = createAuthQueries(prefix);\n const sessionService = createSessionService(queries, { sessionLifetimeMs });\n const magicLinkService = createMagicLinkService(queries, { magicLinkTtlMs });\n const emailService = config.emailService ?? createDefaultEmailService(config.appName, config.emailTemplates);\n const { authMiddleware, buildSessionCookie, clearSessionCookie } = createAuthMiddleware(sessionService, { cookieName, sessionLifetimeMs });\n const runMigrations = createAuthMigrations(prefix);\n\n const authApp = createAuthRoutes({\n magicLinkService,\n sessionService,\n queries,\n emailService,\n appName: config.appName,\n prefix,\n buildSessionCookie,\n clearSessionCookie,\n });\n\n // Conditionally create OAuth subsystem\n let oauthApp: Hono | undefined;\n if (config.oauth) {\n const oauthQueries = createOAuthQueries(prefix);\n const accessTokenTtlMs = config.oauth.accessTokenTtlMs ?? ONE_HOUR_MS;\n const authCodeTtlMs = config.oauth.authCodeTtlMs ?? TEN_MINUTES_MS;\n\n oauthApp = createOAuthRoutes({\n oauthQueries,\n queries,\n sessionService,\n cookieName,\n prefix,\n appName: config.appName,\n jwtSecret: config.oauth.jwtSecret,\n accessTokenTtlSeconds: Math.floor(accessTokenTtlMs / 1000),\n authCodeTtlMs,\n buildSessionCookie,\n });\n }\n\n const runAuthMigrations = () => runMigrations(config.oauth?.clients);\n\n return {\n authApp,\n oauthApp,\n authMiddleware,\n runAuthMigrations,\n getUserById: queries.getUserById,\n getUserByEmail: queries.getUserByEmail,\n createMagicLinkToken: magicLinkService.createMagicLinkToken,\n emailService,\n };\n}\n\nexport type { AuthConfig, StudioKareUser };\nexport type { StudioKareSession, OAuthClient, OAuthConfig } from \"../types.ts\";\nexport { ConsoleEmailService };\nexport type { EmailService } from \"../types.ts\";\n",[],[206,222],{"_104":230,"_97":231,"_160":232,"_162":207,"_163":145,"_164":233,"_166":167,"_106":234,"_101":33,"_169":216,"_171":235,"_172":22,"_173":-5,"_174":236,"_100":237},"88601f5e-22d9-11f1-9063-42dde27851f2","jwt.ts","88601ffe-22d9-11f1-9063-42dde27851f2",7,["D",1773845311633],"import { HMAC } from \"@oslojs/crypto/hmac\";\nimport { SHA256 } from \"@oslojs/crypto/sha2\";\nimport { encodeBase64url, decodeBase64url } from \"@oslojs/encoding\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport interface AccessTokenPayload {\n sub: string;\n email: string;\n client_id: string;\n iat: number;\n exp: number;\n}\n\nfunction base64urlEncode(data: Uint8Array): string {\n return encodeBase64url(data);\n}\n\nfunction base64urlDecode(str: string): Uint8Array {\n return decodeBase64url(str);\n}\n\nfunction base64urlEncodeJSON(obj: object): string {\n return base64urlEncode(encoder.encode(JSON.stringify(obj)));\n}\n\nfunction sign(data: string, secret: string): string {\n const key = encoder.encode(secret);\n const mac = new HMAC(SHA256, key);\n mac.update(encoder.encode(data));\n return base64urlEncode(mac.digest());\n}\n\nexport function createAccessToken(\n payload: Omit,\n secret: string,\n ttlSeconds: number,\n): string {\n const now = Math.floor(Date.now() / 1000);\n const fullPayload: AccessTokenPayload = {\n ...payload,\n iat: now,\n exp: now + ttlSeconds,\n };\n\n const header = base64urlEncodeJSON({ alg: \"HS256\", typ: \"JWT\" });\n const body = base64urlEncodeJSON(fullPayload);\n const signature = sign(`${header}.${body}`, secret);\n\n return `${header}.${body}.${signature}`;\n}\n\nexport function verifyAccessToken(token: string, secret: string): AccessTokenPayload | null {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n\n const [header, body, signature] = parts;\n\n // Verify signature\n const expected = sign(`${header}.${body}`, secret);\n if (signature !== expected) return null;\n\n // Decode payload\n try {\n const payload = JSON.parse(decoder.decode(base64urlDecode(body))) as AccessTokenPayload;\n\n // Check expiration\n const now = Math.floor(Date.now() / 1000);\n if (payload.exp <= now) return null;\n\n return payload;\n } catch {\n return null;\n }\n}\n",[],[206,231],{"_104":239,"_97":240,"_160":241,"_162":207,"_163":145,"_164":242,"_166":167,"_106":243,"_101":208,"_169":216,"_171":244,"_172":22,"_173":-5,"_174":245,"_100":246},"88792eb8-22d9-11f1-ada5-42dde27851f2","magic-link.ts","a2a3a1f8-22b9-11f1-897b-42dde27851f2",11,["D",1773845311797],"import type { AuthQueries } from \"./queries.ts\";\nimport { generateId, generateToken, hashToken } from \"./session.ts\";\n\nexport interface MagicLinkResult {\n token: string;\n email: string;\n}\n\nexport interface VerifyMagicLinkResult {\n userId: string;\n email: string;\n isNewUser: boolean;\n}\n\nexport interface VerifyEmailChangeResult {\n userId: string;\n newEmail: string;\n}\n\nexport function createMagicLinkService(queries: AuthQueries, opts: { magicLinkTtlMs: number }) {\n const { magicLinkTtlMs } = opts;\n\n async function createMagicLinkToken(email: string): Promise {\n const token = generateToken();\n const hashedId = hashToken(token);\n const expiresAt = new Date(Date.now() + magicLinkTtlMs);\n\n await queries.createMagicLinkRecord(hashedId, email, expiresAt);\n\n return { token, email };\n }\n\n async function createEmailChangeToken(userId: string, newEmail: string): Promise<{ token: string }> {\n const token = generateToken();\n const hashedId = hashToken(token);\n const expiresAt = new Date(Date.now() + magicLinkTtlMs);\n await queries.createMagicLinkRecord(hashedId, newEmail, expiresAt, userId);\n return { token };\n }\n\n async function verifyEmailChangeToken(token: string): Promise {\n const hashedId = hashToken(token);\n const link = await queries.getMagicLinkRecord(hashedId);\n\n if (!link) return null;\n // Reject login tokens used on the email-change route\n if (link.userId === null) return null;\n\n // Delete immediately (single-use)\n await queries.deleteMagicLinkRecord(hashedId);\n\n // Check expiry\n if (link.expiresAt <= new Date()) return null;\n\n await queries.updateUserEmail(link.userId, link.email);\n return { userId: link.userId, newEmail: link.email };\n }\n\n async function verifyMagicLinkToken(token: string): Promise {\n const hashedId = hashToken(token);\n const link = await queries.getMagicLinkRecord(hashedId);\n\n if (!link) return null;\n // Reject email-change tokens used on the login route\n if (link.userId !== null) return null;\n\n // Check expiry (token stays valid for reuse until it expires)\n if (link.expiresAt <= new Date()) return null;\n\n // Find or create user\n const existingUser = await queries.getUserByEmail(link.email);\n if (existingUser) {\n return { userId: existingUser.id, email: existingUser.email, isNewUser: false };\n }\n\n const userId = generateId();\n await queries.createUser(userId, link.email);\n return { userId, email: link.email, isNewUser: true };\n }\n\n return { createMagicLinkToken, createEmailChangeToken, verifyEmailChangeToken, verifyMagicLinkToken };\n}\n\nexport type MagicLinkService = ReturnType;\n",[],[206,240],{"_104":248,"_97":249,"_160":250,"_162":207,"_163":145,"_164":208,"_166":167,"_106":251,"_101":33,"_169":216,"_171":252,"_172":22,"_173":-5,"_174":253,"_100":254},"a2a3afe0-22b9-11f1-897b-42dde27851f2","middleware.ts","a2a3b058-22b9-11f1-897b-42dde27851f2",["D",1773831611794],"import { createMiddleware } from \"npm:hono/factory\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport type { SessionService } from \"./session.ts\";\n\nexport function createAuthMiddleware(sessionService: SessionService, opts: { cookieName: string; sessionLifetimeMs: number }) {\n const { cookieName, sessionLifetimeMs } = opts;\n const maxAgeSeconds = Math.floor(sessionLifetimeMs / 1000);\n\n const authMiddleware = createMiddleware(async (c, next) => {\n const token = getCookie(c, cookieName);\n\n if (!token) {\n c.set(\"user\", null);\n c.set(\"sessionToken\", null);\n return next();\n }\n\n const result = await sessionService.validateSession(token);\n\n if (!result) {\n deleteCookie(c, cookieName, { path: \"/\" });\n c.set(\"user\", null);\n c.set(\"sessionToken\", null);\n return next();\n }\n\n c.set(\"user\", result.user);\n c.set(\"sessionToken\", token);\n\n if (result.rotated) {\n setCookie(c, cookieName, token, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: maxAgeSeconds,\n });\n }\n\n return next();\n });\n\n function buildSessionCookie(token: string): string {\n return `${cookieName}=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAgeSeconds}`;\n }\n\n function clearSessionCookie(c: any): void {\n deleteCookie(c, cookieName, { path: \"/\" });\n }\n\n return { authMiddleware, buildSessionCookie, clearSessionCookie };\n}\n",[],[206,249],{"_104":256,"_97":257,"_160":258,"_162":207,"_163":145,"_164":259,"_166":167,"_106":260,"_101":208,"_169":216,"_171":261,"_172":22,"_173":-5,"_174":262,"_100":263},"888748cc-22d9-11f1-bbdf-42dde27851f2","migrations.ts","a2a3b8be-22b9-11f1-897b-42dde27851f2",12,["D",1773845311886],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport type { OAuthClient } from \"../types.ts\";\nimport { hashToken } from \"./session.ts\";\n\nexport function createAuthMigrations(prefix: string) {\n const usersTable = `${prefix}_users`;\n const sessionsTable = `${prefix}_sessions`;\n const magicLinksTable = `${prefix}_magic_links`;\n const oauthClientsTable = `${prefix}_oauth_clients`;\n const oauthCodesTable = `${prefix}_oauth_codes`;\n\n return async function runAuthMigrations(oauthClients?: OAuthClient[]) {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${usersTable} (\n id TEXT PRIMARY KEY,\n email TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${sessionsTable} (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL REFERENCES ${usersTable}(id),\n expires_at TEXT NOT NULL\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${magicLinksTable} (\n id TEXT PRIMARY KEY,\n email TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL\n )\n `);\n\n // Add user_id to magic_links for email-change tokens (nullable; null = login token)\n try {\n await sqlite.execute(`ALTER TABLE ${magicLinksTable} ADD COLUMN user_id TEXT REFERENCES ${usersTable}(id)`);\n } catch (_) {}\n\n try {\n await sqlite.execute(`CREATE INDEX IF NOT EXISTS idx_${prefix}_sessions_user ON ${sessionsTable}(user_id)`);\n } catch (_) {}\n\n // OAuth tables\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${oauthClientsTable} (\n client_id TEXT PRIMARY KEY,\n client_secret_hash TEXT NOT NULL,\n name TEXT NOT NULL,\n redirect_uris TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${oauthCodesTable} (\n code_hash TEXT PRIMARY KEY,\n client_id TEXT NOT NULL REFERENCES ${oauthClientsTable}(client_id),\n user_id TEXT NOT NULL REFERENCES ${usersTable}(id),\n redirect_uri TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n used INTEGER NOT NULL DEFAULT 0\n )\n `);\n\n // Seed OAuth clients from config\n if (oauthClients) {\n for (const client of oauthClients) {\n const secretHash = hashToken(client.clientSecret);\n await sqlite.execute({\n sql: `INSERT INTO ${oauthClientsTable} (client_id, client_secret_hash, name, redirect_uris)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(client_id) DO UPDATE SET\n client_secret_hash = excluded.client_secret_hash,\n name = excluded.name,\n redirect_uris = excluded.redirect_uris`,\n args: [client.clientId, secretHash, client.name, JSON.stringify(client.redirectUris)],\n });\n }\n }\n };\n}\n",[],[206,257],{"_104":265,"_97":266,"_160":267,"_162":207,"_163":145,"_164":268,"_166":167,"_106":269,"_101":33,"_169":216,"_171":270,"_172":22,"_173":-5,"_174":271,"_100":272},"886f3430-22d9-11f1-bbdf-42dde27851f2","oauth-queries.ts","886f34da-22d9-11f1-bbdf-42dde27851f2",10,["D",1773845311653],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nexport interface OAuthClientRow {\n clientId: string;\n clientSecretHash: string;\n name: string;\n redirectUris: string[];\n createdAt: string;\n}\n\nexport interface OAuthCodeRow {\n codeHash: string;\n clientId: string;\n userId: string;\n redirectUri: string;\n expiresAt: Date;\n used: boolean;\n}\n\nexport function createOAuthQueries(prefix: string) {\n const clientsTable = `${prefix}_oauth_clients`;\n const codesTable = `${prefix}_oauth_codes`;\n\n async function getClientById(clientId: string): Promise {\n const result = await sqlite.execute({\n sql: `SELECT client_id, client_secret_hash, name, redirect_uris, created_at FROM ${clientsTable} WHERE client_id = ?`,\n args: [clientId],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0];\n const cols = result.columns;\n const col = (name: string) => row[cols.indexOf(name)];\n return {\n clientId: col(\"client_id\") as string,\n clientSecretHash: col(\"client_secret_hash\") as string,\n name: col(\"name\") as string,\n redirectUris: JSON.parse(col(\"redirect_uris\") as string),\n createdAt: col(\"created_at\") as string,\n };\n }\n\n async function createAuthorizationCode(\n codeHash: string,\n clientId: string,\n userId: string,\n redirectUri: string,\n expiresAt: Date,\n ): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${codesTable} (code_hash, client_id, user_id, redirect_uri, expires_at) VALUES (?, ?, ?, ?, ?)`,\n args: [codeHash, clientId, userId, redirectUri, expiresAt.toISOString()],\n });\n }\n\n async function getAuthorizationCode(codeHash: string): Promise {\n const result = await sqlite.execute({\n sql: `SELECT code_hash, client_id, user_id, redirect_uri, expires_at, used FROM ${codesTable} WHERE code_hash = ?`,\n args: [codeHash],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0];\n const cols = result.columns;\n const col = (name: string) => row[cols.indexOf(name)];\n return {\n codeHash: col(\"code_hash\") as string,\n clientId: col(\"client_id\") as string,\n userId: col(\"user_id\") as string,\n redirectUri: col(\"redirect_uri\") as string,\n expiresAt: new Date(col(\"expires_at\") as string),\n used: (col(\"used\") as number) === 1,\n };\n }\n\n async function markCodeUsed(codeHash: string): Promise {\n await sqlite.execute({\n sql: `UPDATE ${codesTable} SET used = 1 WHERE code_hash = ?`,\n args: [codeHash],\n });\n }\n\n return { getClientById, createAuthorizationCode, getAuthorizationCode, markCodeUsed };\n}\n\nexport type OAuthQueries = ReturnType;\n",[],[206,266],{"_104":274,"_97":275,"_160":276,"_162":207,"_163":145,"_164":277,"_166":167,"_106":278,"_101":33,"_169":216,"_171":279,"_172":22,"_173":-5,"_174":280,"_100":281},"886bdbdc-22d9-11f1-b486-42dde27851f2","oauth-routes.ts","886bdcae-22d9-11f1-b486-42dde27851f2",9,["D",1773845311639],"import { Hono } from \"npm:hono\";\nimport { getCookie } from \"npm:hono/cookie\";\nimport type { OAuthQueries } from \"./oauth-queries.ts\";\nimport type { AuthQueries } from \"./queries.ts\";\nimport type { SessionService } from \"./session.ts\";\nimport { generateToken, hashToken, generateId } from \"./session.ts\";\nimport { createAccessToken, verifyAccessToken } from \"./jwt.ts\";\n\ninterface OAuthRouteDeps {\n oauthQueries: OAuthQueries;\n queries: AuthQueries;\n sessionService: SessionService;\n cookieName: string;\n prefix: string;\n appName: string;\n jwtSecret: string;\n accessTokenTtlSeconds: number;\n authCodeTtlMs: number;\n buildSessionCookie: (token: string) => string;\n}\n\nexport function createOAuthRoutes(deps: OAuthRouteDeps): Hono {\n const {\n oauthQueries,\n queries,\n sessionService,\n cookieName,\n prefix,\n appName,\n jwtSecret,\n accessTokenTtlSeconds,\n authCodeTtlMs,\n buildSessionCookie,\n } = deps;\n\n const oauthApp = new Hono();\n const flowCookieName = `${prefix}_oauth_flow`;\n\n // GET /authorize\n oauthApp.get(\"/authorize\", async (c) => {\n const responseType = c.req.query(\"response_type\");\n const clientId = c.req.query(\"client_id\");\n const redirectUri = c.req.query(\"redirect_uri\");\n const state = c.req.query(\"state\");\n\n if (responseType !== \"code\") {\n return c.json({ error: \"unsupported_response_type\" }, 400);\n }\n if (!clientId || !redirectUri || !state) {\n return c.json({ error: \"invalid_request\", error_description: \"Missing required parameters\" }, 400);\n }\n\n const client = await oauthQueries.getClientById(clientId);\n if (!client) {\n return c.json({ error: \"invalid_client\" }, 400);\n }\n if (!client.redirectUris.includes(redirectUri)) {\n return c.json({ error: \"invalid_request\", error_description: \"Invalid redirect_uri\" }, 400);\n }\n\n // Check if user has a session\n const sessionToken = getCookie(c, cookieName);\n if (sessionToken) {\n const result = await sessionService.validateSession(sessionToken);\n if (result) {\n // User is authenticated — show consent page\n return c.html(consentPage(client.name, appName, clientId, redirectUri, state));\n }\n }\n\n // Not authenticated — store OAuth params in cookie, show login form\n const flowData = JSON.stringify({ client_id: clientId, redirect_uri: redirectUri, state });\n const flowCookie = `${flowCookieName}=${encodeURIComponent(flowData)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=900`;\n\n return new Response(loginPage(appName, client.name), {\n status: 200,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Set-Cookie\": flowCookie,\n },\n });\n });\n\n // POST /authorize — user consents, generate code\n oauthApp.post(\"/authorize\", async (c) => {\n const sessionToken = getCookie(c, cookieName);\n if (!sessionToken) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n const sessionResult = await sessionService.validateSession(sessionToken);\n if (!sessionResult) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n\n const body = await c.req.parseBody();\n const clientId = body[\"client_id\"] as string;\n const redirectUri = body[\"redirect_uri\"] as string;\n const state = body[\"state\"] as string;\n\n if (!clientId || !redirectUri || !state) {\n return c.json({ error: \"invalid_request\" }, 400);\n }\n\n const client = await oauthQueries.getClientById(clientId);\n if (!client || !client.redirectUris.includes(redirectUri)) {\n return c.json({ error: \"invalid_client\" }, 400);\n }\n\n // Generate authorization code\n const code = generateToken();\n const codeHash = hashToken(code);\n const expiresAt = new Date(Date.now() + authCodeTtlMs);\n\n await oauthQueries.createAuthorizationCode(codeHash, clientId, sessionResult.user.id, redirectUri, expiresAt);\n\n // Clear flow cookie\n const clearFlowCookie = `${flowCookieName}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`;\n\n const url = new URL(redirectUri);\n url.searchParams.set(\"code\", code);\n url.searchParams.set(\"state\", state);\n\n return new Response(null, {\n status: 302,\n headers: {\n Location: url.toString(),\n \"Set-Cookie\": clearFlowCookie,\n },\n });\n });\n\n // POST /token — exchange code for JWT\n oauthApp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n const grantType = body[\"grant_type\"] as string;\n const code = body[\"code\"] as string;\n const redirectUri = body[\"redirect_uri\"] as string;\n const clientId = body[\"client_id\"] as string;\n const clientSecret = body[\"client_secret\"] as string;\n\n if (grantType !== \"authorization_code\") {\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n }\n if (!code || !redirectUri || !clientId || !clientSecret) {\n return c.json({ error: \"invalid_request\" }, 400);\n }\n\n // Authenticate client\n const client = await oauthQueries.getClientById(clientId);\n if (!client) {\n return c.json({ error: \"invalid_client\" }, 401);\n }\n const secretHash = hashToken(clientSecret);\n if (secretHash !== client.clientSecretHash) {\n return c.json({ error: \"invalid_client\" }, 401);\n }\n\n // Validate code\n const codeHash = hashToken(code);\n const codeRecord = await oauthQueries.getAuthorizationCode(codeHash);\n if (!codeRecord) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n if (codeRecord.used) {\n return c.json({ error: \"invalid_grant\", error_description: \"Code already used\" }, 400);\n }\n if (codeRecord.expiresAt <= new Date()) {\n return c.json({ error: \"invalid_grant\", error_description: \"Code expired\" }, 400);\n }\n if (codeRecord.clientId !== clientId) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n if (codeRecord.redirectUri !== redirectUri) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n // Mark code used\n await oauthQueries.markCodeUsed(codeHash);\n\n // Look up user\n const user = await queries.getUserById(codeRecord.userId);\n if (!user) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n // Generate JWT\n const accessToken = createAccessToken(\n { sub: user.id, email: user.email, client_id: clientId },\n jwtSecret,\n accessTokenTtlSeconds,\n );\n\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: accessTokenTtlSeconds,\n });\n });\n\n // GET /userinfo — verify JWT and return user info\n oauthApp.get(\"/userinfo\", async (c) => {\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader?.startsWith(\"Bearer \")) {\n return c.json({ error: \"invalid_token\" }, 401);\n }\n const token = authHeader.slice(7);\n const payload = verifyAccessToken(token, jwtSecret);\n if (!payload) {\n return c.json({ error: \"invalid_token\" }, 401);\n }\n return c.json({ sub: payload.sub, email: payload.email });\n });\n\n // POST /users — client-authenticated user registration\n oauthApp.post(\"/users\", async (c) => {\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader?.startsWith(\"Basic \")) {\n return c.json({ error: \"invalid_client\" }, 401);\n }\n\n // Decode Basic auth\n const decoded = atob(authHeader.slice(6));\n const colonIndex = decoded.indexOf(\":\");\n if (colonIndex === -1) {\n return c.json({ error: \"invalid_client\" }, 401);\n }\n const clientId = decoded.slice(0, colonIndex);\n const clientSecret = decoded.slice(colonIndex + 1);\n\n const client = await oauthQueries.getClientById(clientId);\n if (!client) {\n return c.json({ error: \"invalid_client\" }, 401);\n }\n const secretHash = hashToken(clientSecret);\n if (secretHash !== client.clientSecretHash) {\n return c.json({ error: \"invalid_client\" }, 401);\n }\n\n const { email } = await c.req.json();\n if (!email || typeof email !== \"string\") {\n return c.json({ error: \"Email is required\" }, 400);\n }\n\n const trimmedEmail = email.trim().toLowerCase();\n if (!trimmedEmail.includes(\"@\")) {\n return c.json({ error: \"Invalid email\" }, 400);\n }\n\n const existingUser = await queries.getUserByEmail(trimmedEmail);\n if (existingUser) {\n return c.json({ user: existingUser, created: false });\n }\n\n const userId = generateId();\n const newUser = await queries.createUser(userId, trimmedEmail);\n return c.json({ user: newUser, created: true }, 201);\n });\n\n return oauthApp;\n}\n\nfunction consentPage(clientName: string, appName: string, clientId: string, redirectUri: string, state: string): string {\n return `\n\nAuthorize ${clientName} - ${appName}\n\n\n

Authorize ${esc(clientName)}

${esc(clientName)} wants to access your ${esc(appName)} account.

\n \n`;\n}\n\nfunction loginPage(appName: string, clientName: string): string {\n return `\n\nLog in - ${appName}\n\n\n

Log in to continue

${esc(clientName)} wants to access your ${esc(appName)} account. Enter your email to receive a login link.

\n \n

\n \n`;\n}\n\nfunction esc(str: string): string {\n return str.replace(/&/g, \"&\").replace(//g, \">\").replace(/\"/g, \""\");\n}\n",[],[206,275],{"_104":283,"_97":284,"_160":285,"_162":207,"_163":145,"_164":208,"_166":167,"_106":286,"_101":33,"_169":216,"_171":287,"_172":22,"_173":-5,"_174":288,"_100":289},"a2a3c264-22b9-11f1-897b-42dde27851f2","queries.ts","a2a3c2dc-22b9-11f1-897b-42dde27851f2",["D",1773831611794],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport type { StudioKareSession, StudioKareUser } from \"../types.ts\";\n\nexport function createAuthQueries(prefix: string) {\n const usersTable = `${prefix}_users`;\n const sessionsTable = `${prefix}_sessions`;\n const magicLinksTable = `${prefix}_magic_links`;\n\n // ---- Users ----\n\n async function getUserByEmail(email: string): Promise {\n const result = await sqlite.execute({\n sql: `SELECT id, email, created_at FROM ${usersTable} WHERE email = ?`,\n args: [email],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0];\n const cols = result.columns;\n const col = (name: string) => row[cols.indexOf(name)];\n return {\n id: col(\"id\") as string,\n email: col(\"email\") as string,\n createdAt: col(\"created_at\") as string,\n };\n }\n\n async function getUserById(id: string): Promise {\n const result = await sqlite.execute({\n sql: `SELECT id, email, created_at FROM ${usersTable} WHERE id = ?`,\n args: [id],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0];\n const cols = result.columns;\n const col = (name: string) => row[cols.indexOf(name)];\n return {\n id: col(\"id\") as string,\n email: col(\"email\") as string,\n createdAt: col(\"created_at\") as string,\n };\n }\n\n async function createUser(id: string, email: string): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${usersTable} (id, email) VALUES (?, ?)`,\n args: [id, email],\n });\n return { id, email, createdAt: new Date().toISOString() };\n }\n\n // ---- Sessions ----\n\n async function createSessionRecord(sessionId: string, userId: string, expiresAt: Date): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${sessionsTable} (id, user_id, expires_at) VALUES (?, ?, ?)`,\n args: [sessionId, userId, expiresAt.toISOString()],\n });\n }\n\n async function getSessionRecord(\n sessionId: string,\n ): Promise<{ session: StudioKareSession; user: StudioKareUser } | null> {\n const result = await sqlite.execute({\n sql: `SELECT s.id, s.user_id, s.expires_at, u.email, u.created_at\n FROM ${sessionsTable} s\n JOIN ${usersTable} u ON s.user_id = u.id\n WHERE s.id = ?`,\n args: [sessionId],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0];\n const cols = result.columns;\n const col = (name: string) => row[cols.indexOf(name)];\n return {\n session: {\n id: col(\"id\") as string,\n userId: col(\"user_id\") as string,\n expiresAt: new Date(col(\"expires_at\") as string),\n },\n user: {\n id: col(\"user_id\") as string,\n email: col(\"email\") as string,\n createdAt: col(\"created_at\") as string,\n },\n };\n }\n\n async function updateSessionExpiry(sessionId: string, expiresAt: Date): Promise {\n await sqlite.execute({\n sql: `UPDATE ${sessionsTable} SET expires_at = ? WHERE id = ?`,\n args: [expiresAt.toISOString(), sessionId],\n });\n }\n\n async function deleteSessionRecord(sessionId: string): Promise {\n await sqlite.execute({\n sql: `DELETE FROM ${sessionsTable} WHERE id = ?`,\n args: [sessionId],\n });\n }\n\n // ---- Magic Links ----\n\n async function createMagicLinkRecord(id: string, email: string, expiresAt: Date, userId?: string): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${magicLinksTable} (id, email, expires_at, user_id) VALUES (?, ?, ?, ?)`,\n args: [id, email, expiresAt.toISOString(), userId ?? null],\n });\n }\n\n async function getMagicLinkRecord(id: string): Promise<{ email: string; expiresAt: Date; userId: string | null } | null> {\n const result = await sqlite.execute({\n sql: `SELECT email, expires_at, user_id FROM ${magicLinksTable} WHERE id = ?`,\n args: [id],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0];\n const cols = result.columns;\n const col = (name: string) => row[cols.indexOf(name)];\n return {\n email: col(\"email\") as string,\n expiresAt: new Date(col(\"expires_at\") as string),\n userId: col(\"user_id\") as string | null,\n };\n }\n\n async function updateUserEmail(userId: string, newEmail: string): Promise {\n await sqlite.execute({\n sql: `UPDATE ${usersTable} SET email = ? WHERE id = ?`,\n args: [newEmail, userId],\n });\n }\n\n async function deleteMagicLinkRecord(id: string): Promise {\n await sqlite.execute({\n sql: `DELETE FROM ${magicLinksTable} WHERE id = ?`,\n args: [id],\n });\n }\n\n return {\n getUserByEmail,\n getUserById,\n createUser,\n createSessionRecord,\n getSessionRecord,\n updateSessionExpiry,\n deleteSessionRecord,\n createMagicLinkRecord,\n getMagicLinkRecord,\n updateUserEmail,\n deleteMagicLinkRecord,\n };\n}\n\nexport type AuthQueries = ReturnType;\n",[],[206,284],{"_104":291,"_97":292,"_160":293,"_162":207,"_163":145,"_164":294,"_166":167,"_106":295,"_101":208,"_169":216,"_171":296,"_172":22,"_173":-5,"_174":297,"_100":298},"88676188-22d9-11f1-af75-42dde27851f2","routes.ts","a2a3d862-22b9-11f1-897b-42dde27851f2",8,["D",1773845311660],"import { Hono } from \"npm:hono\";\nimport { getCookie } from \"npm:hono/cookie\";\nimport type { MagicLinkService } from \"./magic-link.ts\";\nimport type { SessionService } from \"./session.ts\";\nimport type { AuthQueries } from \"./queries.ts\";\nimport type { EmailService } from \"../types.ts\";\n\ninterface RouteDeps {\n magicLinkService: MagicLinkService;\n sessionService: SessionService;\n queries: AuthQueries;\n emailService: EmailService;\n appName: string;\n prefix: string;\n buildSessionCookie: (token: string) => string;\n clearSessionCookie: (c: any) => void;\n}\n\nexport function createAuthRoutes(deps: RouteDeps): Hono {\n const { magicLinkService, sessionService, queries, emailService, appName, prefix, buildSessionCookie, clearSessionCookie } = deps;\n\n const authApp = new Hono();\n\n // CSRF protection for POST routes: require JSON content type\n authApp.use(\"/*\", async (c, next) => {\n if (c.req.method === \"POST\") {\n const contentType = c.req.header(\"Content-Type\");\n if (!contentType?.includes(\"application/json\")) {\n return c.json({ error: \"Content-Type must be application/json\" }, 400);\n }\n }\n return next();\n });\n\n // POST /magic-link — request a magic link\n authApp.post(\"/magic-link\", async (c) => {\n const { email } = await c.req.json();\n\n if (!email || typeof email !== \"string\") {\n return c.json({ error: \"Email is required\" }, 400);\n }\n\n const trimmedEmail = email.trim().toLowerCase();\n if (!trimmedEmail.includes(\"@\")) {\n return c.json({ error: \"Invalid email\" }, 400);\n }\n\n const { token } = await magicLinkService.createMagicLinkToken(trimmedEmail);\n\n const url = new URL(c.req.url);\n const magicLinkUrl = `${url.origin}/auth/magic-link/${token}`;\n\n await emailService.sendMagicLink(trimmedEmail, magicLinkUrl);\n\n return c.json({ success: true });\n });\n\n // GET /magic-link/:token — verify and authenticate\n authApp.get(\"/magic-link/:token\", async (c) => {\n const token = c.req.param(\"token\");\n const result = await magicLinkService.verifyMagicLinkToken(token);\n\n if (!result) {\n return c.html(\n `\n

Invalid or expired link

This magic link has expired or has already been used.

\n Go back to ${appName}\n `,\n 400,\n );\n }\n\n const { token: sessionToken } = await sessionService.createUserSession(result.userId);\n const cookie = buildSessionCookie(sessionToken);\n\n // Check for OAuth flow cookie\n const flowCookieName = `${prefix}_oauth_flow`;\n const flowCookie = getCookie(c, flowCookieName);\n if (flowCookie) {\n try {\n const flow = JSON.parse(decodeURIComponent(flowCookie));\n const params = new URLSearchParams({\n response_type: \"code\",\n client_id: flow.client_id,\n redirect_uri: flow.redirect_uri,\n state: flow.state,\n });\n return new Response(null, {\n status: 302,\n headers: {\n Location: `/oauth/authorize?${params.toString()}`,\n \"Set-Cookie\": cookie,\n },\n });\n } catch {\n // Invalid flow cookie, fall through to default redirect\n }\n }\n\n return new Response(null, {\n status: 302,\n headers: {\n Location: \"/\",\n \"Set-Cookie\": cookie,\n },\n });\n });\n\n // POST /logout\n authApp.post(\"/logout\", async (c) => {\n const sessionToken = c.get(\"sessionToken\");\n\n if (sessionToken) {\n await sessionService.invalidateSession(sessionToken);\n }\n\n clearSessionCookie(c);\n return c.json({ success: true });\n });\n\n // POST /change-email — authenticated; sends a confirmation link to the new address\n authApp.post(\"/change-email\", async (c) => {\n const user = c.get(\"user\");\n if (!user) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n\n const { email } = await c.req.json();\n if (!email || typeof email !== \"string\") {\n return c.json({ error: \"Email is required\" }, 400);\n }\n\n const newEmail = email.trim().toLowerCase();\n if (!newEmail.includes(\"@\")) {\n return c.json({ error: \"Invalid email\" }, 400);\n }\n\n if (newEmail === user.email) {\n return c.json({ error: \"That is already your email address\" }, 400);\n }\n\n const existing = await queries.getUserByEmail(newEmail);\n if (existing) {\n return c.json({ error: \"That email is already in use\" }, 400);\n }\n\n const { token } = await magicLinkService.createEmailChangeToken(user.id, newEmail);\n const url = new URL(c.req.url);\n const changeUrl = `${url.origin}/auth/change-email/${token}`;\n\n await emailService.sendChangeEmailLink(newEmail, changeUrl);\n\n return c.json({ success: true });\n });\n\n // GET /change-email/:token — verify and update email\n authApp.get(\"/change-email/:token\", async (c) => {\n const token = c.req.param(\"token\");\n const result = await magicLinkService.verifyEmailChangeToken(token);\n\n if (!result) {\n return c.html(\n `\n

Invalid or expired link

This email change link has expired or has already been used.

\n Go back to ${appName}\n `,\n 400,\n );\n }\n\n return new Response(null, {\n status: 302,\n headers: { Location: \"/?email_changed=1\" },\n });\n });\n\n // GET /me — return current user or null\n authApp.get(\"/me\", async (c) => {\n const user = c.get(\"user\");\n return c.json({ user: user || null });\n });\n\n return authApp;\n}\n",[],[206,292],{"_104":300,"_97":301,"_160":302,"_162":207,"_163":145,"_164":303,"_166":167,"_106":304,"_101":208,"_169":216,"_171":305,"_172":22,"_173":-5,"_174":306,"_100":307},"8898798a-22d9-11f1-86c9-42dde27851f2","session.ts","a2a3f130-22b9-11f1-897b-42dde27851f2",14,["D",1773845311998],"import { sha256 } from \"@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"@oslojs/encoding\";\nimport type { StudioKareSession, StudioKareUser } from \"../types.ts\";\nimport type { AuthQueries } from \"./queries.ts\";\n\nexport function generateToken(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return encodeHexLowerCase(bytes);\n}\n\nexport function hashToken(token: string): string {\n return encodeHexLowerCase(sha256(new TextEncoder().encode(token)));\n}\n\nexport function generateId(): string {\n const bytes = new Uint8Array(16);\n crypto.getRandomValues(bytes);\n return encodeHexLowerCase(bytes);\n}\n\nexport interface ValidateResult {\n session: StudioKareSession;\n user: StudioKareUser;\n rotated: boolean;\n}\n\nexport function createSessionService(queries: AuthQueries, opts: { sessionLifetimeMs: number }) {\n const { sessionLifetimeMs } = opts;\n const sessionRotationMs = sessionLifetimeMs / 2;\n\n async function createUserSession(\n userId: string,\n ): Promise<{ token: string; session: StudioKareSession }> {\n const token = generateToken();\n const sessionId = hashToken(token);\n const expiresAt = new Date(Date.now() + sessionLifetimeMs);\n\n await queries.createSessionRecord(sessionId, userId, expiresAt);\n\n return {\n token,\n session: { id: sessionId, userId, expiresAt },\n };\n }\n\n async function validateSession(token: string): Promise {\n const sessionId = hashToken(token);\n const result = await queries.getSessionRecord(sessionId);\n\n if (!result) return null;\n\n const { session, user } = result;\n const now = new Date();\n\n if (session.expiresAt <= now) {\n await queries.deleteSessionRecord(sessionId);\n return null;\n }\n\n // Rotate if past the halfway point\n const timeRemaining = session.expiresAt.getTime() - now.getTime();\n if (timeRemaining < sessionRotationMs) {\n const newExpiresAt = new Date(Date.now() + sessionLifetimeMs);\n await queries.updateSessionExpiry(sessionId, newExpiresAt);\n session.expiresAt = newExpiresAt;\n return { session, user, rotated: true };\n }\n\n return { session, user, rotated: false };\n }\n\n async function invalidateSession(token: string): Promise {\n const sessionId = hashToken(token);\n await queries.deleteSessionRecord(sessionId);\n }\n\n return { createUserSession, validateSession, invalidateSession };\n}\n\nexport type SessionService = ReturnType;\n",[],[206,301],[206],{"_104":310,"_97":311,"_160":312,"_162":-5,"_163":145,"_164":313,"_166":167,"_106":314,"_101":33,"_169":170,"_171":-5,"_172":22,"_173":-5,"_174":315,"_100":325},"4bde5738-22db-11f1-ae2c-42dde27851f2","examples","4bde5882-22db-11f1-ae2c-42dde27851f2",17,["D",1773846069116],[316],{"_104":317,"_97":318,"_160":319,"_162":312,"_163":145,"_164":320,"_166":167,"_106":321,"_101":33,"_169":216,"_171":322,"_172":22,"_173":-5,"_174":323,"_100":324},"67c83c7a-22db-11f1-8e04-42dde27851f2","client-app.ts","67c83d9c-22db-11f1-8e04-42dde27851f2",18,["D",1773846115943],"/**\n * studiokare-auth: OAuth2 Client App Example\n *\n * This file shows two Val Town HTTP vals that work together:\n *\n * 1. AUTH SERVER — deploys studiokare-auth as an identity provider\n * 2. CLIENT APP — a separate app that uses the auth server for login\n *\n * Deploy each as its own Val Town HTTP val. Update the URLs and secrets\n * to match your own vals.\n */\n\n// ============================================================\n// PART 1: AUTH SERVER VAL\n// ============================================================\n// Deploy this as a Val Town HTTP val (e.g. \"myAuthServer\").\n// It becomes the identity provider that issues magic links and\n// OAuth2 tokens.\n//\n// Val Town endpoint URL will be something like:\n// https://myAuthServer.web.val.run\n// ============================================================\n\nimport { Hono } from \"npm:hono\";\nimport { createAuthApp } from \"https://esm.town/v/YOUR_USERNAME/studiokare-auth/backend/index.ts\";\n// ↑ Replace with the actual import path for your deployed studiokare-auth\n\nconst CLIENT_APP_URL = \"https://myClientApp.web.val.run\"; // ← your client app's URL\n\nconst {\n authApp,\n oauthApp,\n authMiddleware,\n runAuthMigrations,\n} = createAuthApp({\n appName: \"My Auth Server\",\n\n // Optional: configure Scaleway email service for real emails.\n // Without it, magic links are logged to the console (see Val Town logs).\n // emailService: new ScalewayEmailService({ ... }),\n\n oauth: {\n // Register the client app so it can use the OAuth2 flow.\n clients: [\n {\n clientId: \"my-client-app\",\n clientSecret: \"change-me-to-a-strong-random-secret\",\n redirectUris: [`${CLIENT_APP_URL}/callback`],\n name: \"My Client App\",\n },\n ],\n // HMAC-SHA256 signing key for JWTs — must be ≥ 32 bytes.\n jwtSecret: \"change-me-to-a-32-byte-or-longer-key!!\",\n },\n});\n\nawait runAuthMigrations();\n\nconst authServer = new Hono();\n\n// The auth middleware attaches `user` to the context for session-based routes.\nauthServer.use(\"*\", authMiddleware);\n\n// Mount auth routes (magic-link login, logout, /me, etc.)\nauthServer.route(\"/auth\", authApp);\n\n// Mount OAuth2 routes (authorize, token, userinfo, users)\nif (oauthApp) authServer.route(\"/oauth\", oauthApp);\n\nexport default authServer;\n\n\n// ============================================================\n// PART 2: CLIENT APP VAL\n// ============================================================\n// Deploy this as a SEPARATE Val Town HTTP val (e.g. \"myClientApp\").\n// This is your actual application that delegates authentication\n// to the auth server above.\n//\n// Val Town endpoint URL will be something like:\n// https://myClientApp.web.val.run\n// ============================================================\n\n// import { Hono } from \"npm:hono\";\n// import { getCookie, setCookie } from \"npm:hono/cookie\";\n\n// // --- Configuration -----------------------------------------------------------\n// // Point these at your deployed auth server and match the client credentials\n// // you registered above.\n//\n// const AUTH_SERVER_URL = \"https://myAuthServer.web.val.run\";\n// const CLIENT_ID = \"my-client-app\";\n// const CLIENT_SECRET = \"change-me-to-a-strong-random-secret\";\n// const CLIENT_APP_URL = \"https://myClientApp.web.val.run\";\n//\n// const app = new Hono();\n//\n//\n// // --- Home page ---------------------------------------------------------------\n// // Shows a login link (or the logged-in user's info).\n//\n// app.get(\"/\", (c) => {\n// const userEmail = getCookie(c, \"user_email\");\n//\n// if (userEmail) {\n// // User is logged in — show their info and a logout link.\n// return c.html(`\n//

Welcome, ${userEmail}!

\n//

You are authenticated via studiokare-auth.

\n// Log out\n// `);\n// }\n//\n// // User is not logged in — show a login button.\n// return c.html(`\n//

My Client App

\n//

This app uses studiokare-auth for passwordless login.

\n// Log in with magic link\n// `);\n// });\n//\n//\n// // --- Login redirect -----------------------------------------------------------\n// // Redirects the user to the auth server's OAuth2 authorize endpoint.\n// // The auth server will handle magic-link login and consent, then redirect\n// // back to /callback with an authorization code.\n//\n// app.get(\"/login\", (c) => {\n// // Generate a random state value to prevent CSRF attacks.\n// const state = crypto.randomUUID();\n//\n// // In production, store `state` in a cookie or session so you can verify\n// // it when the callback arrives. For brevity, we skip that here.\n//\n// const authorizeUrl = new URL(`${AUTH_SERVER_URL}/oauth/authorize`);\n// authorizeUrl.searchParams.set(\"response_type\", \"code\");\n// authorizeUrl.searchParams.set(\"client_id\", CLIENT_ID);\n// authorizeUrl.searchParams.set(\"redirect_uri\", `${CLIENT_APP_URL}/callback`);\n// authorizeUrl.searchParams.set(\"state\", state);\n//\n// return c.redirect(authorizeUrl.toString());\n// });\n//\n//\n// // --- OAuth2 callback ----------------------------------------------------------\n// // The auth server redirects here after the user authenticates and consents.\n// // We receive an authorization code and exchange it for a JWT access token.\n//\n// app.get(\"/callback\", async (c) => {\n// const code = c.req.query(\"code\");\n// const state = c.req.query(\"state\");\n//\n// // In production, verify `state` matches what you stored during /login.\n//\n// if (!code) {\n// return c.text(\"Missing authorization code\", 400);\n// }\n//\n// // ---- Step 1: Exchange the authorization code for an access token ----------\n// // This is a server-to-server request — the client secret is never exposed\n// // to the browser.\n//\n// const tokenResponse = await fetch(`${AUTH_SERVER_URL}/oauth/token`, {\n// method: \"POST\",\n// headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n// body: new URLSearchParams({\n// grant_type: \"authorization_code\",\n// code: code,\n// redirect_uri: `${CLIENT_APP_URL}/callback`,\n// client_id: CLIENT_ID,\n// client_secret: CLIENT_SECRET,\n// }),\n// });\n//\n// if (!tokenResponse.ok) {\n// const err = await tokenResponse.text();\n// return c.text(`Token exchange failed: ${err}`, 500);\n// }\n//\n// const { access_token } = await tokenResponse.json();\n//\n// // ---- Step 2: Fetch user info using the access token ----------------------\n// // The access token is a JWT — you could also decode it directly, but\n// // calling /oauth/userinfo is the standard approach.\n//\n// const userinfoResponse = await fetch(`${AUTH_SERVER_URL}/oauth/userinfo`, {\n// headers: { Authorization: `Bearer ${access_token}` },\n// });\n//\n// if (!userinfoResponse.ok) {\n// return c.text(\"Failed to fetch user info\", 500);\n// }\n//\n// const userinfo = await userinfoResponse.json();\n// // userinfo = { sub: \"user-id\", email: \"user@example.com\" }\n//\n// // ---- Step 3: Create your own session -------------------------------------\n// // Set a simple cookie with the user's email. In production, use a proper\n// // session store (e.g. a database-backed session with an opaque token).\n//\n// setCookie(c, \"user_email\", userinfo.email, {\n// httpOnly: true,\n// secure: true,\n// sameSite: \"Lax\",\n// path: \"/\",\n// maxAge: 60 * 60 * 24 * 7, // 7 days\n// });\n//\n// // Redirect to the home page, now logged in.\n// return c.redirect(\"/\");\n// });\n//\n//\n// // --- Logout -------------------------------------------------------------------\n//\n// app.get(\"/logout\", (c) => {\n// setCookie(c, \"user_email\", \"\", { path: \"/\", maxAge: 0 });\n// return c.redirect(\"/\");\n// });\n//\n//\n// export default app;\n\n\n// ============================================================\n// BONUS: Register a user via the API\n// ============================================================\n// You can pre-register users from a script or admin tool using\n// the POST /oauth/users endpoint with Basic auth:\n//\n// const response = await fetch(`${AUTH_SERVER_URL}/oauth/users`, {\n// method: \"POST\",\n// headers: {\n// \"Content-Type\": \"application/json\",\n// \"Authorization\": `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,\n// },\n// body: JSON.stringify({ email: \"newuser@example.com\" }),\n// });\n//\n// const result = await response.json();\n// // { user: { id: \"...\", email: \"...\", createdAt: \"...\" }, created: true }\n// // If the user already existed, `created` will be `false`.\n",[],[311,318],[311],{"_104":327,"_97":328,"_160":329,"_162":-5,"_163":145,"_164":208,"_166":167,"_106":330,"_101":33,"_169":170,"_171":-5,"_172":22,"_173":-5,"_174":331,"_100":348},"a2a41fc0-22b9-11f1-897b-42dde27851f2","frontend","019d009a-6592-739d-877b-714a263d557a",["D",1773831611794],[332,340],{"_104":333,"_97":334,"_160":335,"_162":329,"_163":145,"_164":208,"_166":167,"_106":336,"_101":33,"_169":216,"_171":337,"_172":22,"_173":-5,"_174":338,"_100":339},"a2a407d8-22b9-11f1-897b-42dde27851f2","LoginForm.tsx","a2a40846-22b9-11f1-897b-42dde27851f2",["D",1773831611794],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n\nimport { useState } from \"https://esm.sh/react@18.2.0\";\nimport { requestMagicLink } from \"./auth.ts\";\n\nexport function LoginForm({ onClose, Input }: { onClose?: () => void; Input?: any }) {\n const [email, setEmail] = useState(\"\");\n const [status, setStatus] = useState<\"idle\" | \"sending\" | \"sent\" | \"error\">(\"idle\");\n const [errorMessage, setErrorMessage] = useState(\"\");\n\n const handleSubmit = async (e?: React.FormEvent) => {\n e?.preventDefault();\n if (!email.trim()) return;\n\n setStatus(\"sending\");\n const result = await requestMagicLink(email.trim());\n\n if (result.success) {\n setStatus(\"sent\");\n } else {\n setStatus(\"error\");\n setErrorMessage(result.error || \"Something went wrong\");\n }\n };\n\n if (status === \"sent\") {\n return (\n

Check your email

\n We sent a login link to {email}\n

\n {onClose && (\n \n Close\n \n )}\n

\n );\n }\n\n const inputElement = Input ? (\n e.key === \"Enter\" && handleSubmit()}\n placeholder=\"Email address\"\n size=\"sm\"\n className=\"text-xs w-44\"\n />\n ) : (\n setEmail(e.target.value)}\n onKeyDown={(e: any) => e.key === \"Enter\" && handleSubmit()}\n placeholder=\"Email address\"\n className=\"text-xs w-44 px-2 py-1 border rounded\"\n />\n );\n\n return (\n

\n {inputElement}\n \n {status === \"sending\" ? \"Sending...\" : \"Log in\"}\n \n {status === \"error\" && {errorMessage}}\n \n );\n}\n",[],[328,334],{"_104":341,"_97":342,"_160":343,"_162":329,"_163":145,"_164":208,"_166":167,"_106":344,"_101":33,"_169":216,"_171":345,"_172":22,"_173":-5,"_174":346,"_100":347},"a2a3ff18-22b9-11f1-897b-42dde27851f2","auth.ts","a2a3ff90-22b9-11f1-897b-42dde27851f2",["D",1773831611794],"import type { StudioKareUser } from \"../types.ts\";\n\ndeclare global {\n interface Window {\n __STUDIOKARE_USER__?: StudioKareUser | null;\n }\n}\n\nexport function getAuthUser(): StudioKareUser | null {\n return window.__STUDIOKARE_USER__ ?? null;\n}\n\nexport async function requestMagicLink(\n email: string,\n): Promise<{ success: boolean; error?: string }> {\n try {\n const response = await fetch(\"/auth/magic-link\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ email }),\n });\n if (!response.ok) {\n const data = await response.json();\n return { success: false, error: data.error || \"Failed to send magic link\" };\n }\n return { success: true };\n } catch {\n return { success: false, error: \"Network error\" };\n }\n}\n\nexport async function logout(): Promise {\n await fetch(\"/auth/logout\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n });\n window.location.reload();\n}\n\nexport async function requestEmailChange(\n newEmail: string,\n): Promise<{ success: boolean; error?: string }> {\n try {\n const response = await fetch(\"/auth/change-email\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ email: newEmail }),\n });\n if (!response.ok) {\n const data = await response.json();\n return { success: false, error: data.error || \"Failed to send confirmation\" };\n }\n return { success: true };\n } catch {\n return { success: false, error: \"Network error\" };\n }\n}\n",[],[328,342],[328],{"_104":350,"_97":351,"_160":352,"_162":-5,"_163":145,"_164":144,"_166":167,"_106":353,"_101":191,"_169":182,"_171":354,"_172":22,"_173":-5,"_174":355,"_100":356},"6fce4e00-22db-11f1-bad0-42dde27851f2","README.md","38eb299c-22ba-11f1-9ef4-42dde27851f2",["D",1773846129406],"# studiokare-auth\n\nA single-tenant passwordless magic-link auth library for Deno + Hono + Val Town SQLite, with optional multi-client OAuth2 authorization code flow.\n\n## Quick Start\n\n```typescript\nimport { createAuthApp } from \"./backend/index.ts\";\n\nconst { authApp, authMiddleware, runAuthMigrations } = createAuthApp({\n appName: \"MyApp\",\n});\n\nawait runAuthMigrations();\n\nconst app = new Hono();\napp.use(\"*\", authMiddleware);\napp.route(\"/auth\", authApp);\n```\n\n### With OAuth2\n\n```typescript\nconst { authApp, oauthApp, authMiddleware, runAuthMigrations } = createAuthApp({\n appName: \"MyApp\",\n oauth: {\n clients: [\n {\n clientId: \"my-client\",\n clientSecret: \"a-strong-secret\",\n redirectUris: [\"https://my-client-app.com/callback\"],\n name: \"My Client App\",\n },\n ],\n jwtSecret: \"a-32-byte-or-longer-secret-key!!\", // HMAC-SHA256\n },\n});\n\nawait runAuthMigrations();\n\nconst app = new Hono();\napp.use(\"*\", authMiddleware);\napp.route(\"/auth\", authApp);\nif (oauthApp) app.route(\"/oauth\", oauthApp);\n```\n\n## Auth Endpoints (`/auth`)\n\n| Method | Path | Description |\n|---|---|---|\n| `POST` | `/magic-link` | Request a magic link. Body: `{ \"email\": \"...\" }` |\n| `GET` | `/magic-link/:token` | Verify magic link and create session |\n| `POST` | `/logout` | Destroy current session |\n| `GET` | `/me` | Return current user or `null` |\n| `POST` | `/change-email` | Request email change. Body: `{ \"email\": \"...\" }` |\n| `GET` | `/change-email/:token` | Confirm email change |\n\n## OAuth2 Endpoints (`/oauth`)\n\nOnly available when `oauth` is configured. Implements the OAuth2 authorization code flow with stateless JWT access tokens.\n\n| Method | Path | Description |\n|---|---|---|\n| `GET` | `/authorize` | Start authorization flow. Query: `response_type=code&client_id=...&redirect_uri=...&state=...` |\n| `POST` | `/authorize` | User consents; generates auth code and redirects to `redirect_uri` |\n| `POST` | `/token` | Exchange auth code for JWT. Form: `grant_type=authorization_code&code=...&redirect_uri=...&client_id=...&client_secret=...` |\n| `GET` | `/userinfo` | Get user info from JWT. Header: `Authorization: Bearer {jwt}` |\n| `POST` | `/users` | Register a user (client-authenticated). Header: `Authorization: Basic base64(client_id:client_secret)`. Body: `{ \"email\": \"...\" }` |\n\n### OAuth2 Flow\n\n1. Client redirects user to `/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&state=...`\n2. User authenticates via magic link (if not already logged in)\n3. User sees consent page and authorizes\n4. Auth server redirects to `redirect_uri?code=...&state=...`\n5. Client exchanges code for JWT at `POST /oauth/token`\n6. Client uses JWT at `GET /oauth/userinfo`\n\n### Token Response\n\n```json\n{ \"access_token\": \"eyJ...\", \"token_type\": \"Bearer\", \"expires_in\": 3600 }\n```\n\n### Userinfo Response\n\n```json\n{ \"sub\": \"user-id\", \"email\": \"user@example.com\" }\n```\n\n## Example: Client App\n\nSee [`examples/client-app.ts`](examples/client-app.ts) for a complete example of two Val Town HTTP vals working together — an auth server (identity provider) and a client app that uses the OAuth2 flow for passwordless login.\n\n## Configuration\n\n```typescript\ninterface AuthConfig {\n appName: string;\n tablePrefix?: string; // default: \"studiokare\"\n cookieName?: string; // default: \"studiokare_session\"\n sessionLifetimeMs?: number; // default: 30 days\n magicLinkTtlMs?: number; // default: 15 minutes\n emailService?: EmailService;\n emailTemplates?: { ... };\n oauth?: {\n clients: OAuthClient[];\n jwtSecret: string; // HMAC-SHA256 key (>= 32 bytes)\n accessTokenTtlMs?: number; // default: 1 hour\n authCodeTtlMs?: number; // default: 10 minutes\n };\n}\n```\n\n## Environment Variables\n\n### Scaleway Email Service\n\nUsed by `ScalewayEmailService` in `backend/email.ts` to send transactional emails (magic links, invites, email change confirmations).\n\n| Variable | Required | Description |\n|---|---|---|\n| `SCW_REGION` | Yes | Scaleway region (used to build the API endpoint) |\n| `SCW_API_URL` | Yes | Scaleway API base URL |\n| `SCW_SECRET_KEY` | Yes | Scaleway authentication secret |\n| `SCW_PROJECT_ID` | Yes | Scaleway project identifier |\n| `SCW_FROM_EMAIL` | Yes | Sender email address for transactional emails |\n| `SCW_FROM_NAME` | No | Sender display name (optional) |\n\nIf `SCW_SECRET_KEY` and `SCW_PROJECT_ID` are not set, the system falls back to `ConsoleEmailService`, which logs emails to the console instead of sending them.\n",[],[351],{"_104":358,"_97":359,"_160":360,"_162":-5,"_163":145,"_164":361,"_166":167,"_106":362,"_101":208,"_169":216,"_171":363,"_172":22,"_173":-5,"_174":364,"_100":365},"88b99962-22d9-11f1-82a6-42dde27851f2","types.ts","a2a41746-22b9-11f1-897b-42dde27851f2",16,["D",1773845312221],"export interface StudioKareUser {\n id: string;\n email: string;\n createdAt: string;\n}\n\nexport interface StudioKareSession {\n id: string;\n userId: string;\n expiresAt: Date;\n}\n\nexport interface EmailService {\n sendMagicLink(email: string, magicLinkUrl: string): Promise;\n sendChangeEmailLink(newEmail: string, changeUrl: string): Promise;\n sendInvite(email: string, magicLinkUrl: string): Promise;\n}\n\nexport interface OAuthClient {\n clientId: string;\n clientSecret: string;\n redirectUris: string[];\n name: string;\n}\n\nexport interface OAuthConfig {\n clients: OAuthClient[];\n jwtSecret: string; // HMAC-SHA256 key (>= 32 bytes)\n accessTokenTtlMs?: number; // default: 1 hour\n authCodeTtlMs?: number; // default: 10 minutes\n}\n\nexport interface AuthConfig {\n appName: string;\n tablePrefix?: string; // default: \"studiokare\"\n cookieName?: string; // default: \"studiokare_session\"\n sessionLifetimeMs?: number; // default: 30 days\n magicLinkTtlMs?: number; // default: 15 minutes\n emailService?: EmailService; // default: ConsoleEmailService\n emailTemplates?: {\n magicLink?: (email: string, url: string) => { subject: string; text: string; html: string };\n emailChange?: (email: string, url: string) => { subject: string; text: string; html: string };\n invite?: (email: string, url: string) => { subject: string; text: string; html: string };\n };\n oauth?: OAuthConfig;\n}\n",[],[359],"files",[157,176,187,194,204,211,220,229,238,247,255,264,273,282,290,299,309,316,326,332,340,349,357],"counts",{"_370":33,"_371":191,"_372":33,"_373":374,"_377":378},"pulls","branches","forks","envVars",{"_375":294,"_376":33},"count","emptyCount","connections",{"_375":33,"_379":33},"unfilledCount","contents",[382,385,388,391,394,397,400],{"_104":158,"_97":159,"_160":161,"_162":-5,"_163":145,"_164":165,"_166":167,"_106":383,"_101":33,"_169":170,"_171":-5,"_172":22,"_173":-5,"_100":384},["D",1773845311350],[159],{"_104":188,"_97":189,"_160":190,"_162":-5,"_163":145,"_164":191,"_166":167,"_106":386,"_101":33,"_169":170,"_171":-5,"_172":22,"_173":-5,"_100":387},["D",1773831863571],[189],{"_104":205,"_97":206,"_160":207,"_162":-5,"_163":145,"_164":208,"_166":167,"_106":389,"_101":33,"_169":170,"_171":-5,"_172":22,"_173":-5,"_100":390},["D",1773831611794],[206],{"_104":310,"_97":311,"_160":312,"_162":-5,"_163":145,"_164":313,"_166":167,"_106":392,"_101":33,"_169":170,"_171":-5,"_172":22,"_173":-5,"_100":393},["D",1773846069116],[311],{"_104":327,"_97":328,"_160":329,"_162":-5,"_163":145,"_164":208,"_166":167,"_106":395,"_101":33,"_169":170,"_171":-5,"_172":22,"_173":-5,"_100":396},["D",1773831611794],[328],{"_104":350,"_97":351,"_160":352,"_162":-5,"_163":145,"_164":144,"_166":167,"_106":398,"_101":191,"_169":182,"_171":354,"_172":22,"_173":-5,"_100":399},["D",1773846129406],[351],{"_104":358,"_97":359,"_160":360,"_162":-5,"_163":145,"_164":361,"_166":167,"_106":401,"_101":208,"_169":216,"_171":363,"_172":22,"_173":-5,"_100":402},["D",1773845312221],[359],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.environment-variables",{"_95":96,"_97":98,"_102":411,"_373":416,"_446":22},{"_104":105,"_97":98,"_106":412,"_108":-5,"_109":22,"_110":111,"_112":113,"_114":-5,"_14":115,"_116":-5,"_117":22,"_118":-5,"_119":-5,"_120":33,"_16":121,"_122":-5,"_123":-5,"_124":-5,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_23":413,"_137":414,"_142":415,"_154":22},["D",1773829593631],{"_95":96,"_135":136},{"_95":96,"_139":136,"_14":115,"_140":141},{"_101":144,"_97":45,"_104":145,"_146":105,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":98,"_153":96},[417,424,428,431,434,437,440,443],{"_418":419,"_106":420,"_421":-5,"_112":422,"_423":22},"key","SCW_FROM_EMAIL",["D",1773831719563],"updatedAt","magiclink+noreply@login.studiokare.nl","isEmpty",{"_418":425,"_106":426,"_421":-5,"_112":427,"_423":22},"SCW_FROM_NAME",["D",1773831695914],"Studio Kare Authentication",{"_418":429,"_106":430,"_421":-5,"_112":74,"_423":22},"SCW_PROJECT_ID",["D",1773831674632],{"_418":432,"_106":433,"_421":-5,"_112":74,"_423":22},"SCW_ACCESS_KEY",["D",1773831666737],{"_418":435,"_106":436,"_421":-5,"_112":74,"_423":22},"SCW_SECRET_KEY",["D",1773831659736],{"_418":438,"_106":439,"_421":-5,"_112":74,"_423":22},"SCW_DEFAULT_ORG",["D",1773831653074],{"_418":441,"_106":442,"_421":-5,"_112":74,"_423":22},"SCW_REGION",["D",1773831645586],{"_418":444,"_106":445,"_421":-5,"_112":74,"_423":22},"SCW_API_URL",["D",1773831638056],"isTeamOrg","actionData","errors"]

Key	Description
SCW_FROM_EMAIL	magiclink+noreply@login.studiokare.nl
SCW_FROM_NAME	Studio Kare Authentication
SCW_PROJECT_ID
SCW_ACCESS_KEY
SCW_SECRET_KEY
SCW_DEFAULT_ORG
SCW_REGION
SCW_API_URL

cricks_unmixed4u

studiokare-auth

Environment variables