[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_237":238,"_239":240},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_179":-5,"_20":180,"_22":181,"_182":183,"_184":185,"_26":186,"_24":187,"_188":-5,"_189":-5,"_190":52,"_191":192,"_193":43,"_194":-5,"_195":-5,"_196":197},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","drmy01bsp6bi","name","signup-login","branchName","main","version","path","index.tsx","project",{"_33":123,"_13":14,"_44":124,"_125":-5,"_126":52,"_127":109,"_128":109,"_129":130,"_131":-5,"_132":133,"_134":36,"_135":43,"_136":-5,"_137":-5,"_138":67,"_139":140,"_141":142,"_143":144,"_145":146,"_147":-5,"_148":149,"_150":149,"_151":152,"_153":152,"_154":152,"_155":149,"_156":149,"_157":158,"_159":160,"_161":162,"_163":52},"tree",[55,56,57,58,59,60,61],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","95d56d9b-a09d-4aa2-a3f1-5279aeeb83c4","fileId","01a0b007-082c-75f1-b566-c43cc36ce931","parentId","branchId","e1904dc2-ab4b-4aeb-8c8c-626dd25ed021","branchVersion",5,"latest",true,"createdAt",["D",1789659795593],1,"fileType","http","content","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport type { Context } from \"npm:hono@4\";\nimport { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport {\n bumpCodeAttempts,\n consumeCode,\n countCodesSince,\n createSession,\n createUser,\n deleteSession,\n findActiveCode,\n findSessionUser,\n findUserByEmail,\n initDb,\n markVerified,\n type User,\n} from \"./db.ts\";\nimport {\n clearedSessionCookie,\n generateCode,\n hashCode,\n hashPassword,\n hashToken,\n newToken,\n readCookie,\n sessionCookie,\n SESSION_COOKIE,\n verifyPassword,\n} from \"./auth.ts\";\nimport { sendCodeEmail } from \"./mail.ts\";\n\nconst CODE_TTL_MINUTES = 10;\nconst SESSION_DAYS = 30;\nconst RESEND_COOLDOWN_SECONDS = 30;\nconst MAX_CODES_PER_HOUR = 5;\nconst MAX_CODE_ATTEMPTS = 5;\nconst MIN_PASSWORD_LENGTH = 8;\nconst MAX_EMAIL_LENGTH = 254;\nconst MAX_PASSWORD_LENGTH = 200;\n\n// 页面只显示文案代码，文案在这里查表 —— 用户输入永远不会被反射回页面。\nconst MESSAGES: Record = {\n code_sent: { text: `验证码已发到你的邮箱，${CODE_TTL_MINUTES} 分钟内有效。`, tone: \"ok\" },\n welcome: { text: \"邮箱验证成功，欢迎。\", tone: \"ok\" },\n logged_out: { text: \"已退出登录。\", tone: \"ok\" },\n invalid_email: { text: \"邮箱格式不对。\", tone: \"bad\" },\n weak_password: { text: `密码至少 ${MIN_PASSWORD_LENGTH} 位。`, tone: \"bad\" },\n email_taken: { text: \"这个邮箱已经注册过了，直接登录吧。\", tone: \"bad\" },\n invalid_credentials: { text: \"邮箱或密码不对。\", tone: \"bad\" },\n not_verified: { text: \"这个邮箱还没验证，先收验证码验证一下。\", tone: \"bad\" },\n bad_code: { text: \"验证码不对。\", tone: \"bad\" },\n expired_code: { text: \"验证码不存在或已过期，重新发一个。\", tone: \"bad\" },\n too_many_attempts: { text: \"试错次数太多，重新发一个验证码。\", tone: \"bad\" },\n cooldown: { text: `刚发过，等 ${RESEND_COOLDOWN_SECONDS} 秒再试。`, tone: \"bad\" },\n rate_limited: { text: `一小时内最多发 ${MAX_CODES_PER_HOUR} 次验证码。`, tone: \"bad\" },\n mail_failed: { text: \"验证码已生成，但邮件没发出去（收件人限制见 README）。\", tone: \"bad\" },\n};\n\nconst Notice = ({ code }: { code?: string }) => {\n const message = code ? MESSAGES[code] : undefined;\n if (!message) return null;\n const tone = message.tone === \"ok\"\n ? \"border-green-300 bg-green-50 text-green-800\"\n : \"border-red-300 bg-red-50 text-red-800\";\n return

{message.text}

;\n};\n\nconst Layout = (\n props: { title: string; user?: User | null; notice?: string; children: unknown },\n) => (\n \n \n {props.title}\n \n \n \n \n \n \n \n \n \n {props.children}\n \n \n \n);\n\nconst Field = (\n props: {\n label: string;\n name: string;\n type: string;\n autocomplete: string;\n value?: string;\n hint?: string;\n },\n) => (\n \n {props.label}\n \n {props.hint ? {props.hint} : null}\n \n);\n\nconst Submit = ({ children }: { children: unknown }) => (\n \n {children}\n \n);\n\nconst app = new Hono();\n\nfunction redirect(\n path: string,\n params: Record = {},\n cookie?: string,\n): Response {\n const query = new URLSearchParams(params).toString();\n const headers: Record = { Location: query ? `${path}?${query}` : path };\n if (cookie) headers[\"Set-Cookie\"] = cookie;\n return new Response(null, { status: 302, headers });\n}\n\nfunction field(body: Record, name: string): string {\n const value = body[name];\n return typeof value === \"string\" ? value.trim() : \"\";\n}\n\nfunction noticeCode(c: Context): string | undefined {\n return c.req.query(\"err\") ?? c.req.query(\"msg\") ?? undefined;\n}\n\nasync function currentUser(c: Context): Promise {\n const token = readCookie(c.req.header(\"cookie\"), SESSION_COOKIE);\n if (!token) return null;\n const tokenHash = await hashToken(token);\n const session = await findSessionUser(tokenHash);\n if (!session) return null;\n if (Date.parse(session.session_expires_at) <= Date.now()) {\n await deleteSession(tokenHash);\n return null;\n }\n return session;\n}\n\nasync function startSession(userId: string): Promise {\n const now = Date.now();\n const token = newToken();\n await createSession({\n tokenHash: await hashToken(token),\n userId,\n createdAt: new Date(now).toISOString(),\n expiresAt: new Date(now + SESSION_DAYS * 86_400_000).toISOString(),\n });\n return sessionCookie(token, SESSION_DAYS * 86_400);\n}\n\n/** 生成验证码、落库、发信。带冷却和一小时次数上限。 */\nasync function issueCode(\n user: User,\n): Promise<\"ok\" | \"cooldown\" | \"rate_limited\" | \"mail_failed\"> {\n const now = Date.now();\n const recent = await countCodesSince(user.id, new Date(now - 3_600_000).toISOString());\n if (recent >= MAX_CODES_PER_HOUR) return \"rate_limited\";\n\n const last = await findActiveCode(user.id);\n if (last && now - Date.parse(last.created_at) < RESEND_COOLDOWN_SECONDS * 1000) {\n return \"cooldown\";\n }\n\n const code = generateCode();\n await insertCodeRow(user.id, code, now);\n\n try {\n await sendCodeEmail(user.email, code, CODE_TTL_MINUTES);\n return \"ok\";\n } catch (error) {\n console.error(\"验证码邮件发送失败:\", error);\n // 邮件发不出去时把验证码写进日志，方便你在 Val Town 日志里自己完成验证流程。\n console.log(`[dev] ${user.email} 的验证码是 ${code}`);\n return \"mail_failed\";\n }\n}\n\nasync function insertCodeRow(userId: string, code: string, now: number): Promise {\n const { insertCode } = await import(\"./db.ts\");\n await insertCode({\n id: crypto.randomUUID(),\n userId,\n codeHash: await hashCode(userId, code),\n createdAt: new Date(now).toISOString(),\n expiresAt: new Date(now + CODE_TTL_MINUTES * 60_000).toISOString(),\n });\n}\n\napp.get(\"/\", async (c) => {\n const user = await currentUser(c);\n return c.html(\n \n {user\n ? (\n

已登录

邮箱: {user.email}
状态: {user.verified_at ? \"已验证\" : \"未验证\"}
注册于: {new Date(user.created_at).toLocaleString(\"zh-CN\")}

\n 会话是 HttpOnly cookie，服务端只存 token 的哈希。登录状态保持 {SESSION_DAYS} 天。\n

\n )\n : (\n

邮箱注册 / 登录

\n 邮箱 + 密码注册 → 收 6 位验证码验证邮箱 → 登录后拿到会话 cookie。\n

\n \n 注册\n \n \n 登录\n \n

\n )}\n ,\n );\n});\n\napp.get(\"/signup\", async (c) => {\n const user = await currentUser(c);\n if (user) return redirect(\"/\");\n return c.html(\n \n

注册

\n ,\n );\n});\n\napp.post(\"/signup\", async (c) => {\n await initDb();\n const body = await c.req.parseBody();\n const email = field(body, \"email\").toLowerCase();\n const password = field(body, \"password\");\n\n if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email) || email.length > MAX_EMAIL_LENGTH) {\n return redirect(\"/signup\", { err: \"invalid_email\" });\n }\n if (password.length < MIN_PASSWORD_LENGTH || password.length > MAX_PASSWORD_LENGTH) {\n return redirect(\"/signup\", { err: \"weak_password\" });\n }\n\n const existing = await findUserByEmail(email);\n if (existing?.verified_at) return redirect(\"/login\", { err: \"email_taken\" });\n\n let user = existing;\n if (!user) {\n try {\n await createUser({\n id: crypto.randomUUID(),\n email,\n passwordHash: await hashPassword(password),\n createdAt: new Date().toISOString(),\n });\n } catch (error) {\n // 并发注册撞上 UNIQUE 约束：当成已存在处理。\n console.error(\"创建用户失败:\", error);\n user = await findUserByEmail(email);\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n }\n user ??= await findUserByEmail(email);\n }\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n\n const result = await issueCode(user);\n return redirect(\"/verify\", {\n email,\n ...(result === \"ok\" ? { msg: \"code_sent\" } : { err: result }),\n });\n});\n\napp.get(\"/verify\", async (c) => {\n const email = (c.req.query(\"email\") ?? \"\").toLowerCase();\n if (!email) return redirect(\"/signup\");\n return c.html(\n \n

验证邮箱

\n 验证码已发到 {email}，{CODE_TTL_MINUTES} 分钟内有效。\n

\n ,\n );\n});\n\napp.post(\"/verify\", async (c) => {\n await initDb();\n const body = await c.req.parseBody();\n const email = field(body, \"email\").toLowerCase();\n const code = field(body, \"code\");\n\n const user = await findUserByEmail(email);\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n\n const row = await findActiveCode(user.id);\n if (!row || Date.parse(row.expires_at) <= Date.now()) {\n return redirect(\"/verify\", { email, err: \"expired_code\" });\n }\n if (row.attempts >= MAX_CODE_ATTEMPTS) {\n return redirect(\"/verify\", { email, err: \"too_many_attempts\" });\n }\n if (await hashCode(user.id, code) !== row.code_hash) {\n await bumpCodeAttempts(row.id);\n return redirect(\"/verify\", { email, err: \"bad_code\" });\n }\n\n const now = new Date().toISOString();\n await consumeCode(row.id, now);\n await markVerified(user.id, now);\n return redirect(\"/\", { msg: \"welcome\" }, await startSession(user.id));\n});\n\napp.post(\"/verify/resend\", async (c) => {\n await initDb();\n const email = field(await c.req.parseBody(), \"email\").toLowerCase();\n const user = await findUserByEmail(email);\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n if (user.verified_at) return redirect(\"/login\", { err: \"email_taken\" });\n\n const result = await issueCode(user);\n return redirect(\"/verify\", {\n email,\n ...(result === \"ok\" ? { msg: \"code_sent\" } : { err: result }),\n });\n});\n\napp.get(\"/login\", async (c) => {\n const user = await currentUser(c);\n if (user) return redirect(\"/\");\n return c.html(\n \n

\n ,\n );\n});\n\napp.post(\"/login\", async (c) => {\n await initDb();\n const body = await c.req.parseBody();\n const email = field(body, \"email\").toLowerCase();\n const password = field(body, \"password\");\n\n const user = await findUserByEmail(email);\n // 用户不存在时也走一遍哈希校验，避免用响应时间区分邮箱是否注册过。\n const ok = await verifyPassword(password, user?.password_hash ?? \"pbkdf2$1$AA$AA\");\n if (!user || !ok) return redirect(\"/login\", { err: \"invalid_credentials\" });\n if (!user.verified_at) return redirect(\"/verify\", { email, err: \"not_verified\" });\n\n return redirect(\"/\", { msg: \"welcome\" }, await startSession(user.id));\n});\n\napp.post(\"/logout\", async (c) => {\n const token = readCookie(c.req.header(\"cookie\"), SESSION_COOKIE);\n if (token) await deleteSession(await hashToken(token));\n return redirect(\"/\", { msg: \"logged_out\" }, clearedSessionCookie());\n});\n\napp.get(\"/public/*\", (c) => serveFile(c.req.path));\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// 把 Hono 的错误换成原始错误，Val Town 日志里能看到真实堆栈\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;","deleted",false,"label",[19],{"_33":108,"_13":109,"_35":110,"_37":-5,"_38":39,"_40":46,"_42":43,"_44":111,"_17":67,"_47":112,"_49":-5,"_51":52,"_53":-5,"_70":113,"_18":114},{"_33":100,"_13":101,"_35":102,"_37":-5,"_38":39,"_40":103,"_42":43,"_44":104,"_17":46,"_47":24,"_49":105,"_51":52,"_53":-5,"_70":106,"_18":107},{"_33":92,"_13":93,"_35":94,"_37":-5,"_38":39,"_40":95,"_42":43,"_44":96,"_17":67,"_47":68,"_49":97,"_51":52,"_53":-5,"_70":98,"_18":99},{"_33":84,"_13":85,"_35":86,"_37":-5,"_38":39,"_40":87,"_42":43,"_44":88,"_17":67,"_47":68,"_49":89,"_51":52,"_53":-5,"_70":90,"_18":91},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":81,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_70":82,"_18":83},{"_33":73,"_13":74,"_35":75,"_37":-5,"_38":39,"_40":76,"_42":43,"_44":77,"_17":67,"_47":68,"_49":78,"_51":52,"_53":-5,"_70":79,"_18":80},{"_33":62,"_13":63,"_35":64,"_37":-5,"_38":39,"_40":65,"_42":43,"_44":66,"_17":67,"_47":68,"_49":69,"_51":52,"_53":-5,"_70":71,"_18":72},"e17d72a9-e118-482c-9055-71f4a3f79a04","test.ts","9e461e1c-b2ae-11f1-b1d4-1607ee4eb77e",7,["D",1789659847451],0,"script","// 直接跑这个文件：run_file(\"drmy01bsp6bi/signup-login\", \"test.ts\")\n// 覆盖密码哈希、验证码、会话 token 和 cookie 解析 —— 这些是鉴权最容易写错的地方。\n\nimport {\n clearedSessionCookie,\n generateCode,\n hashCode,\n hashPassword,\n hashToken,\n newToken,\n readCookie,\n sessionCookie,\n verifyPassword,\n} from \"./auth.ts\";\n\nfunction check(condition: unknown, label: string): void {\n if (!condition) throw new Error(`FAIL: ${label}`);\n console.log(`ok: ${label}`);\n}\n\nconst password = \"correct horse battery staple\";\nconst hash = await hashPassword(password);\ncheck(hash.startsWith(\"pbkdf2$100000$\"), \"密码哈希是 pbkdf2 + 迭代次数 + 盐\");\ncheck(await verifyPassword(password, hash), \"正确密码通过\");\ncheck(!(await verifyPassword(\"wrong password\", hash)), \"错误密码不通过\");\ncheck(!(await verifyPassword(password, \"pbkdf2$1$AA$AA\")), \"坏哈希不通过\");\n\nconst secondHash = await hashPassword(password);\ncheck(hash !== secondHash, \"同一密码两次哈希不同（盐随机）\");\ncheck(await verifyPassword(password, secondHash), \"第二个哈希也能验证\");\n\nconst code = generateCode();\ncheck(/^\\d{6}$/.test(code), \"验证码是 6 位数字\");\ncheck(await hashCode(\"user-1\", \"123456\") === await hashCode(\"user-1\", \"123456\"), \"验证码哈希稳定\");\ncheck(await hashCode(\"user-1\", \"123456\") !== await hashCode(\"user-2\", \"123456\"), \"验证码哈希绑定了用户\");\n\nconst token = newToken();\ncheck(/^[0-9a-f]{64}$/.test(token), \"会话 token 是 64 位 hex\");\ncheck(token !== newToken(), \"每次生成的 token 不同\");\ncheck(await hashToken(token) !== await hashToken(newToken()), \"不同 token 哈希不同\");\ncheck(await hashToken(token) === await hashToken(token), \"同一 token 哈希稳定\");\n\ncheck(readCookie(\"a=1; session=abc123; b=2\", \"session\") === \"abc123\", \"从 cookie 头里读出 session\");\ncheck(readCookie(\"foo=bar\", \"session\") === null, \"没有该 cookie 时返回 null\");\ncheck(readCookie(undefined, \"session\") === null, \"没有 cookie 头时返回 null\");\ncheck(readCookie(\"session=\", \"session\") === \"\", \"空值返回空串\");\n\nconst cookie = sessionCookie(token, 3600);\ncheck(cookie.includes(\"HttpOnly\"), \"会话 cookie 是 HttpOnly\");\ncheck(cookie.includes(\"Secure\"), \"会话 cookie 带 Secure\");\ncheck(cookie.includes(\"SameSite=Lax\"), \"会话 cookie 带 SameSite=Lax\");\ncheck(cookie.includes(\"Max-Age=3600\"), \"会话 cookie 有有效期\");\ncheck(clearedSessionCookie().includes(\"Max-Age=0\"), \"清除 cookie 用 Max-Age=0\");\n\nconsole.log(\"\\n全部通过。\");","children",[],[63],"b8373023-5c91-4eee-8a2c-263e2b8f8e46","mail.ts","56cef0d6-b2ae-11f1-99cb-1607ee4eb77e",4,["D",1789659727548],"import { email } from \"https://esm.town/v/std/email\";\n\n/**\n * 给注册者本人发验证码。\n * 注意：std/email 的收件人受套餐限制 —— 免费账号只能发到本账号自己的邮箱。\n * 想给真实用户发信需要升级套餐，或者换成自己的邮件服务（见 README）。\n */\nexport async function sendCodeEmail(to: string, code: string, minutes: number): Promise {\n await email({\n to,\n subject: `你的验证码是 ${code}`,\n text: [\n `验证码：${code}`,\n \"\",\n `${minutes} 分钟内有效，只能使用一次。`,\n \"如果不是你本人操作，忽略这封邮件即可。\",\n ].join(\"\\n\"),\n });\n}",[],[74],["D",1789659795593],[],[19],"bfe521f7-4c90-4468-8fb0-97f26f3ef3bd","db.ts","56b52bd8-b2ae-11f1-99cb-1607ee4eb77e",2,["D",1789659727383],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type User = {\n id: string;\n email: string;\n password_hash: string;\n created_at: string;\n verified_at: string | null;\n};\n\nexport type LoginCode = {\n id: string;\n user_id: string;\n code_hash: string;\n created_at: string;\n expires_at: string;\n consumed_at: string | null;\n attempts: number;\n};\n\nexport type SessionUser = User & { session_expires_at: string };\n\n// 建表。用 CREATE TABLE IF NOT EXISTS，所以每次冷启动跑一遍也是安全的。\nlet schemaReady: Promise | undefined;\n\nexport function initDb(): Promise {\n schemaReady ??= sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id TEXT PRIMARY KEY,\n email TEXT NOT NULL COLLATE NOCASE UNIQUE,\n password_hash TEXT NOT NULL,\n created_at TEXT NOT NULL,\n verified_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS login_codes (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n code_hash TEXT NOT NULL,\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n attempts INTEGER NOT NULL DEFAULT 0\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token_hash TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n },\n { sql: \"CREATE INDEX IF NOT EXISTS idx_login_codes_user ON login_codes(user_id, created_at)\" },\n ]).then(() => undefined);\n return schemaReady;\n}\n\nasync function query(sql: string, args: (string | number)[] = []): Promise {\n const result = await sqlite.execute({ sql, args });\n return result.rows as unknown as T[];\n}\n\nexport async function findUserByEmail(email: string): Promise {\n const [user] = await query(\"SELECT * FROM users WHERE email = ?\", [email]);\n return user ?? null;\n}\n\nexport async function createUser(user: {\n id: string;\n email: string;\n passwordHash: string;\n createdAt: string;\n}): Promise {\n await sqlite.execute({\n sql: \"INSERT INTO users (id, email, password_hash, created_at) VALUES (?, ?, ?, ?)\",\n args: [user.id, user.email, user.passwordHash, user.createdAt],\n });\n}\n\nexport async function markVerified(userId: string, at: string): Promise {\n await sqlite.execute({\n sql: \"UPDATE users SET verified_at = ? WHERE id = ? AND verified_at IS NULL\",\n args: [at, userId],\n });\n}\n\nexport async function insertCode(code: {\n id: string;\n userId: string;\n codeHash: string;\n createdAt: string;\n expiresAt: string;\n}): Promise {\n await sqlite.execute({\n sql: `INSERT INTO login_codes (id, user_id, code_hash, created_at, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [code.id, code.userId, code.codeHash, code.createdAt, code.expiresAt],\n });\n}\n\n/** 最近一个还没用掉的验证码（可能是过期的，调用方自己判断）。 */\nexport async function findActiveCode(userId: string): Promise {\n const [row] = await query(\n \"SELECT * FROM login_codes WHERE user_id = ? AND consumed_at IS NULL ORDER BY created_at DESC LIMIT 1\",\n [userId],\n );\n return row ?? null;\n}\n\nexport async function consumeCode(codeId: string, at: string): Promise {\n await sqlite.execute({\n sql: \"UPDATE login_codes SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL\",\n args: [at, codeId],\n });\n}\n\nexport async function bumpCodeAttempts(codeId: string): Promise {\n await sqlite.execute({\n sql: \"UPDATE login_codes SET attempts = attempts + 1 WHERE id = ?\",\n args: [codeId],\n });\n}\n\n/** 某个时间点之后这个用户一共申请过几次验证码（用于限流）。 */\nexport async function countCodesSince(userId: string, since: string): Promise {\n const [row] = await query<{ n: number }>(\n \"SELECT COUNT(*) AS n FROM login_codes WHERE user_id = ? AND created_at >= ?\",\n [userId, since],\n );\n return Number(row?.n ?? 0);\n}\n\nexport async function createSession(session: {\n tokenHash: string;\n userId: string;\n createdAt: string;\n expiresAt: string;\n}): Promise {\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)\",\n args: [session.tokenHash, session.userId, session.createdAt, session.expiresAt],\n });\n}\n\nexport async function findSessionUser(tokenHash: string): Promise {\n const [row] = await query(\n `SELECT u.*, s.expires_at AS session_expires_at\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = ?`,\n [tokenHash],\n );\n return row ?? null;\n}\n\nexport async function deleteSession(tokenHash: string): Promise {\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token_hash = ?\", args: [tokenHash] });\n}",[],[85],"12f660a8-891a-4d8e-9066-76a094f7ec76","auth.ts","56bfff0e-b2ae-11f1-99cb-1607ee4eb77e",3,["D",1789659727447],"// 密码、验证码、会话 token 的处理。全部用 Web Crypto，没有第三方依赖。\n\nconst encoder = new TextEncoder();\n\nconst PBKDF2_ITERATIONS = 100_000;\n\nexport const SESSION_COOKIE = \"session\";\n\nfunction toBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary);\n}\n\nfunction fromBase64(value: string): Uint8Array {\n const binary = atob(value);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\n\nfunction equalBytes(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\nasync function derive(password: string, salt: Uint8Array, iterations: number): Promise {\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(password), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\n\n/** 存成 pbkdf2$迭代次数$盐$哈希，盐每个用户独立。 */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await derive(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toBase64(salt)}$${toBase64(hash)}`;\n}\n\nexport async function verifyPassword(password: string, stored: string): Promise {\n const [scheme, iterations, salt, hash] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\" || !iterations || !salt || !hash) return false;\n const candidate = await derive(password, fromBase64(salt), Number(iterations));\n return equalBytes(candidate, fromBase64(hash));\n}\n\n/** 6 位数字验证码。 */\nexport function generateCode(): string {\n return String(crypto.getRandomValues(new Uint32Array(1))[0] % 1_000_000).padStart(6, \"0\");\n}\n\nexport async function sha256Base64(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(input));\n return toBase64(new Uint8Array(digest));\n}\n\n/** 验证码不存明文，存哈希。 */\nexport async function hashCode(userId: string, code: string): Promise {\n return await sha256Base64(`${userId}:${code}`);\n}\n\n/** 会话 token 同理：只存哈希，明文只在 cookie 里。 */\nexport async function hashToken(token: string): Promise {\n return await sha256Base64(`session:${token}`);\n}\n\nexport function newToken(): string {\n const bytes = crypto.getRandomValues(new Uint8Array(32));\n return [...bytes].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function readCookie(header: string | null | undefined, name: string): string | null {\n if (!header) return null;\n for (const part of header.split(\";\")) {\n const index = part.indexOf(\"=\");\n if (index === -1) continue;\n if (part.slice(0, index).trim() === name) {\n return decodeURIComponent(part.slice(index + 1).trim());\n }\n }\n return null;\n}\n\nexport function sessionCookie(token: string, maxAgeSeconds: number): string {\n return `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAgeSeconds}`;\n}\n\nexport function clearedSessionCookie(): string {\n return `${SESSION_COOKIE}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`;\n}",[],[93],"b6a84a11-75dd-4c2b-8d71-251323feb8c8","README.md","01a0b007-082c-75f1-b566-c3540b70476c",10,["D",1789659918345],"# signup-login\n\n邮箱注册 / 登录 + 6 位验证码校验。Hono JSX 服务端渲染，SQLite 存数据，零第三方依赖。\n\n[打开应用](url:index.tsx)\n\n## 流程\n\n```mermaid\nsequenceDiagram\n participant U as 浏览器\n participant A as index.tsx\n participant D as SQLite\n participant M as std/email\n\n U->>A: POST /signup（邮箱 + 密码）\n A->>D: 建用户，密码存 PBKDF2 哈希\n A->>D: 存验证码哈希（10 分钟有效）\n A->>M: 发 6 位验证码\n A-->>U: 302 → /verify\n U->>A: POST /verify（验证码）\n A->>D: 比对哈希 → 标记邮箱已验证\n A->>D: 建会话，只存 token 的哈希\n A-->>U: 302 → / 并 Set-Cookie\n U->>A: GET /（带 cookie）\n A->>D: 用 token 哈希查会话\n A-->>U: 已登录页面\n```\n\n## 文件\n\n| 文件 | 作用 |\n| --- | --- |\n| `index.tsx` | 路由 + 页面（`/signup`、`/verify`、`/login`、`/logout`） |\n| `db.ts` | 三张表（users / login_codes / sessions）和所有查询 |\n| `auth.ts` | PBKDF2 密码哈希、验证码、会话 token、cookie 读写 |\n| `mail.ts` | 发验证码邮件 |\n| `test.ts` | 单元测试，用 `run_file` 直接跑 |\n\n跑测试：\n\n```\nrun_file(\"drmy01bsp6bi/signup-login\", \"test.ts\")\n```\n\n## 安全上的取舍\n\n- 密码用 PBKDF2-SHA256，10 万次迭代，每个用户独立随机盐。\n- 验证码和会话 token **都只存 SHA-256 哈希**。数据库泄露也拿不到能直接用的凭证。\n- 会话 cookie 带 `HttpOnly` + `Secure` + `SameSite=Lax`，30 天过期。\n- 登录失败统一提示\"邮箱或密码不对\"；邮箱不存在时也照样跑一遍哈希校验，避免用响应时间判断邮箱是否注册过。\n- 验证码：10 分钟过期、用掉即失效、错 5 次作废、30 秒冷却、每小时最多 5 次。\n- 页面只渲染文案代码（`?err=bad_code`），用户输入不会被反射回页面。\n\n## ⚠️ 免费套餐发不出邮件\n\n`std/email` 在免费账号上只能发给**本账号自己的邮箱**，日志原文：\n\n> Free tier users can only send email to themselves — leave `to`, `cc`, and `bcc` blank.\n\n所以现在这个版本：注册、验证码生成、验证、登录全都正常，只有\"把邮件投递给真实用户\"这一步会失败，页面上会明确提示。\n\n两个出路：\n\n1. **升级 Pro** —— 不用改任何代码，`mail.ts` 照旧。\n2. **换成自己的邮件服务** —— 改 `mail.ts` 里的发送实现（比如 Resend），把 API key 放进环境变量。\n\n👉 Add RESEND_API_KEY here: https://www.val.town/x/drmy01bsp6bi/signup-login/environment-variables?key=RESEND_API_KEY\n\n另外，邮件发送失败时验证码会打到日志里（`[dev] ... 的验证码是 ...`），方便你自己跑通流程。**正式上线前把 `index.tsx` 里那行 `console.log` 删掉。**\n\n## 还没做的\n\n- 忘记密码 / 重置密码\n- 改密码、改邮箱、注销账号\n- 会话管理（列出登录设备、\"退出所有设备\"）\n- CSRF token —— 目前靠 `SameSite=Lax` + 表单 POST 兜底，够用但不是零风险\n- 清理过期会话和验证码的定时任务（加一个 interval 文件即可）",[],[101],"52295a26-ce1a-43f2-a123-eb041e0d3050","public","01a0b007-082c-75f1-b566-bd26a32e0604",["D",1789659645926],"directory",[115],[109],{"_33":116,"_13":117,"_35":118,"_37":110,"_38":39,"_40":46,"_42":43,"_44":119,"_17":67,"_47":24,"_49":120,"_51":52,"_53":-5,"_70":121,"_18":122},"73520635-9bdd-4366-885e-56f63098e59a","favicon.svg","01a0b007-082c-75f1-b566-ba2006e800dd",["D",1789659645926],"\n",[],[109,117],"4b3bb8fa-4cb4-4853-aec2-dc10c1c339dc",["D",1789659645926],"deletedAt","legacyEnvVars","privacy","httpPrivacy","description","邮箱注册 + 登录 + 验证码校验，SQLite 存用户，Hono JSX 页面","imageUrl","userId","8f5f4f03-5bf7-4d70-9213-3b0f291169e6","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a0b001-2963-77e8-86ca-da7e1d5b44e5","tursoName","4b3bb8fa4cb44853aec2dc10c1c339dc","tursoHostname","4b3bb8fa4cb44853aec2dc10c1c339dc-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789660265060],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_178":173},"org",{"_11":12,"_172":173,"_174":173,"_132":133,"_175":176,"_177":52},"branch",{"_17":103,"_13":16,"_33":39,"_164":123,"_165":-5,"_166":-5,"_167":-5,"_168":-5,"_169":-5,"_170":14,"_171":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":123,"_13":14,"_44":232,"_125":-5,"_126":52,"_127":109,"_128":109,"_129":130,"_131":-5,"_132":133,"_134":36,"_135":43,"_136":-5,"_137":-5,"_138":67,"_139":140,"_141":142,"_143":144,"_145":233,"_147":-5,"_148":149,"_150":149,"_151":152,"_153":152,"_154":152,"_155":149,"_156":149,"_157":234,"_159":235,"_161":236,"_163":52},[208,210,211,212,213,214,215],"files",[208,209,210,211,212,213,214,215],"counts",{"_199":67,"_200":46,"_201":67,"_32":202,"_203":204},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":198},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches","forks",{"_205":67,"_207":67},"connections",{"_205":67,"_206":67},"count","unfilledCount","emptyCount",{"_33":108,"_13":109,"_35":110,"_37":-5,"_38":39,"_40":46,"_42":43,"_44":111,"_17":67,"_47":112,"_49":-5,"_51":52,"_53":-5,"_70":230,"_18":231},{"_33":116,"_13":117,"_35":118,"_37":110,"_38":39,"_40":46,"_42":43,"_44":119,"_17":67,"_47":24,"_49":120,"_51":52,"_53":-5,"_70":228,"_18":229},{"_33":100,"_13":101,"_35":102,"_37":-5,"_38":39,"_40":103,"_42":43,"_44":104,"_17":46,"_47":24,"_49":105,"_51":52,"_53":-5,"_70":226,"_18":227},{"_33":92,"_13":93,"_35":94,"_37":-5,"_38":39,"_40":95,"_42":43,"_44":96,"_17":67,"_47":68,"_49":97,"_51":52,"_53":-5,"_70":224,"_18":225},{"_33":84,"_13":85,"_35":86,"_37":-5,"_38":39,"_40":87,"_42":43,"_44":88,"_17":67,"_47":68,"_49":89,"_51":52,"_53":-5,"_70":222,"_18":223},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":81,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_70":220,"_18":221},{"_33":73,"_13":74,"_35":75,"_37":-5,"_38":39,"_40":76,"_42":43,"_44":77,"_17":67,"_47":68,"_49":78,"_51":52,"_53":-5,"_70":218,"_18":219},{"_33":62,"_13":63,"_35":64,"_37":-5,"_38":39,"_40":65,"_42":43,"_44":66,"_17":67,"_47":68,"_49":69,"_51":52,"_53":-5,"_70":216,"_18":217},[],[63],[],[74],[],[19],[],[85],[],[93],[],[101],[],[109,117],[209],[109],["D",1789659645926],["D",1789660265060],{"_11":12,"_178":173},{"_11":12,"_172":173,"_174":173,"_132":133,"_175":176,"_177":52},{"_17":103,"_13":16,"_33":39,"_164":123,"_165":-5,"_166":-5,"_167":-5,"_168":-5,"_169":-5,"_170":14,"_171":12},"ctx",{"_157":-5,"_195":270,"_271":272,"_273":274,"_275":52,"_276":52,"_277":52,"_278":43,"_279":-5,"_280":-7,"_281":-7,"_282":67,"_283":52,"_284":52,"_285":-5,"_286":52,"_287":52,"_288":52,"_289":-5},"ENV",{"_241":242,"_243":244,"_245":16,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]