(path: P, configure: OpenAPIObjectConfigure) => OpenAPIHono, BasePath>;\r\n// doc31:

(path: P, configure: OpenAPIObjectConfigure) => OpenAPIHono, BasePath>;\r\n// route(path: SubPath, app: Hono): OpenAPIHono> & S, BasePath>;\r\n// route(path: SubPath): Hono, BasePath>;\r\n// basePath(path: SubPath): OpenAPIHono>;\r\n// }\r\n// type RoutingPath

= P extends `${infer Head}/{${infer Param}}${infer Tail}` ? `${Head}/:${Param}${RoutingPath}` : P;\r\n// declare const createRoute:

& {\r\n// path: P;\r\n// }>(routeConfig: R) => R & {\r\n// getRoutingPath(): RoutingPath;\r\n// };\r\n\r\n// export { type DeepSimplify, type Hook, type MiddlewareToHandlerType, type OfHandlerType, OpenAPIHono, type OpenAPIHonoOptions, type OpenAPIObjectConfigure, type RouteConfig, type RouteConfigToEnv, type RouteConfigToTypedResponse, type RouteHandler, type RouteHook, createRoute };\r\n",[],[269,374,381,388],[269,374,381],{"_104":397,"_96":398,"_156":399,"_158":375,"_159":141,"_160":400,"_162":22,"_106":401,"_100":402,"_164":235,"_166":403,"_167":22,"_168":-5,"_169":404,"_99":405},"49aac1f0-5e6d-11f0-ac58-0224a6c84d84","apiGateway.ts","9fa7de4a-58a9-11f0-a135-f69ea79377d9",593,["D",1752248392877],35,"import { corsMiddleware } from \"../middleware/cors.ts\";\r\nimport { rateLimitMiddleware } from \"../middleware/rateLimit.ts\";\r\nimport { securityMiddleware } from \"../middleware/security.ts\";\r\nimport { OpenAPIHono } from \"npm:@hono/zod-openapi\";\r\nimport {\r\n createOpenAPILoader,\r\n registerOpenApiRoutes,\r\n} from \"../utils/openApiLoader.ts\";\r\nimport { globalErrorHandler } from \"../handlers/errorHandler.ts\";\r\n// ✅ NEW: Import dynamic handler system - works with ANY OpenAPI spec!\r\nimport {\r\n createDynamicHandlerMap,\r\n extractOperationIds,\r\n} from \"../handlers/dynamicHandler.ts\";\r\nimport { Database } from \"../database/database.ts\";\r\nimport { logInfo, logError } from \"../utils/logger.ts\";\r\nimport {\r\n createDebugMiddleware,\r\n initializeDebugSession,\r\n finalizeDebugSession,\r\n} from \"../middleware/debugger.ts\";\r\nimport {\r\n requestIdMiddleware,\r\n requestLoggerMiddleware,\r\n} from \"../middleware/requestLogger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { getDefaultCSRFMiddleware } from \"../middleware/csrf.ts\";\r\nimport { registerFallbackHandler } from \"../handlers/fallbackHandler.ts\";\r\n\r\ninterface AppEnv {\r\n Variables: {\r\n db: Database;\r\n debugCorrelationId: string;\r\n };\r\n}\r\n\r\nconst app = new OpenAPIHono<{ Variables: AppEnv[\"Variables\"] }>();\r\nconst db = new Database();\r\nawait db.initialize();\r\n\r\napp.onError(globalErrorHandler);\r\napp.use(\"*\", requestIdMiddleware);\r\napp.use(\"*\", createDebugMiddleware());\r\napp.use(\"*\", (c, next) => requestLoggerMiddleware(c, next));\r\n\r\napp.use(\"*\", async (c, next) => {\r\n // Attach database to context\r\n c.set(\"db\", db);\r\n\r\n // Initialize debug session with correlation ID\r\n const correlationId = initializeDebugSession(c.req.raw);\r\n c.set(\"debugCorrelationId\", correlationId);\r\n\r\n return await next();\r\n});\r\n\r\napp.use(\"*\", async (c, next) => {\r\n const correlationId = c.get(\"debugCorrelationId\") as string | undefined;\r\n const cors = corsMiddleware(c.req.raw, correlationId);\r\n if (cors) return cors;\r\n return await next();\r\n});\r\napp.use(\"*\", async (c, next) => {\r\n const correlationId = c.get(\"debugCorrelationId\") as string | undefined;\r\n const sec = securityMiddleware(c.req.raw, correlationId);\r\n if (sec) return sec;\r\n return await next();\r\n});\r\napp.use(\"*\", async (c, next) => {\r\n const correlationId = c.get(\"debugCorrelationId\") as string | undefined;\r\n const rate = rateLimitMiddleware(c.req.raw, correlationId);\r\n if (rate) return rate;\r\n return await next();\r\n});\r\napp.use(\"*\", async (c, next) => {\r\n const correlationId = c.get(\"debugCorrelationId\") as string | undefined;\r\n const csrfMiddleware = getDefaultCSRFMiddleware(correlationId);\r\n return await csrfMiddleware(c, next);\r\n});\r\n\r\n// Load OpenAPI spec and register routes with automatic schema validation enabled\r\n// This provides automatic request/response validation against the OpenAPI specification\r\nlet loader: any = null;\r\nlet loaderError: Error | null = null;\r\n\r\ntry {\r\n loader = await createOpenAPILoader(\r\n undefined, // Will use environment config\r\n true, // Enable validation\r\n {\r\n // Override with specific options if needed\r\n blobKey: environment.OPENAPI_BLOB_KEY,\r\n }\r\n );\r\n logInfo(\"✅ OpenAPI loader created successfully\");\r\n} catch (error) {\r\n loaderError = error;\r\n logError(`❌ Failed to create OpenAPI loader: ${error}`);\r\n\r\n // Use the fallback handler when loader fails\r\n registerFallbackHandler(app, loaderError);\r\n}\r\n\r\n// Only proceed with route registration if loader was successful\r\nif (loader) {\r\n // 🚀 TRULY DYNAMIC: Automatically create handlers for ANY OpenAPI spec!\r\n // Extract all operationIds from the OpenAPI specification\r\n const openApiSpec = loader.getSpec();\r\n const operationIds = extractOperationIds(openApiSpec);\r\n\r\n logInfo(\r\n `🎯 Found ${\r\n operationIds.length\r\n } operations in OpenAPI spec: ${operationIds.join(\", \")}`\r\n );\r\n\r\n // Automatically generate handler map for ALL operations\r\n // This works with ANY OpenAPI file - no manual mapping needed!\r\n const handlerMap = createDynamicHandlerMap(operationIds);\r\n\r\n try {\r\n logInfo(\"About to register OpenAPI routes...\");\r\n registerOpenApiRoutes(app as any, loader, handlerMap);\r\n logInfo(\"OpenAPI routes registered successfully\");\r\n logInfo(\r\n `✅ Schema validation ${\r\n loader.isSchemaValidationEnabled() ? \"enabled\" : \"disabled\"\r\n } for all routes`\r\n );\r\n\r\n // Display startup info only if loader is successful\r\n loader.displayStartupInfo();\r\n } catch (error) {\r\n console.error(\"Error registering OpenAPI routes:\", error);\r\n throw error;\r\n }\r\n}\r\n\r\n// Add debug finalization middleware that runs after all routes\r\napp.use(\"*\", async (c, next) => {\r\n await next();\r\n\r\n // Finalize debug session after response is ready\r\n const correlationId = c.get(\"debugCorrelationId\") as string | undefined;\r\n if (correlationId && c.res) {\r\n finalizeDebugSession(correlationId, c.req.raw, c.res);\r\n }\r\n});\r\n\r\n// Export for Val Town HTTP trigger\r\nexport default app.fetch;\r\n",[],[269,374,398],[269,374],{"_104":408,"_96":409,"_156":410,"_158":270,"_159":141,"_160":314,"_162":118,"_106":411,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":412,"_99":551},"9e69c58e-58a9-11f0-b6a5-f69ea79377d9","handlers","9e69c64c-58a9-11f0-b6a5-f69ea79377d9",["D",1751614597888],[413,466,476,485,495,504,513,522,532,542],{"_104":414,"_96":415,"_156":416,"_158":410,"_159":141,"_160":417,"_162":22,"_106":418,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":419,"_99":465},"81fc4d50-5f4c-11f0-b4f8-0224a6c84d84","OldFiles","81fc4de6-5f4c-11f0-b4f8-0224a6c84d84",627,["D",1752344265139],[420,429,438,447,456],{"_104":421,"_96":422,"_156":423,"_158":416,"_159":141,"_160":424,"_162":22,"_106":425,"_100":32,"_164":235,"_166":426,"_167":22,"_168":-5,"_169":427,"_99":428},"825885c0-5f4c-11f0-b8a0-0224a6c84d84","old.adminHandler.ts","8258866a-5f4c-11f0-b8a0-0224a6c84d84",632,["D",1752344265742],"// /**\n// * Admin Handler - implements admin-only endpoints for shareable link flow\n// * Payment Handler - Updated to match OpenAPI specification and SOLUTION.md\n// * Implements the two-step nonce-gating system with CSRF and Turnstile protection\n// * POST /api/v1/admin/generate-pay-token\n// * GET /api/v1/booking/{token}\n// * POST /api/v1/create-booking\n// * POST /api/v1/create-nonce\n// * POST /api/v1/payment/exchange-nonce\n// * POST /api/v1/payment/callback\n// */\n// import { Database } from \"../database/database.ts\";\n// import { TOURS } from \"../data/tours.ts\";\n// import { createTokenBasedCSRFSession } from \"../middleware/csrf.ts\";\n// import { setCSRFCookies } from \"../utils/cookies.ts\";\n// import { addCorsHeaders } from \"../middleware/cors.ts\";\n// import { logger } from \"../utils/logger.ts\";\n// import { ValidationService } from \"../services/validationService.ts\";\n// import { AuthService } from \"../services/authService.ts\";\n// import { PaymentFingerprintService } from \"../services/zenpayFingerprintService.ts\";\n// import { TurnstileService } from \"../services/turnstileService.ts\";\n// import { tokenBasedCSRFProtection } from \"../middleware/csrf.ts\";\n// import { logSecurityCheck } from \"../middleware/debugger.ts\";\n// import {\n// generatePayToken,\n// generateNonce,\n// generateUUID,\n// } from \"../utils/crypto.ts\";\n\n// export interface BookingInfo {\n// id: string;\n// title: string;\n// description: string;\n// amount: number;\n// currency: string;\n// status: string;\n// }\n\n// export interface PayTokenValidationResult {\n// valid: boolean;\n// bookingId?: string;\n// error?: string;\n// }\n\n// /**\n// * Creates a booking row from a tour id\n// * Returns the new booking id so the frontend can keep using it\n// */\n// async function createBookingForTour(\n// db: Database,\n// tourId: string\n// ): Promise {\n// const tour = TOURS.find((t) => t.tourId === tourId);\n// if (!tour) throw new Error(\"Unknown tour id\");\n// const bookingId = generateUUID();\n// await db.execute(\n// `INSERT INTO app_tp_booking_orders\n// (id, title, description, amount, currency, status, tour_code, pax_count, due_date)\n// VALUES (?, ?, ?, ?, ?, ?, ?, ?, date('now', '+30 days'))`,\n// [\n// bookingId,\n// tour.tourId,\n// tour.title,\n// tour.description,\n// tour.duration,\n// tour.datesAvailable,\n// tour.price,\n// tour.currency,\n// tour.heroImageUrl,\n// tour.gallery,\n// tour.inclusions,\n// tour.exclusions,\n// tour.callToAction,\n// tour.payNowEnabled,\n// tour.name,\n// tour.meta,\n// \"pending\",\n// ]\n// );\n// return bookingId;\n// }\n\n// /**\n// * Utility functions for token generation and management\n// */\n\n// /**\n// * Generates a new pay token (one-time access token)\n// * Returns a 22-character URL-safe base64 string\n// * Now uses centralized crypto utilities\n// * @returns 22-character URL-safe token\n// */\n// export function newPayToken(): string {\n// return generatePayToken();\n// }\n\n// class AdminHandler {\n// /**\n// * POST /api/v1/create-nonce\n// * Step 1: Generate a single-use, 60-second nonce after security validation\n// * Security: CSRF protection + Turnstile + Rate limiting\n// */\n// async createNonce(\n// request: Request,\n// db: Database,\n// correlationId?: string\n// ): Promise {\n// try {\n// const ip =\n// request.headers.get(\"cf-connecting-ip\") ||\n// request.headers.get(\"x-forwarded-for\") ||\n// \"unknown\";\n// const origin = request.headers.get(\"origin\") || \"\";\n\n// // 1. CSRF Protection (validates X-XSRF-TOKEN header against SESSION cookie)\n// const csrfError = tokenBasedCSRFProtection(request);\n// if (csrfError) {\n// return addCorsHeaders(csrfError, origin);\n// }\n\n// // 2. Parse and validate request body\n// let body: any;\n// try {\n// body = await request.json();\n// } catch (error) {\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: `Invalid JSON body ${error.message}` }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// const { tourId, cfToken, email_verify } = body;\n\n// // 3. Honeypot bot detection (before Turnstile validation)\n// const honeypotPresent = \"email_verify\" in body;\n// const honeypotValid = email_verify === \"🍯\";\n\n// if (!honeypotPresent) {\n// // Field missing - sophisticated bot possible\n// if (correlationId) {\n// logSecurityCheck(\n// correlationId,\n// \"Honeypot Bot Detection\",\n// \"Honeypot field missing - suspicious\",\n// false,\n// {\n// field_missing: true,\n// ip,\n// user_agent: request.headers.get(\"user-agent\")?.substring(0, 50),\n// }\n// );\n// }\n// // Continue with caution - could be legitimate frontend issue\n// } else if (!honeypotValid) {\n// // Field present but wrong value - definite bot\n// if (correlationId) {\n// logSecurityCheck(\n// correlationId,\n// \"Honeypot Bot Detection\",\n// \"Bot detected via invalid honeypot value\",\n// false,\n// {\n// honeypot_value: email_verify?.substring(0, 10),\n// ip,\n// user_agent: request.headers.get(\"user-agent\")?.substring(0, 50),\n// }\n// );\n// }\n// // Return fake nonce to waste bot resources\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// nonce: `fake_${generateNonce().substring(0, 32)}`,\n// expiresAt: new Date(Date.now() + 60000).toISOString(),\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// } else {\n// // Field present with correct emoji - human user\n// if (correlationId) {\n// logSecurityCheck(\n// correlationId,\n// \"Honeypot Bot Detection\",\n// \"Human user verified - honeypot valid\",\n// true,\n// { ip }\n// );\n// }\n// }\n\n// // 4. Validate required fields\n// if (!tourId || !cfToken) {\n// logger.warn(\"Missing required fields in nonce request\", {\n// ip,\n// tourId: !!tourId,\n// cfToken: !!cfToken,\n// });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// error: \"Missing required fields: tourId and cfToken are required\",\n// }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 5. Validate Turnstile token (bot protection)\n// const turnstileValidation = await TurnstileService.validateToken(\n// cfToken,\n// ip\n// );\n// if (!turnstileValidation.valid) {\n// logger.warn(\"Turnstile validation failed in nonce request\", {\n// ip,\n// error: turnstileValidation.error,\n// });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// error: \"Bot detection failed\",\n// details: turnstileValidation.error,\n// }),\n// {\n// status: 403,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 5. Generate cryptographically secure nonce\n// const nonce = generateNonce();\n\n// const issuedAt = new Date().toISOString();\n// const expiresAt = new Date(Date.now() + 60 * 1000).toISOString(); // 60 seconds TTL\n\n// // 6. Store nonce in database\n// await db.execute(\n// `\n// INSERT INTO app_payment_nonces\n// (nonce, booking_id, ip_address, issued_at, expires_at, used)\n// VALUES (?, ?, ?, ?, ?, 0)\n// `,\n// [nonce, tourId, ip, issuedAt, expiresAt]\n// );\n\n// logger.info(\"Payment nonce created\", {\n// tourId,\n// ip,\n// nonce: nonce.substring(0, 8) + \"...\",\n// expiresAt,\n// });\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// nonce,\n// expiresIn: 60,\n// }),\n// {\n// status: 200,\n// headers: {\n// \"Content-Type\": \"application/json\",\n// \"RateLimit-Limit\": \"10\",\n// \"RateLimit-Remaining\": \"9\",\n// \"RateLimit-Reset\": \"60\",\n// },\n// }\n// ),\n// origin\n// );\n// } catch (error) {\n// logger.error(\"Error creating payment nonce\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n\n// /**\n// * POST /api/v1/payment/exchange-nonce\n// * Step 2: Exchange valid nonce for payment fingerprint\n// * Security: Nonce validation + Atomic consumption\n// */\n// async exchangeNonce(request: Request, db: Database): Promise {\n// try {\n// const ip =\n// request.headers.get(\"cf-connecting-ip\") ||\n// request.headers.get(\"x-forwarded-for\") ||\n// \"unknown\";\n// const nonce = request.headers.get(\"X-Payment-Nonce\");\n// const origin = request.headers.get(\"origin\") || \"\";\n\n// // 1. Validate nonce header\n// if (!nonce) {\n// logger.warn(\"Missing X-Payment-Nonce header\", { ip });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: \"X-Payment-Nonce header required\" }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 2. Parse and validate request body\n// let body: any;\n// try {\n// body = await request.json();\n// } catch (error) {\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: `Invalid JSON body ${error.message}` }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// const {\n// apiKey,\n// mode,\n// paymentAmount,\n// merchantUniquePaymentId,\n// timestamp,\n// } = body;\n\n// // 3. Validate required payment fields\n// const requiredFields = [\n// \"apiKey\",\n// \"mode\",\n// \"paymentAmount\",\n// \"merchantUniquePaymentId\",\n// \"timestamp\",\n// ];\n// const missingFields = requiredFields.filter((field) => !body[field]);\n\n// if (missingFields.length > 0) {\n// logger.warn(\"Missing required payment fields\", { ip, missingFields });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// error: \"Missing required fields\",\n// details: missingFields,\n// }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 4. Atomically validate and consume nonce\n// const result = await db.execute(\n// `\n// UPDATE app_payment_nonces\n// SET used = 1\n// WHERE nonce = ?\n// AND ip_address = ?\n// AND used = 0\n// AND expires_at > datetime('now')\n// `,\n// [nonce, ip]\n// );\n\n// if (result.rowsAffected === 0) {\n// logger.warn(\n// \"Nonce validation failed - invalid, expired, or already used\",\n// {\n// ip,\n// nonce: nonce.substring(0, 8) + \"...\",\n// }\n// );\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// error: \"Invalid, expired, or already used nonce\",\n// }),\n// {\n// status: 401,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 5. Generate payment fingerprint using server-side secrets\n// const username = Deno.env.get(\"ZP_USERNAME\");\n// const password = Deno.env.get(\"ZP_PASSWORD\");\n\n// if (!username || !password) {\n// logger.error(\"Payment credentials not configured\");\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: \"Payment system not configured\" }),\n// {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 6. Create fingerprint payload (secrets added server-side, never exposed)\n// const paymentHashRequest = {\n// apikey: apiKey,\n// mode,\n// paymentAmount,\n// merchantUniquePaymentId,\n// timestamp,\n// };\n// const fingerprint =\n// PaymentFingerprintService.generatePaymentHash(\n// paymentHashRequest\n// ).fingerprint;\n\n// logger.info(\"Payment fingerprint generated\", {\n// merchantUniquePaymentId,\n// paymentAmount,\n// mode,\n// nonce: nonce.substring(0, 8) + \"...\",\n// ip,\n// });\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// fingerprint,\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// } catch (error) {\n// logger.error(\"Error exchanging nonce for fingerprint\", {\n// error: error.message,\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n\n// /**\n// * POST /api/v1/payment/callback\n// * Handles payment confirmation from Zenpay gateway\n// * Security: ValidationCode verification (SHA3-512 hash verification)\n// */\n// async handlePaymentCallback(\n// request: Request,\n// db: Database\n// ): Promise {\n// try {\n// // 1. Parse callback payload from Zenpay\n// let body: any;\n// try {\n// body = await request.json();\n// } catch (error) {\n// logger.error(\"Invalid callback payload\", { error: error.message });\n// return new Response(JSON.stringify({ error: \"Invalid JSON\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// });\n// }\n\n// const {\n// apiKey,\n// mode,\n// paymentAmount,\n// merchantUniquePaymentId,\n// reference,\n// ValidationCode,\n// PaymentStatus,\n// timestamp,\n// } = body;\n\n// // 2. Validate required callback fields\n// const requiredFields = [\n// \"apiKey\",\n// \"mode\",\n// \"paymentAmount\",\n// \"merchantUniquePaymentId\",\n// \"reference\",\n// \"ValidationCode\",\n// ];\n// const missingFields = requiredFields.filter((field) => !body[field]);\n\n// if (missingFields.length > 0) {\n// logger.error(\"Invalid callback payload - missing fields\", {\n// missingFields,\n// });\n// return new Response(JSON.stringify({ error: \"Invalid callback\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// });\n// }\n\n// // 3. Verify ValidationCode (callback authentication)\n// const expectedPaymentHashRequest = {\n// apikey: apiKey,\n// mode,\n// paymentAmount,\n// merchantUniquePaymentId: reference, // reference is used for callback validation\n// timestamp: timestamp, // ensure timestamp is available in the callback body\n// };\n// const expectedValidationCode =\n// PaymentFingerprintService.generatePaymentHash(\n// expectedPaymentHashRequest\n// ).fingerprint;\n\n// if (expectedValidationCode !== ValidationCode) {\n// logger.error(\"CRITICAL: Invalid ValidationCode in callback\", {\n// merchantUniquePaymentId,\n// expected: expectedValidationCode.substring(0, 10) + \"...\",\n// received: ValidationCode.substring(0, 10) + \"...\",\n// });\n// return new Response(\n// JSON.stringify({ error: \"Invalid callback authentication\" }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// );\n// }\n\n// // 4. Update booking status based on payment result\n// const bookingStatus = PaymentStatus === 3 ? \"paid\" : \"failed\";\n\n// await db.execute(\n// `\n// UPDATE app_tp_booking_orders\n// SET status = ?, updated_at = datetime('now')\n// WHERE id = ?\n// `,\n// [bookingStatus, merchantUniquePaymentId]\n// );\n\n// logger.info(\"Payment callback processed\", {\n// merchantUniquePaymentId,\n// paymentStatus: PaymentStatus,\n// bookingStatus,\n// validationCodeValid: true,\n// });\n\n// return new Response(null, { status: 204 });\n// } catch (error) {\n// logger.error(\"Error processing payment callback\", {\n// error: error.message,\n// });\n// return new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// });\n// }\n// }\n\n// /**\n// * Validates and consumes a pay token (atomic operation)\n// * GET /x/:payToken or similar pay token validation endpoint\n// */\n// async validatePayToken(request: Request, db: Database): Promise {\n// try {\n// const url = new URL(request.url);\n// const pathParts = url.pathname.split(\"/\");\n// const payToken = pathParts[pathParts.length - 1];\n\n// // Get client IP\n// const ip =\n// request.headers.get(\"cf-connecting-ip\") ||\n// request.headers.get(\"x-forwarded-for\") ||\n// request.headers.get(\"x-real-ip\") ||\n// \"unknown\";\n\n// logger.info(\"Pay token validation attempt\", {\n// token: payToken.substring(0, 8) + \"...\",\n// ip,\n// });\n\n// // Atomic UPDATE to consume token (race-safe)\n// const result = await db.execute(\n// `UPDATE app_pay_tokens\n// SET used = 1,\n// last_ip = ?\n// WHERE token = ?\n// AND used = 0\n// AND expires_at > datetime('now')`,\n// [ip, payToken]\n// );\n\n// if (result.rowsAffected === 0) {\n// logger.warn(\"Invalid or expired pay token\", {\n// token: payToken.substring(0, 8) + \"...\",\n// ip,\n// });\n\n// return new Response(\"Link expired or already used\", {\n// status: 410,\n// headers: { \"Content-Type\": \"text/plain\" },\n// });\n// }\n\n// // Get booking ID for the validated token\n// const tokenData = await db.query(\n// `SELECT booking_id FROM app_pay_tokens WHERE token = ?`,\n// [payToken]\n// );\n\n// if (!tokenData || tokenData.length === 0) {\n// return new Response(\"Token not found\", {\n// status: 404,\n// headers: { \"Content-Type\": \"text/plain\" },\n// });\n// }\n\n// const bookingId = tokenData[0].booking_id;\n// logger.info(\"Pay token validated successfully\", { bookingId, ip });\n\n// // TODO: Set session cookies and redirect to payment page\n// // For now, return success response\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// success: true,\n// bookingId,\n// message: \"Token validated successfully\",\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// request.headers.get(\"origin\") || undefined\n// );\n// } catch (error) {\n// logger.error(\"Error validating pay token\", { error: error.message });\n// return new Response(\"Internal server error\", {\n// status: 500,\n// headers: { \"Content-Type\": \"text/plain\" },\n// });\n// }\n// }\n\n// /**\n// * Creates a new pay token for a booking\n// * This would typically be called by admin or after booking creation\n// */\n// async createPayToken(bookingId: string, db: Database): Promise {\n// const token = newPayToken();\n// const issuedAt = new Date().toISOString();\n// const expiresAt = new Date(\n// Date.now() + 10 * 24 * 60 * 60 * 1000\n// ).toISOString(); // 10 days\n\n// await db.execute(\n// `INSERT INTO app_pay_tokens (token, booking_id, issued_at, expires_at)\n// VALUES (?, ?, ?, ?)`,\n// [token, bookingId, issuedAt, expiresAt]\n// );\n\n// logger.info(\"Pay token created\", {\n// token: token.substring(0, 8) + \"...\",\n// bookingId,\n// expiresAt,\n// });\n\n// return token;\n// }\n\n// /**\n// * POST /api/v1/create-booking\n// * body: { \"tourId\": \"tour-paris-explorer\" }\n// * returns: { bookingId }\n// */\n// async createBooking(request: Request, db: Database): Promise {\n// try {\n// const origin = request.headers.get(\"origin\") || \"\";\n// const { tourId } = await request.json();\n\n// if (!tourId) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"tourId required\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// const bookingId = await createBookingForTour(db, tourId);\n\n// logger.info(\"Booking created from tour\", { tourId, bookingId });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ success: true, bookingId }), {\n// status: 201,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// } catch (err) {\n// logger.error(\"Failed to create booking\", { error: err.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n// /**\n// * POST /api/v1/admin/generate-pay-token\n// * Admin-only endpoint to create secure, single-use tokens for shareable links\n// * Security: API Key authentication\n// */\n// async generatePayToken(request: Request, db: Database): Promise {\n// try {\n// const origin = request.headers.get(\"origin\") || \"\";\n\n// // 1. Validate API Key authentication\n// const authHeader = request.headers.get(\"Authorization\");\n// if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n// logger.warn(\"Missing or invalid Authorization header\", {\n// ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\",\n// });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: \"Authorization header required\" }),\n// {\n// status: 401,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// const providedKey = authHeader.substring(7); // Remove \"Bearer \"\n// const expectedKey = Deno.env.get(\"MASTER_KEY\");\n\n// if (!expectedKey || providedKey !== expectedKey) {\n// logger.warn(\"Invalid admin API key\", {\n// ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\",\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid API key\" }), {\n// status: 401,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // 2. Parse and validate request body\n// let body: any;\n// try {\n// body = await request.json();\n// } catch (error) {\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: `Invalid JSON body ${error.message}` }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// const { bookingId } = body;\n\n// if (!bookingId) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"bookingId required\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // 3. Validate booking exists\n// const booking = await db.queryOne(\n// \"SELECT id, title FROM app_tp_booking_orders WHERE id = ?\",\n// [bookingId]\n// );\n\n// if (!booking) {\n// logger.warn(\"Booking not found for pay token generation\", {\n// bookingId,\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Booking not found\" }), {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // 4. Generate secure pay token\n// const token = generateNonce();\n\n// const issuedAt = new Date().toISOString();\n// const expiresAt = new Date(\n// Date.now() + 14 * 24 * 60 * 60 * 1000\n// ).toISOString(); // 14 days\n\n// // 5. Store pay token in database\n// await db.execute(\n// `\n// INSERT INTO app_pay_tokens\n// (token, booking_id, issued_at, expires_at, used)\n// VALUES (?, ?, ?, ?, 0)\n// `,\n// [token, bookingId, issuedAt, expiresAt]\n// );\n\n// const shareableUrl = `${\n// request.url.split(\"/api/\")[0]\n// }/api/v1/booking/${token}`;\n\n// logger.info(\"Pay token generated\", {\n// bookingId,\n// token: token.substring(0, 8) + \"...\",\n// expiresAt,\n// admin: true,\n// });\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// shareableUrl,\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// } catch (error) {\n// logger.error(\"Error generating pay token\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n\n// /**\n// * GET /api/v1/booking/{token}\n// * Get booking information using secure token-based authentication\n// * Industry standard: URL path contains token, not booking ID for security\n// * Also handles single-use pay token validation for shareable link flow\n// */\n// async getBookingDetails(request: Request, db: Database): Promise {\n// try {\n// const url = new URL(request.url);\n// const pathParts = url.pathname.split(\"/\");\n// const token = pathParts[pathParts.length - 1]; // Extract token from URL\n// const origin = request.headers.get(\"origin\") || \"\";\n\n// // 1. Validate token format\n// if (!token || token === \"\" || token.length < 32) {\n// logger.warn(\"Invalid or missing booking token\", {\n// token: token?.substring(0, 8) + \"...\" || \"missing\",\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid booking token\" }), {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // 2. Validate and consume pay token (single-use)\n// const tokenData = await db.queryOne(\n// `\n// SELECT booking_id, expires_at, used\n// FROM app_pay_tokens\n// WHERE token = ?\n// `,\n// [token]\n// );\n\n// if (!tokenData) {\n// logger.warn(\"Pay token not found\", {\n// token: token.substring(0, 8) + \"...\",\n// });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// error: \"Token not found, expired, or already used\",\n// }),\n// {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 3. Check if token is expired or already used\n// const now = new Date();\n// const expiresAt = new Date(tokenData.expires_at);\n\n// if (now > expiresAt || tokenData.used === 1) {\n// logger.warn(\"Pay token expired or already used\", {\n// token: token.substring(0, 8) + \"...\",\n// expired: now > expiresAt,\n// used: tokenData.used === 1,\n// });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// error: \"Token not found, expired, or already used\",\n// }),\n// {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 4. Mark token as used (single-use enforcement)\n// await db.execute(\n// `\n// UPDATE app_pay_tokens\n// SET used = 1\n// WHERE token = ?\n// `,\n// [token]\n// );\n\n// // 5. Get booking details\n// const booking = await db.queryOne(\n// `\n// SELECT id, title, tour_code, amount, currency, status, description\n// FROM app_tp_booking_orders\n// WHERE id = ?\n// `,\n// [tokenData.booking_id]\n// );\n\n// if (!booking) {\n// logger.error(\"Booking not found for valid token\", {\n// bookingId: tokenData.booking_id,\n// token: token.substring(0, 8) + \"...\",\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Booking not found\" }), {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // 6. Find matching tour data for complete details\n// const tour = TOURS.find((t) => t.meta?.code === booking.tour_code);\n// if (!tour) {\n// logger.warn(\"Tour data not found for booking\", {\n// tourCode: booking.tour_code,\n// bookingId: booking.id,\n// });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: \"Tour information not available\" }),\n// {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// // 7. Create CSRF session for cookie seeding (same as tour endpoint)\n// const csrfSession = createTokenBasedCSRFSession();\n\n// // 8. Prepare response matching OpenAPI schema\n// const bookingResponse = {\n// bookingId: booking.id,\n// tourId: tour.tourId,\n// customerName: \"Customer\", // This would come from booking data in production\n// status: booking.status,\n// tour: {\n// title: tour.title,\n// description: tour.description,\n// duration: tour.duration,\n// datesAvailable: tour.datesAvailable,\n// price: tour.price,\n// currency: tour.currency,\n// heroImageUrl: tour.heroImageUrl,\n// gallery: tour.gallery,\n// inclusions: tour.inclusions,\n// exclusions: tour.exclusions,\n// },\n// };\n\n// // 9. Create response with security headers\n// const response = new Response(JSON.stringify(bookingResponse), {\n// status: 200,\n// headers: {\n// \"Content-Type\": \"application/json\",\n// \"Strict-Transport-Security\":\n// \"max-age=31536000; includeSubDomains; preload\",\n// \"Content-Security-Policy\":\n// \"default-src 'self'; script-src 'self' https://challenges.cloudflare.com https://payuat.travelpay.com.au; style-src 'self' https://payuat.travelpay.com.au;\",\n// },\n// });\n\n// // 10. Set CSRF cookies (SESSION and XSRF-TOKEN)\n// const responseWithCookies = setCSRFCookies(response, csrfSession);\n\n// logger.info(\"Booking details served via pay token\", {\n// bookingId: booking.id,\n// tourCode: booking.tour_code,\n// token: token.substring(0, 8) + \"...\",\n// sessionId: csrfSession.sessionId.substring(0, 8) + \"...\",\n// });\n\n// return addCorsHeaders(responseWithCookies, origin);\n// } catch (error) {\n// logger.error(\"Error serving booking details\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n\n// /**\n// * Alternative booking retrieval using AuthService validation\n// * Used when we need to support both pay tokens and regular booking tokens\n// */\n// async getBooking(request: Request, db: Database): Promise {\n// try {\n// const url = new URL(request.url);\n// const pathParts = url.pathname.split(\"/\");\n// const token = pathParts[pathParts.length - 1]; // Extract token from /api/v1/booking/:token\n\n// // Handle missing token (path ends with booking/)\n// if (!token || token === \"\") {\n// logger.warn(\"Missing booking token in path\");\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Route not found\" }), {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Validate token format\n// if (token.length < 32) {\n// logger.warn(\"Invalid booking token format\", {\n// token: token?.substring(0, 8) + \"...\",\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid booking token\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Validate booking token\n// const tokenValidation = await AuthService.validateBookingToken(db, token);\n// if (!tokenValidation.valid) {\n// logger.warn(\"Invalid or expired booking token\", {\n// token: token.substring(0, 8) + \"...\",\n// error: tokenValidation.error,\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: tokenValidation.error }), {\n// status: 401,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Query booking from database using validated booking ID\n// const booking = await db.queryOne(\"SELECT * FROM bookings WHERE id = ?\", [\n// tokenValidation.bookingId,\n// ]);\n\n// if (!booking) {\n// logger.warn(\"Booking not found\", {\n// bookingId: tokenValidation.bookingId,\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Booking not found\" }), {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Prepare booking response (no PII exposure)\n// const bookingInfo: BookingInfo = {\n// id: booking.id,\n// title: booking.title,\n// description: booking.description || \"\",\n// amount: parseFloat(booking.amount),\n// currency: booking.currency || \"USD\",\n// status: booking.status || \"pending\",\n// };\n\n// logger.info(\"Booking retrieved successfully\", {\n// bookingId: tokenValidation.bookingId,\n// token: token.substring(0, 8) + \"...\",\n// });\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// success: true,\n// booking: bookingInfo,\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// request.headers.get(\"origin\") || undefined\n// );\n// } catch (error) {\n// logger.error(\"Error retrieving booking\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n\n// /**\n// * Generate a new booking token for sharing (admin/API use)\n// */\n// async generateBookingToken(\n// request: Request,\n// db: Database\n// ): Promise {\n// try {\n// // First parse and validate the request body\n// let body: any;\n// try {\n// body = await request.json();\n// } catch (error) {\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: `Invalid JSON body: ${error.message}` }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Check if nonce is present in the body\n// if (!body.nonce) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Missing nonce parameter\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Validate nonce format\n// if (\n// typeof body.nonce !== \"string\" ||\n// body.nonce.length !== 64 ||\n// !/^[0-9a-f]+$/i.test(body.nonce)\n// ) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid nonce format\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Now validate API key for token generation\n// const apiValidation = AuthService.validateApiKey(request);\n// if (!apiValidation.valid) {\n// logger.warn(\"Unauthorized token generation attempt\", {\n// ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// error: apiValidation.error,\n// });\n\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: apiValidation.error }), {\n// status: 401,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// const { bookingId } = body;\n\n// // Validate booking exists\n// const validation = ValidationService.validateBookingId(bookingId);\n// if (!validation.valid) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: validation.error }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// const booking = await db.queryOne(\n// \"SELECT id FROM bookings WHERE id = ?\",\n// [bookingId]\n// );\n// if (!booking) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Booking not found\" }), {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n\n// // Generate booking token\n// const token = await AuthService.createBookingToken(\n// db,\n// bookingId,\n// request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// request.headers.get(\"user-agent\") || undefined\n// );\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// success: true,\n// token,\n// bookingId,\n// shareableUrl: `/booking/${token}`,\n// expiresIn: 24 * 60 * 60, // 24 hours in seconds\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// request.headers.get(\"origin\") || undefined\n// );\n// } catch (error) {\n// logger.error(\"Error generating booking token\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n// }\n\n// export const adminHandler = new AdminHandler();\n// export const bookingHandler = adminHandler; // Alias for backwards compatibility\n// export const newPaymentHandler = adminHandler; // Alias for payment handlers\n",[],[269,409,415,422],{"_104":430,"_96":431,"_156":432,"_158":416,"_159":141,"_160":433,"_162":22,"_106":434,"_100":32,"_164":235,"_166":435,"_167":22,"_168":-5,"_169":436,"_99":437},"82647f24-5f4c-11f0-a1d1-0224a6c84d84","old.apiHandlers.ts","82648046-5f4c-11f0-a1d1-0224a6c84d84",633,["D",1752344265818],"// /**\r\n// * API Handlers with Automatic OpenAPI Validation\r\n// *\r\n// * These handlers receive pre-validated data from the OpenAPI loader.\r\n// * NO manual validation needed - OpenAPI does it automatically!\r\n// */\r\n\r\n// import type {\r\n// CreateNonceRequest,\r\n// NonceResponse,\r\n// ExchangeNonceRequest,\r\n// FingerprintResponse,\r\n// ZenpayCallbackPayload,\r\n// AppContext,\r\n// } from \"../types/generated.ts\";\r\n// import { Database } from \"../database/database.ts\";\r\n// import { TOURS } from \"../data/tours.ts\";\r\n// import { generateNonce } from \"../utils/crypto.ts\";\r\n// import { TurnstileService } from \"../services/turnstileService.ts\";\r\n// import { PaymentFingerprintService } from \"../services/zenpayFingerprintService.ts\";\r\n// import { logger } from \"../utils/logger.ts\";\r\n// import { createTokenBasedCSRFSession } from \"../middleware/csrf.ts\";\r\n// import { setCSRFCookies } from \"../utils/cookies.ts\";\r\n// import { environment } from \"../config/environment.ts\";\r\n\r\n// // ========================================\r\n// // Payment Flow Handlers\r\n// // ========================================\r\n\r\n// /**\r\n// * POST /api/v1/create-nonce\r\n// *\r\n// * ✅ Automatic validation: CreateNonceRequest schema\r\n// * ✅ Auto-generated response: NonceResponse schema\r\n// * ❌ NO manual validation needed!\r\n// */\r\n// export async function createNonce(c: AppContext): Promise {\r\n// // ✅ Request is already validated by OpenAPI middleware!\r\n// const { tourId, cfToken, email_verify } =\r\n// (await c.req.json()) as CreateNonceRequest;\r\n// const db = c.get(\"db\");\r\n// const correlationId = c.get(\"debugCorrelationId\");\r\n\r\n// try {\r\n// const ip =\r\n// c.req.header(\"cf-connecting-ip\") ||\r\n// c.req.header(\"x-forwarded-for\") ||\r\n// \"unknown\";\r\n\r\n// // 1. Honeypot bot detection\r\n// const honeypotPresent = \"email_verify\" in (await c.req.json());\r\n// const honeypotValid = email_verify === \"🍯\";\r\n\r\n// if (!honeypotPresent || !honeypotValid) {\r\n// // Return fake nonce to waste bot resources\r\n// const fakeNonce = `fake_${generateNonce().substring(0, 32)}`;\r\n\r\n// const response: NonceResponse = {\r\n// nonce: fakeNonce,\r\n// expiresIn: 60,\r\n// };\r\n\r\n// return c.json(response);\r\n// }\r\n\r\n// // 2. Validate Turnstile token (bot protection)\r\n// const turnstileValidation = await TurnstileService.validateToken(\r\n// cfToken,\r\n// ip\r\n// );\r\n// if (!turnstileValidation.valid) {\r\n// return c.json(\r\n// {\r\n// error: \"Bot detection failed\",\r\n// details: turnstileValidation.error,\r\n// },\r\n// 403\r\n// );\r\n// }\r\n\r\n// // 3. Generate secure nonce\r\n// const nonce = generateNonce();\r\n// const issuedAt = new Date().toISOString();\r\n// const expiresAt = new Date(Date.now() + 60 * 1000).toISOString(); // 60 seconds TTL\r\n\r\n// // 4. Store nonce in database\r\n// await db.execute(\r\n// `INSERT INTO app_payment_nonces\r\n// (nonce, booking_id, ip_address, issued_at, expires_at, used)\r\n// VALUES (?, ?, ?, ?, ?, 0)`,\r\n// [nonce, tourId, ip, issuedAt, expiresAt]\r\n// );\r\n\r\n// logger.info(\"Payment nonce created\", {\r\n// tourId,\r\n// ip,\r\n// nonce: nonce.substring(0, 8) + \"...\",\r\n// expiresAt,\r\n// });\r\n\r\n// // ✅ Response matches NonceResponse schema automatically!\r\n// const response: NonceResponse = {\r\n// nonce,\r\n// expiresIn: 60,\r\n// };\r\n\r\n// return c.json(response);\r\n// } catch (error) {\r\n// logger.error(\"Error creating payment nonce\", { error: error.message });\r\n// return c.json({ error: \"Internal server error\" }, 500);\r\n// }\r\n// }\r\n\r\n// /**\r\n// * POST /api/v1/payment/exchange-nonce\r\n// *\r\n// * ✅ Automatic validation: ExchangeNonceRequest schema\r\n// * ✅ Auto-generated response: FingerprintResponse schema\r\n// * ❌ NO manual validation needed!\r\n// */\r\n// export async function exchangeNonce(c: AppContext): Promise {\r\n// // ✅ Request is already validated by OpenAPI middleware!\r\n// const { tourId } = (await c.req.json()) as ExchangeNonceRequest;\r\n// const db = c.get(\"db\");\r\n\r\n// try {\r\n// const ip =\r\n// c.req.header(\"cf-connecting-ip\") ||\r\n// c.req.header(\"x-forwarded-for\") ||\r\n// \"unknown\";\r\n// const nonce = c.req.header(\"X-Payment-Nonce\");\r\n\r\n// // 1. Validate nonce header (this is not in OpenAPI schema, so manual check needed)\r\n// if (!nonce) {\r\n// return c.json({ error: \"X-Payment-Nonce header required\" }, 400);\r\n// }\r\n\r\n// // 2. Atomically validate and consume nonce\r\n// const result = await db.execute(\r\n// `UPDATE app_payment_nonces\r\n// SET used = 1\r\n// WHERE nonce = ? AND ip_address = ? AND used = 0 AND expires_at > datetime('now')`,\r\n// [nonce, ip]\r\n// );\r\n\r\n// if (result.rowsAffected === 0) {\r\n// return c.json({ error: \"Invalid, expired, or already used nonce\" }, 401);\r\n// }\r\n\r\n// // 3. Generate payment fingerprint using server-side secrets\r\n// const tour = TOURS.find((t) => t.tourId === tourId);\r\n// if (!tour) {\r\n// return c.json({ error: \"Tour not found\" }, 404);\r\n// }\r\n\r\n// // Prepare payment hash request\r\n// const paymentHashRequest = {\r\n// apikey: environment.ZP_API_KEY,\r\n// mode: \"0\", // Payment mode\r\n// paymentAmount: tour.price.toString(),\r\n// merchantUniquePaymentId:\r\n// PaymentFingerprintService.generateMerchantUniquePaymentId(),\r\n// timestamp: PaymentFingerprintService.generateTimestamp(),\r\n// };\r\n\r\n// const fingerprintResult =\r\n// PaymentFingerprintService.generatePaymentHash(paymentHashRequest);\r\n\r\n// // ✅ Response matches FingerprintResponse schema automatically!\r\n// const response: FingerprintResponse = {\r\n// fingerprint: fingerprintResult.fingerprint,\r\n// paymentParams: {\r\n// url: \"https://pay.travelpay.com.au/online/v5\",\r\n// merchantCode: \"MERCHANT123\",\r\n// apiKey: fingerprintResult.apiKey,\r\n// redirectUrl: \"https://myapp.com/payment/return\",\r\n// mode: fingerprintResult.mode,\r\n// displayMode: 0,\r\n// customerName: \"Customer\",\r\n// customerReference: \"ABC123\",\r\n// merchantUniquePaymentId: fingerprintResult.merchantUniquePaymentId,\r\n// paymentAmount:\r\n// parseInt(fingerprintResult.paymentAmount.replace(\".\", \"\")) ||\r\n// tour.price * 100, // Convert to cents\r\n// timestamp: fingerprintResult.timestamp,\r\n// },\r\n// };\r\n\r\n// return c.json(response);\r\n// } catch (error) {\r\n// logger.error(\"Error exchanging nonce\", { error: error.message });\r\n// return c.json({ error: \"Internal server error\" }, 500);\r\n// }\r\n// }\r\n\r\n// /**\r\n// * POST /api/v1/payment/callback\r\n// *\r\n// * ✅ Automatic validation: ZenpayCallbackPayload schema\r\n// * ❌ NO manual validation needed!\r\n// */\r\n// export async function handlePaymentCallback(c: AppContext): Promise {\r\n// // ✅ Request is already validated by OpenAPI middleware!\r\n// const payload = (await c.req.json()) as ZenpayCallbackPayload;\r\n// const db = c.get(\"db\");\r\n\r\n// try {\r\n// // Process the payment callback\r\n// // Implementation details depend on your payment processing logic\r\n\r\n// logger.info(\"Payment callback received\", {\r\n// merchantUniquePaymentId: payload.merchantUniquePaymentId,\r\n// reference: payload.reference,\r\n// });\r\n\r\n// // Store callback in database for audit\r\n// await db.execute(\r\n// \"INSERT INTO payment_callbacks (payload, received_at) VALUES (?, ?)\",\r\n// [JSON.stringify(payload), new Date().toISOString()]\r\n// );\r\n\r\n// // Return 204 No Content as per OpenAPI spec\r\n// return new Response(null, { status: 204 });\r\n// } catch (error) {\r\n// logger.error(\"Error processing payment callback\", { error: error.message });\r\n// return c.json({ error: \"Internal server error\" }, 500);\r\n// }\r\n// }\r\n\r\n// // ========================================\r\n// // Tour and Booking Handlers\r\n// // ========================================\r\n\r\n// /**\r\n// * GET /api/v1/tours\r\n// *\r\n// * ✅ Automatic validation: Query parameters\r\n// * ✅ Auto-generated response: Tours array\r\n// */\r\n// export async function listTours(c: AppContext): Promise {\r\n// // ✅ Query parameters are already validated by OpenAPI middleware!\r\n// const page = Number(c.req.query(\"page\")) || 1;\r\n// const limit = Math.min(Number(c.req.query(\"limit\")) || 10, 10);\r\n// const featured = c.req.query(\"featured\") === \"true\";\r\n\r\n// try {\r\n// let tours = [...TOURS];\r\n\r\n// if (featured) {\r\n// // Filter for featured tours (example logic)\r\n// tours = tours.filter((tour) => tour.meta?.featured === true);\r\n// }\r\n\r\n// // Pagination\r\n// const startIndex = (page - 1) * limit;\r\n// const endIndex = startIndex + limit;\r\n// const paginatedTours = tours.slice(startIndex, endIndex);\r\n\r\n// const response = {\r\n// tours: paginatedTours,\r\n// pagination: {\r\n// page,\r\n// limit,\r\n// total: tours.length,\r\n// pages: Math.ceil(tours.length / limit),\r\n// },\r\n// };\r\n\r\n// return c.json(response);\r\n// } catch (error) {\r\n// logger.error(\"Error listing tours\", { error: error.message });\r\n// return c.json({ error: \"Internal server error\" }, 500);\r\n// }\r\n// }\r\n\r\n// /**\r\n// * GET /api/v1/tour/{id}\r\n// *\r\n// * ✅ Automatic validation: Path parameters\r\n// * ✅ Auto-generated response: Tour object with CSRF cookies\r\n// */\r\n// export async function getTourDetails(c: AppContext): Promise {\r\n// // ✅ Path parameters are already validated by OpenAPI middleware!\r\n// const tourId = c.req.param(\"id\");\r\n\r\n// try {\r\n// const tour = TOURS.find((t) => t.tourId === tourId);\r\n\r\n// if (!tour) {\r\n// return c.json({ error: \"Tour not found\" }, 404);\r\n// }\r\n\r\n// // Create CSRF session for cookie seeding\r\n// const csrfSession = createTokenBasedCSRFSession();\r\n\r\n// const response = c.json({\r\n// tourId: tour.tourId,\r\n// title: tour.title,\r\n// description: tour.description,\r\n// duration: tour.duration,\r\n// price: tour.price,\r\n// currency: tour.currency,\r\n// tour,\r\n// });\r\n\r\n// // Set CSRF cookies\r\n// setCSRFCookies(response, csrfSession);\r\n\r\n// return response;\r\n// } catch (error) {\r\n// logger.error(\"Error getting tour details\", { error: error.message });\r\n// return c.json({ error: \"Internal server error\" }, 500);\r\n// }\r\n// }\r\n\r\n// /**\r\n// * GET /api/v1/booking/{bookingId}\r\n// *\r\n// * ✅ Automatic validation: Path parameters\r\n// * ✅ Auto-generated response: Booking object\r\n// */\r\n// export async function getBookingDetails(c: AppContext): Promise {\r\n// // ✅ Path parameters are already validated by OpenAPI middleware!\r\n// const bookingId = c.req.param(\"bookingId\");\r\n// const db = c.get(\"db\");\r\n\r\n// try {\r\n// // Get booking details\r\n// const booking = await db.queryOne(\r\n// `SELECT id, title, tour_code, amount, currency, status, description\r\n// FROM app_tp_booking_orders WHERE id = ?`,\r\n// [bookingId]\r\n// );\r\n\r\n// if (!booking) {\r\n// return c.json({ error: \"Booking not found\" }, 404);\r\n// }\r\n\r\n// // Find matching tour data\r\n// const tour = TOURS.find((t) => t.meta?.code === booking.tour_code);\r\n// if (!tour) {\r\n// return c.json({ error: \"Tour information not available\" }, 404);\r\n// }\r\n\r\n// // Create CSRF session for cookie seeding\r\n// const csrfSession = createTokenBasedCSRFSession();\r\n\r\n// const response = c.json({\r\n// bookingId: booking.id,\r\n// tourId: tour.tourId,\r\n// customerName: \"Customer\",\r\n// status: booking.status,\r\n// tour,\r\n// });\r\n\r\n// // Set CSRF cookies\r\n// setCSRFCookies(response, csrfSession);\r\n\r\n// return response;\r\n// } catch (error) {\r\n// logger.error(\"Error getting booking details\", { error: error.message });\r\n// return c.json({ error: \"Internal server error\" }, 500);\r\n// }\r\n// }\r\n",[],[269,409,415,431],{"_104":439,"_96":440,"_156":441,"_158":416,"_159":141,"_160":442,"_162":22,"_106":443,"_100":32,"_164":235,"_166":444,"_167":22,"_168":-5,"_169":445,"_99":446},"82717e68-5f4c-11f0-b96f-0224a6c84d84","old.tourHandler.ts","82717f30-5f4c-11f0-b96f-0224a6c84d84",635,["D",1752344265834],"// /**\n// * Tour Handler - implements GET /api/v1/tour/{id} and GET /api/v1/tours\n// * Seeds SESSION and XSRF-TOKEN cookies as specified in SOLUTION.md\n// */\n// import { Context } from \"https://esm.sh/hono@4.2.7\";\n// import { Database } from \"../database/database.ts\";\n// import { TOURS, Tour } from \"../data/tours.ts\";\n// import { createTokenBasedCSRFSession } from \"../middleware/csrf.ts\";\n// import { setCSRFCookies } from \"../utils/cookies.ts\";\n// import type { CSRFSession } from \"../utils/cookies.ts\";\n// import { addCorsHeaders } from \"../middleware/cors.ts\";\n// import { getSecurityHeaders } from \"../middleware/secureHeaders.ts\";\n// import { logger } from \"../utils/logger.ts\";\n\n// /**\n// * Availability entry with structured status\n// */\n// interface AvailabilityEntry {\n// date: string;\n// available: boolean;\n// spots_remaining?: number;\n// }\n\n// /**\n// * Itinerary entry with timeline\n// */\n// interface ItineraryEntry {\n// time: string;\n// activity: string;\n// location?: string;\n// duration?: string;\n// }\n\n// /**\n// * Group size constraints\n// */\n// interface GroupSize {\n// min: number;\n// max: number;\n// }\n\n// /**\n// * Age restrictions\n// */\n// interface AgeRestrictions {\n// min_age?: number;\n// max_age?: number;\n// adult_supervision_required?: boolean;\n// }\n\n// /**\n// * Accessibility information\n// */\n// interface Accessibility {\n// wheelchair_accessible?: boolean;\n// mobility_notes?: string;\n// visual_impairment_friendly?: boolean;\n// hearing_impairment_friendly?: boolean;\n// }\n\n// /**\n// * Extended Tour interface with all new fields\n// */\n// interface ExtendedTour extends Tour {\n// // Alternative naming fields (name is already required in base Tour)\n// short_description?: string;\n// long_description?: string;\n// from_price_display?: number;\n// image_url?: string;\n// images?: string[];\n\n// // Location fields\n// start_location?: string;\n// end_location?: string;\n// pickup_points?: string[];\n\n// // Categorization\n// category?: string;\n// tags?: string[];\n\n// // Structured availability\n// availability?: AvailabilityEntry[];\n\n// // Detailed itinerary\n// itinerary?: ItineraryEntry[];\n\n// // Business fields\n// terms_and_conditions?: string;\n// tour_url?: string;\n\n// // Tour characteristics\n// group_size?: GroupSize;\n// difficulty?: \"easy\" | \"moderate\" | \"challenging\" | \"expert\";\n// age_restrictions?: AgeRestrictions;\n// accessibility?: Accessibility;\n// }\n\n// // === Request/Response Types ===\n\n// /**\n// * Path parameters for GET /api/v1/tour/{id}\n// */\n// interface GetTourDetailsParams {\n// id: string;\n// }\n\n// /**\n// * Query parameters for GET /api/v1/tours\n// */\n// interface ListToursQueryParams {\n// page?: string;\n// limit?: string;\n// featured?: string;\n// }\n\n// /**\n// * Parsed pagination parameters with validation\n// */\n// interface PaginationParams {\n// page: number;\n// limit: number;\n// featured?: boolean;\n// }\n\n// /**\n// * Pagination metadata\n// */\n// interface PaginationMeta {\n// page: number;\n// limit: number;\n// total: number;\n// totalPages: number;\n// hasNext: boolean;\n// hasPrev: boolean;\n// }\n\n// /**\n// * Tour details response (matches OpenAPI schema)\n// */\n// interface TourDetailsResponse extends ExtendedTour {\n// // Explicitly typed to match ExtendedTour interface with all enriched fields\n// }\n\n// /**\n// * Paginated tours response\n// */\n// interface PaginatedToursResponse {\n// tours: ExtendedTour[];\n// pagination: PaginationMeta;\n// }\n\n// /**\n// * Standard error response\n// */\n// interface ErrorResponse {\n// error: string;\n// details?: string | string[];\n// }\n\n// /**\n// * Tour handler context interface\n// */\n// interface TourHandlerContext {\n// req: {\n// param: (key: string) => string;\n// };\n// }\n\n// // === Handler Method Signatures ===\n\n// /**\n// * Tour handler method type for consistency\n// */\n// type TourHandlerMethod = (\n// request: Request,\n// db: Database,\n// context?: Context | TourHandlerContext\n// ) => Response;\n\n// class TourHandler {\n// /**\n// * GET /api/v1/tour/{id}\n// * Returns tour details and seeds SESSION & XSRF-TOKEN cookies\n// */\n// getTourDetails(\n// request: Request,\n// _db: Database,\n// context?: Context | TourHandlerContext\n// ): Response {\n// try {\n// const url = new URL(request.url);\n// const origin: string | null = request.headers.get(\"origin\");\n\n// // Get tour ID from Hono path parameter (via context) or fallback to manual parsing\n// let tourId: string;\n// if (context && context.req && context.req.param) {\n// tourId = context.req.param(\"id\");\n// console.log(`🔍 DEBUG: Got tourId from Hono context: \"${tourId}\"`);\n// } else {\n// // Fallback: manual path parsing\n// const pathParts = url.pathname.split(\"/\");\n// tourId = pathParts[pathParts.length - 1];\n// console.log(`🔍 DEBUG: Got tourId from manual parsing: \"${tourId}\"`);\n// console.log(`🔍 DEBUG: Full pathname: \"${url.pathname}\"`);\n// console.log(`🔍 DEBUG: Path parts:`, pathParts);\n// }\n\n// // Validate tour ID format\n// if (!tourId || tourId === \"\" || tourId === \"tour\") {\n// const errorResponse: ErrorResponse = {\n// error: \"Validation failed\",\n// details: [\"id: Required\"],\n// };\n\n// logger.warn(\"Validation failed in getTourDetails\", {\n// path: url.pathname,\n// received: { tourId },\n// errors: errorResponse.details,\n// });\n\n// return addCorsHeaders(\n// new Response(JSON.stringify(errorResponse), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Find tour in static data\n// const tour: ExtendedTour | undefined = TOURS.find(\n// (t) => t.tourId === tourId\n// ) as ExtendedTour;\n// if (!tour) {\n// const errorResponse: ErrorResponse = {\n// error: \"Tour not found\",\n// };\n\n// logger.warn(\"Tour not found\", { tourId });\n// return addCorsHeaders(\n// new Response(JSON.stringify(errorResponse), {\n// status: 404,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Create CSRF session for cookie seeding\n// const csrfSession: CSRFSession = createTokenBasedCSRFSession();\n\n// // Prepare tour response matching OpenAPI schema\n// // Spread all tour properties to include any extended fields\n// const tourResponse: TourDetailsResponse = {\n// ...tour, // This will include all fields from the tour object\n// };\n\n// // Create response with tour data\n// const response = new Response(JSON.stringify(tourResponse), {\n// status: 200,\n// headers: {\n// \"Content-Type\": \"application/json\",\n// // Add security headers from CSP middleware\n// ...getSecurityHeaders(),\n// },\n// });\n\n// // Set CSRF cookies (SESSION and XSRF-TOKEN)\n// const responseWithCookies = setCSRFCookies(response, csrfSession);\n\n// logger.info(\"Tour details served with session cookies\", {\n// tourId,\n// sessionId: csrfSession.sessionId.substring(0, 8) + \"...\",\n// });\n\n// return addCorsHeaders(responseWithCookies, origin);\n// } catch (error) {\n// const errorResponse: ErrorResponse = {\n// error: \"Internal server error\",\n// };\n\n// logger.error(\"Error serving tour details\", {\n// error: error instanceof Error ? error.message : String(error),\n// });\n\n// return addCorsHeaders(\n// new Response(JSON.stringify(errorResponse), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n\n// /**\n// * GET /api/v1/tours\n// * Returns paginated list of tours (max 10 per page)\n// */\n// listTours(\n// request: Request,\n// _db: Database,\n// _context?: Context | TourHandlerContext\n// ): Response {\n// try {\n// const url = new URL(request.url);\n// const origin: string | null = request.headers.get(\"origin\");\n\n// // Parse query parameters\n// const queryParams: ListToursQueryParams = {\n// page: url.searchParams.get(\"page\") || undefined,\n// limit: url.searchParams.get(\"limit\") || undefined,\n// featured: url.searchParams.get(\"featured\") || undefined,\n// };\n\n// const params: PaginationParams = {\n// page: queryParams.page ? Math.max(1, parseInt(queryParams.page)) : 1,\n// limit: queryParams.limit\n// ? Math.min(10, Math.max(1, parseInt(queryParams.limit)))\n// : 10,\n// featured:\n// queryParams.featured === \"true\"\n// ? true\n// : queryParams.featured === \"false\"\n// ? false\n// : undefined,\n// };\n\n// // Validate parameters\n// if (isNaN(params.page) || params.page < 1) {\n// const errorResponse: ErrorResponse = {\n// error: \"Validation failed\",\n// details: [\"page: Must be a positive integer\"],\n// };\n\n// logger.warn(\"Invalid page parameter\", { page: queryParams.page });\n// return addCorsHeaders(\n// new Response(JSON.stringify(errorResponse), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// if (isNaN(params.limit) || params.limit < 1 || params.limit > 10) {\n// const errorResponse: ErrorResponse = {\n// error: \"Validation failed\",\n// details: [\"limit: Must be between 1 and 10\"],\n// };\n\n// logger.warn(\"Invalid limit parameter\", { limit: queryParams.limit });\n// return addCorsHeaders(\n// new Response(JSON.stringify(errorResponse), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Filter tours if featured parameter is provided\n// let filteredTours: ExtendedTour[] = TOURS as ExtendedTour[];\n// if (params.featured !== undefined) {\n// filteredTours = TOURS.filter((tour: ExtendedTour) => {\n// const isFeatured: boolean = tour.meta?.featured === true;\n// return params.featured ? isFeatured : !isFeatured;\n// }) as ExtendedTour[];\n// }\n\n// // Calculate pagination\n// const total: number = filteredTours.length;\n// const totalPages: number = Math.ceil(total / params.limit);\n// const startIndex: number = (params.page - 1) * params.limit;\n// const endIndex: number = startIndex + params.limit;\n\n// // Get tours for current page\n// const paginatedTours: ExtendedTour[] = filteredTours.slice(\n// startIndex,\n// endIndex\n// );\n\n// // Build pagination metadata\n// const paginationMeta: PaginationMeta = {\n// page: params.page,\n// limit: params.limit,\n// total,\n// totalPages,\n// hasNext: params.page < totalPages,\n// hasPrev: params.page > 1,\n// };\n\n// // Build response\n// const response: PaginatedToursResponse = {\n// tours: paginatedTours,\n// pagination: paginationMeta,\n// };\n\n// logger.info(\"Tours list served\", {\n// page: params.page,\n// limit: params.limit,\n// total,\n// filtered: params.featured !== undefined,\n// featuredOnly: params.featured,\n// });\n\n// return addCorsHeaders(\n// new Response(JSON.stringify(response), {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// } catch (error) {\n// const errorResponse: ErrorResponse = {\n// error: \"Internal server error\",\n// details: \"Failed to retrieve tours list\",\n// };\n\n// logger.error(\"Error in listTours handler\", {\n// error: error instanceof Error ? error.message : String(error),\n// url: request.url,\n// });\n\n// return addCorsHeaders(\n// new Response(JSON.stringify(errorResponse), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n// }\n\n// export const tourHandler = new TourHandler();\n",[],[269,409,415,440],{"_104":448,"_96":449,"_156":450,"_158":416,"_159":141,"_160":451,"_162":22,"_106":452,"_100":32,"_164":235,"_166":453,"_167":22,"_168":-5,"_169":454,"_99":455},"82698b36-5f4c-11f0-85b2-0224a6c84d84","old.turnstileHandler.ts","82698bd6-5f4c-11f0-85b2-0224a6c84d84",634,["D",1752344265855],"// import { ValidationService } from \"../services/validationService.ts\";\n// import { addCorsHeaders } from \"../middleware/cors.ts\";\n// import { logger } from \"../utils/logger.ts\";\n// import { environment } from \"../config/environment.ts\";\n\n// class TurnstileHandler {\n// /**\n// * Serves an HTML page with Cloudflare Turnstile widget for token generation\n// * This is for testing purposes only to verify Turnstile integration\n// */\n// serveTurnstileTestPage(_request: Request): Response {\n// const html = `\n// \n// \n// \n// \n// \n// Turnstile Token Generator\n// \n// \n// \n// \n//

\n//

Turnstile Token Generator

\n \n//

\n//

Site Key: 0x4AAAAAABjPDL4GDo6BXFza

\n//

This page generates real Cloudflare Turnstile tokens for testing the payment flow.

\n//

The token will be valid for 90 seconds once generated.

\n//

\n\n// \n \n//

\n// Generated Token:
\n// \n//

\n// \n//

\n \n//

\n//

\n\n// \n// \n// \n// `;\n\n// return new Response(html, {\n// status: 200,\n// headers: {\n// \"Content-Type\": \"text/html; charset=utf-8\",\n// \"Cache-Control\": \"no-cache, no-store, must-revalidate\",\n// },\n// });\n// }\n\n// async verifyTurnstile(request: Request): Promise {\n// try {\n// const ip =\n// request.headers.get(\"cf-connecting-ip\") ||\n// request.headers.get(\"x-forwarded-for\") ||\n// \"unknown\";\n// const origin = request.headers.get(\"origin\") || \"\";\n\n// // Parse request body\n// let body: any;\n// try {\n// body = await request.json();\n// } catch (_error) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid JSON body\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Check for required fields\n// if (!body || typeof body !== \"object\") {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Request body required\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// const { token, remoteip } = body;\n\n// // Validate token is present\n// if (!token) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Token required\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Validate remoteip is present\n// if (!remoteip) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Remote IP required\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Validate IP format\n// const ipRegex =\n// /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/;\n// if (!ipRegex.test(remoteip)) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid IP format\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Validate token length\n// if (token.length > 2048) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Token too long\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Validate token format\n// const validation = ValidationService.validateTurnstileToken(token);\n// if (!validation.valid) {\n// logger.warn(\"Invalid Turnstile token format\", {\n// ip,\n// error: validation.error,\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: validation.error }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// origin\n// );\n// }\n\n// // Verify token with Cloudflare Turnstile API\n// const turnstileSecret = environment.TURNSTILE_SECRET_KEY;\n// if (!turnstileSecret) {\n// logger.error(\"Turnstile secret key not configured\");\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: \"Turnstile verification not configured\" }),\n// {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// const verificationResponse = await fetch(\n// \"https://challenges.cloudflare.com/turnstile/v0/siteverify\",\n// {\n// method: \"POST\",\n// headers: {\n// \"Content-Type\": \"application/x-www-form-urlencoded\",\n// },\n// body: new URLSearchParams({\n// secret: turnstileSecret,\n// response: token,\n// remoteip: ip,\n// }),\n// }\n// );\n\n// const verificationResult = await verificationResponse.json();\n\n// if (!verificationResult.success) {\n// logger.warn(\"Turnstile verification failed\", {\n// ip,\n// errors: verificationResult[\"error-codes\"] || [],\n// });\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// success: false,\n// error: \"Turnstile verification failed\",\n// details: verificationResult[\"error-codes\"] || [],\n// }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// }\n\n// logger.info(\"Turnstile verification successful\", { ip });\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// success: true,\n// message: \"Turnstile verification successful\",\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }\n// ),\n// origin\n// );\n// } catch (error) {\n// logger.error(\"Error verifying Turnstile token\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined\n// );\n// }\n// }\n// }\n\n// export const turnstileHandler = new TurnstileHandler();\n",[],[269,409,415,449],{"_104":457,"_96":458,"_156":459,"_158":416,"_159":141,"_160":460,"_162":22,"_106":461,"_100":32,"_164":235,"_166":462,"_167":22,"_168":-5,"_169":463,"_99":464},"82834a30-5f4c-11f0-8123-0224a6c84d84","old.webhookHandler.ts","82834ae4-5f4c-11f0-8123-0224a6c84d84",636,["D",1752344266023],"// import { Database } from \"../database/database.ts\";\n// import { AuthService } from \"../services/authService.ts\";\n// import { addCorsHeaders } from \"../middleware/cors.ts\";\n// import { logger } from \"../utils/logger.ts\";\n// import { blob } from \"https://esm.town/v/std/blob\";\n// import { generateUUID } from \"../utils/crypto.ts\";\n\n// export interface WebhookResponse {\n// id: string;\n// timestamp: string;\n// status: string;\n// message: string;\n// receivedAt: string;\n// payloadSize: number;\n// headers: Record;\n// }\n\n// class WebhookHandler {\n// /**\n// * Generic webhook endpoint that accepts any JSON payload\n// * Requires API key authentication via header or query parameter\n// */\n// async handleWebhook(request: Request, db: Database): Promise {\n// try {\n// // Parse JSON payload first to validate input\n// let payload: any;\n// try {\n// payload = await request.json();\n// } catch (error) {\n// logger.warn(\"Webhook invalid JSON payload\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid JSON payload\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Validate payload is not empty\n// if (!payload || Object.keys(payload).length === 0) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Empty webhook body\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Validate event type if present\n// if (payload.event && typeof payload.event === \"string\") {\n// const _validEvents = [\n// \"payment.completed\",\n// \"payment.failed\",\n// \"subscription.created\",\n// \"subscription.cancelled\",\n// ];\n// if (!payload.event.includes(\".\")) {\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({ error: \"Invalid event type format\" }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// },\n// ),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n// }\n\n// // Now validate API key after input validation\n// const apiValidation = AuthService.validateApiKey(request);\n// if (!apiValidation.valid) {\n// logger.warn(\"Webhook unauthorized access attempt\", {\n// ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// userAgent: request.headers.get(\"user-agent\") || \"unknown\",\n// error: apiValidation.error,\n// });\n\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: apiValidation.error }), {\n// status: 401,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Generate webhook response\n// const webhookId = generateUUID();\n// const timestamp = new Date().toISOString();\n// const payloadSize = JSON.stringify(payload).length;\n\n// // Extract relevant headers for logging\n// const relevantHeaders: Record = {};\n// request.headers.forEach((value, key) => {\n// if (\n// key.toLowerCase().includes(\"content-\") ||\n// key.toLowerCase().includes(\"x-\") ||\n// key.toLowerCase() === \"user-agent\"\n// ) {\n// relevantHeaders[key] = value;\n// }\n// });\n\n// // Log webhook receipt\n// logger.info(\"Webhook received\", {\n// id: webhookId,\n// payloadSize,\n// headers: relevantHeaders,\n// ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// });\n\n// // Store webhook data (optional - for audit purposes)\n// await db.execute(\n// \"INSERT INTO webhook_logs (id, payload, headers, ip_address, timestamp) VALUES (?, ?, ?, ?, ?)\",\n// [\n// webhookId,\n// JSON.stringify(payload),\n// JSON.stringify(relevantHeaders),\n// request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// timestamp,\n// ],\n// );\n\n// // Save webhook payload to blob storage\n// try {\n// const nowDate = new Date(timestamp);\n// const y = nowDate.getFullYear();\n// const m = String(nowDate.getMonth() + 1).padStart(2, \"0\");\n// const d = String(nowDate.getDate()).padStart(2, \"0\");\n// const hh = String(nowDate.getHours()).padStart(2, \"0\");\n// const mm = String(nowDate.getMinutes()).padStart(2, \"0\");\n// const ss = String(nowDate.getSeconds()).padStart(2, \"0\");\n// const blobKey =\n// `webhook/sys/${y}${m}${d}-${hh}${mm}${ss}-${webhookId}.json`;\n// await blob.setJSON(blobKey, payload);\n// } catch (e) {\n// logger.warn(\"Failed to save webhook payload to blob storage\", {\n// error: e.message,\n// });\n// }\n\n// // Prepare response\n// const response: WebhookResponse = {\n// id: webhookId,\n// timestamp,\n// status: \"received\",\n// message: \"Webhook processed successfully\",\n// receivedAt: timestamp,\n// payloadSize,\n// headers: relevantHeaders,\n// };\n\n// return addCorsHeaders(\n// new Response(JSON.stringify(response), {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// } catch (error) {\n// logger.error(\"Webhook processing error\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n// }\n\n// /**\n// * OAuth/Payment callback endpoint\n// * Handles callbacks with state parameter validation\n// */\n// async handleCallback(request: Request, db: Database): Promise {\n// try {\n// // Parse JSON payload first to validate input\n// let payload: any;\n// try {\n// payload = await request.json();\n// } catch (error) {\n// logger.warn(\"Callback invalid JSON payload\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid JSON payload\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Validate payload is not empty\n// if (!payload || Object.keys(payload).length === 0) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Empty callback body\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Check for required state parameter (CSRF protection)\n// if (!payload.state) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Missing state parameter\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Validate state format\n// if (typeof payload.state !== \"string\" || payload.state.length < 32) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Invalid state format\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Check for error callbacks\n// if (payload.error) {\n// logger.warn(\"Error callback received\", {\n// error: payload.error,\n// errorDescription: payload.error_description,\n// state: payload.state.substring(0, 8) + \"...\",\n// });\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// error: \"Callback error\",\n// details: payload.error,\n// description: payload.error_description,\n// }),\n// {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// },\n// ),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Validate provider if present\n// if (payload.provider && typeof payload.provider === \"string\") {\n// const validProviders = [\n// \"oauth_provider\",\n// \"payment_provider\",\n// \"google\",\n// \"github\",\n// \"stripe\",\n// \"paypal\",\n// ];\n// if (!validProviders.includes(payload.provider)) {\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Unknown provider\" }), {\n// status: 400,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n// }\n\n// // Check for CSRF attack indicators\n// const origin = request.headers.get(\"origin\");\n// const referer = request.headers.get(\"referer\");\n// if (origin && origin.includes(\"evil-site.com\")) {\n// logger.warn(\"Potential CSRF attack detected\", {\n// origin,\n// referer,\n// state: payload.state.substring(0, 8) + \"...\",\n// });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Forbidden\" }), {\n// status: 403,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Now validate API key after input validation\n// const apiValidation = AuthService.validateApiKey(request);\n// if (!apiValidation.valid) {\n// logger.warn(\"Callback unauthorized access attempt\", {\n// ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// userAgent: request.headers.get(\"user-agent\") || \"unknown\",\n// error: apiValidation.error,\n// });\n\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: apiValidation.error }), {\n// status: 401,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n\n// // Generate callback response\n// const callbackId = generateUUID();\n// const timestamp = new Date().toISOString();\n\n// // Log callback receipt\n// logger.info(\"Callback received\", {\n// id: callbackId,\n// state: payload.state.substring(0, 8) + \"...\",\n// provider: payload.provider,\n// ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// });\n\n// // Store callback data for audit\n// await db.execute(\n// \"INSERT INTO callback_logs (id, payload, state, ip_address, timestamp) VALUES (?, ?, ?, ?, ?)\",\n// [\n// callbackId,\n// JSON.stringify(payload),\n// payload.state,\n// request.headers.get(\"x-forwarded-for\") || \"unknown\",\n// timestamp,\n// ],\n// );\n\n// // Save callback payload to blob storage\n// try {\n// const nowDate = new Date(timestamp);\n// const y = nowDate.getFullYear();\n// const m = String(nowDate.getMonth() + 1).padStart(2, \"0\");\n// const d = String(nowDate.getDate()).padStart(2, \"0\");\n// const hh = String(nowDate.getHours()).padStart(2, \"0\");\n// const mm = String(nowDate.getMinutes()).padStart(2, \"0\");\n// const ss = String(nowDate.getSeconds()).padStart(2, \"0\");\n// const blobKey =\n// `callback/sys/${y}${m}${d}-${hh}${mm}${ss}-${callbackId}.json`;\n// await blob.setJSON(blobKey, payload);\n// } catch (e) {\n// logger.warn(\"Failed to save callback payload to blob storage\", {\n// error: e.message,\n// });\n// }\n\n// return addCorsHeaders(\n// new Response(\n// JSON.stringify({\n// id: callbackId,\n// timestamp,\n// status: \"processed\",\n// message: \"Callback processed successfully\",\n// state: payload.state,\n// }),\n// {\n// status: 200,\n// headers: { \"Content-Type\": \"application/json\" },\n// },\n// ),\n// request.headers.get(\"origin\") || undefined,\n// );\n// } catch (error) {\n// logger.error(\"Callback processing error\", { error: error.message });\n// return addCorsHeaders(\n// new Response(JSON.stringify({ error: \"Internal server error\" }), {\n// status: 500,\n// headers: { \"Content-Type\": \"application/json\" },\n// }),\n// request.headers.get(\"origin\") || undefined,\n// );\n// }\n// }\n// }\n\n// export const webhookHandler = new WebhookHandler();\n",[],[269,409,415,458],[269,409,415],{"_104":467,"_96":468,"_156":469,"_158":410,"_159":141,"_160":470,"_162":22,"_106":471,"_100":472,"_164":235,"_166":473,"_167":22,"_168":-5,"_169":474,"_99":475},"49bb5286-5e6d-11f0-922b-0224a6c84d84","adminHandler.ts","8c60818e-5a93-11f0-828e-f69ea79377d9",594,["D",1752248392982],10,"/**\r\n * Admin Handler - implements admin-only endpoints for shareable link flow\r\n * Payment Handler - Updated to match OpenAPI specification and SOLUTION.md\r\n * Implements the two-step nonce-gating system with CSRF and Turnstile protection\r\n * POST /api/v1/s/booking/generate-token\r\n * GET /api/v1/s/booking/{token}\r\n * POST /api/v1/create-booking\r\n * POST /api/v1/payment/create-nonce\r\n * POST /api/v1/payment/exchange-nonce\r\n * POST /api/v1/payment/callback\r\n */\r\nimport { Database } from \"../database/database.ts\";\r\nimport { TOURS } from \"../data/tours.ts\";\r\nimport { createCSRFSession, setCSRFCookies } from \"../middleware/csrf.ts\";\r\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { ValidationService } from \"../services/validationService.ts\";\r\nimport { AuthService } from \"../services/authService.ts\";\r\nimport { PaymentFingerprintService } from \"../services/zenpayFingerprintService.ts\";\r\nimport { TurnstileService } from \"../services/turnstileService.ts\";\r\nimport { csrfProtection } from \"../middleware/csrf.ts\";\r\nimport { logSecurityCheck } from \"../middleware/debugger.ts\";\r\n\r\nexport interface BookingInfo {\r\n id: string;\r\n title: string;\r\n description: string;\r\n amount: number;\r\n currency: string;\r\n status: string;\r\n}\r\n\r\nexport interface PayTokenValidationResult {\r\n valid: boolean;\r\n bookingId?: string;\r\n error?: string;\r\n}\r\n\r\n/**\r\n * Creates a booking row from a tour id\r\n * Returns the new booking id so the frontend can keep using it\r\n */\r\nasync function createBookingForTour(\r\n db: Database,\r\n tourId: string\r\n): Promise {\r\n const tour = TOURS.find((t) => t.tourId === tourId);\r\n if (!tour) throw new Error(\"Unknown tour id\");\r\n const bookingId = crypto.randomUUID();\r\n await db.execute(\r\n `INSERT INTO app_tp_booking_orders\r\n (id, title, description, amount, currency, status, tour_code, pax_count, due_date)\r\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, date('now', '+30 days'))`,\r\n [\r\n bookingId,\r\n tour.tourId,\r\n tour.title,\r\n tour.description,\r\n tour.duration,\r\n tour.datesAvailable,\r\n tour.price,\r\n tour.currency,\r\n tour.heroImageUrl,\r\n tour.gallery,\r\n tour.inclusions,\r\n tour.exclusions,\r\n tour.callToAction,\r\n tour.payNowEnabled,\r\n tour.name,\r\n tour.meta,\r\n \"pending\",\r\n ]\r\n );\r\n return bookingId;\r\n}\r\n\r\n/**\r\n * Utility functions for token generation and management\r\n */\r\n\r\n/**\r\n * Generates a new pay token (one-time access token)\r\n * Returns a 22-character URL-safe base64 string\r\n * @returns 22-character URL-safe token\r\n */\r\nexport function newPayToken(): string {\r\n // Generate UUID and remove hyphens for 128-bit entropy\r\n const uuid = crypto.randomUUID().replace(/-/g, \"\");\r\n\r\n // Take first 22 characters for URL-safe token\r\n // This provides ~132 bits of entropy (22 * 6 bits per base64 char)\r\n return uuid.substring(0, 22);\r\n}\r\n\r\nclass AdminHandler {\r\n /**\r\n * POST /api/v1/payment/create-nonce\r\n * Step 1: Generate a single-use, 60-second nonce after security validation\r\n * Security: CSRF protection + Turnstile + Rate limiting\r\n */\r\n async createNonce(\r\n request: Request,\r\n db: Database,\r\n correlationId?: string\r\n ): Promise {\r\n try {\r\n const ip =\r\n request.headers.get(\"cf-connecting-ip\") ||\r\n request.headers.get(\"x-forwarded-for\") ||\r\n \"unknown\";\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // 1. CSRF Protection (validates X-XSRF-TOKEN header against SESSION cookie)\r\n const csrfError = csrfProtection(request);\r\n if (csrfError) {\r\n return addCorsHeaders(csrfError, origin);\r\n }\r\n\r\n // 2. Parse and validate request body\r\n let body: any;\r\n try {\r\n body = await request.json();\r\n } catch (error) {\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: `Invalid JSON body ${error.message}` }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n const { tourId, cfToken, email_verify } = body;\r\n\r\n // 3. Honeypot bot detection (before Turnstile validation)\r\n const honeypotPresent = \"email_verify\" in body;\r\n const honeypotValid = email_verify === \"🍯\";\r\n\r\n if (!honeypotPresent) {\r\n // Field missing - sophisticated bot possible\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Honeypot Bot Detection\",\r\n \"Honeypot field missing - suspicious\",\r\n false,\r\n {\r\n field_missing: true,\r\n ip,\r\n user_agent: request.headers.get(\"user-agent\")?.substring(0, 50),\r\n }\r\n );\r\n }\r\n // Continue with caution - could be legitimate frontend issue\r\n } else if (!honeypotValid) {\r\n // Field present but wrong value - definite bot\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Honeypot Bot Detection\",\r\n \"Bot detected via invalid honeypot value\",\r\n false,\r\n {\r\n honeypot_value: email_verify?.substring(0, 10),\r\n ip,\r\n user_agent: request.headers.get(\"user-agent\")?.substring(0, 50),\r\n }\r\n );\r\n }\r\n // Return fake nonce to waste bot resources\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n nonce: `fake_${crypto\r\n .randomUUID()\r\n .replace(/-/g, \"\")\r\n .substring(0, 32)}`,\r\n expiresAt: new Date(Date.now() + 60000).toISOString(),\r\n }),\r\n {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n } else {\r\n // Field present with correct emoji - human user\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Honeypot Bot Detection\",\r\n \"Human user verified - honeypot valid\",\r\n true,\r\n { ip }\r\n );\r\n }\r\n }\r\n\r\n // 4. Validate required fields\r\n if (!tourId || !cfToken) {\r\n logger.warn(\"Missing required fields in nonce request\", {\r\n ip,\r\n tourId: !!tourId,\r\n cfToken: !!cfToken,\r\n });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n error: \"Missing required fields: tourId and cfToken are required\",\r\n }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 5. Validate Turnstile token (bot protection)\r\n const turnstileValidation = await TurnstileService.validateToken(\r\n cfToken,\r\n ip\r\n );\r\n if (!turnstileValidation.valid) {\r\n logger.warn(\"Turnstile validation failed in nonce request\", {\r\n ip,\r\n error: turnstileValidation.error,\r\n });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n error: \"Bot detection failed\",\r\n details: turnstileValidation.error,\r\n }),\r\n {\r\n status: 403,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 5. Generate cryptographically secure nonce\r\n const nonce =\r\n crypto.randomUUID().replace(/-/g, \"\") +\r\n Array.from(crypto.getRandomValues(new Uint8Array(16)), (byte) =>\r\n byte.toString(16).padStart(2, \"0\")\r\n ).join(\"\");\r\n\r\n const issuedAt = new Date().toISOString();\r\n const expiresAt = new Date(Date.now() + 60 * 1000).toISOString(); // 60 seconds TTL\r\n\r\n // 6. Store nonce in database\r\n await db.execute(\r\n `\r\n INSERT INTO app_payment_nonces\r\n (nonce, booking_id, ip_address, issued_at, expires_at, used)\r\n VALUES (?, ?, ?, ?, ?, 0)\r\n `,\r\n [nonce, tourId, ip, issuedAt, expiresAt]\r\n );\r\n\r\n logger.info(\"Payment nonce created\", {\r\n tourId,\r\n ip,\r\n nonce: nonce.substring(0, 8) + \"...\",\r\n expiresAt,\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n nonce,\r\n expiresIn: 60,\r\n }),\r\n {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"application/json\",\r\n \"RateLimit-Limit\": \"10\",\r\n \"RateLimit-Remaining\": \"9\",\r\n \"RateLimit-Reset\": \"60\",\r\n },\r\n }\r\n ),\r\n origin\r\n );\r\n } catch (error) {\r\n logger.error(\"Error creating payment nonce\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n\r\n /**\r\n * POST /api/v1/payment/exchange-nonce\r\n * Step 2: Exchange valid nonce for payment fingerprint\r\n * Security: Nonce validation + Atomic consumption\r\n */\r\n async exchangeNonce(request: Request, db: Database): Promise {\r\n try {\r\n const ip =\r\n request.headers.get(\"cf-connecting-ip\") ||\r\n request.headers.get(\"x-forwarded-for\") ||\r\n \"unknown\";\r\n const nonce = request.headers.get(\"X-Payment-Nonce\");\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // 1. Validate nonce header\r\n if (!nonce) {\r\n logger.warn(\"Missing X-Payment-Nonce header\", { ip });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: \"X-Payment-Nonce header required\" }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 2. Parse and validate request body\r\n let body: any;\r\n try {\r\n body = await request.json();\r\n } catch (error) {\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: `Invalid JSON body ${error.message}` }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n const {\r\n apiKey,\r\n mode,\r\n paymentAmount,\r\n merchantUniquePaymentId,\r\n timestamp,\r\n } = body;\r\n\r\n // 3. Validate required payment fields\r\n const requiredFields = [\r\n \"apiKey\",\r\n \"mode\",\r\n \"paymentAmount\",\r\n \"merchantUniquePaymentId\",\r\n \"timestamp\",\r\n ];\r\n const missingFields = requiredFields.filter((field) => !body[field]);\r\n\r\n if (missingFields.length > 0) {\r\n logger.warn(\"Missing required payment fields\", { ip, missingFields });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n error: \"Missing required fields\",\r\n details: missingFields,\r\n }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 4. Atomically validate and consume nonce\r\n const result = await db.execute(\r\n `\r\n UPDATE app_payment_nonces\r\n SET used = 1\r\n WHERE nonce = ?\r\n AND ip_address = ?\r\n AND used = 0\r\n AND expires_at > datetime('now')\r\n `,\r\n [nonce, ip]\r\n );\r\n\r\n if (result.rowsAffected === 0) {\r\n logger.warn(\r\n \"Nonce validation failed - invalid, expired, or already used\",\r\n {\r\n ip,\r\n nonce: nonce.substring(0, 8) + \"...\",\r\n }\r\n );\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n error: \"Invalid, expired, or already used nonce\",\r\n }),\r\n {\r\n status: 401,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 5. Generate payment fingerprint using server-side secrets\r\n const username = Deno.env.get(\"ZP_USERNAME\");\r\n const password = Deno.env.get(\"ZP_PASSWORD\");\r\n\r\n if (!username || !password) {\r\n logger.error(\"Payment credentials not configured\");\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: \"Payment system not configured\" }),\r\n {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 6. Create fingerprint payload (secrets added server-side, never exposed)\r\n const paymentHashRequest = {\r\n apikey: apiKey,\r\n mode,\r\n paymentAmount,\r\n merchantUniquePaymentId,\r\n timestamp,\r\n };\r\n const fingerprint =\r\n PaymentFingerprintService.generatePaymentHash(\r\n paymentHashRequest\r\n ).fingerprint;\r\n\r\n logger.info(\"Payment fingerprint generated\", {\r\n merchantUniquePaymentId,\r\n paymentAmount,\r\n mode,\r\n nonce: nonce.substring(0, 8) + \"...\",\r\n ip,\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n fingerprint,\r\n }),\r\n {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n } catch (error) {\r\n logger.error(\"Error exchanging nonce for fingerprint\", {\r\n error: error.message,\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n\r\n /**\r\n * POST /api/v1/payment/callback\r\n * Handles payment confirmation from Zenpay gateway\r\n * Security: ValidationCode verification (SHA3-512 hash verification)\r\n */\r\n async handlePaymentCallback(\r\n request: Request,\r\n db: Database\r\n ): Promise {\r\n try {\r\n // 1. Parse callback payload from Zenpay\r\n let body: any;\r\n try {\r\n body = await request.json();\r\n } catch (error) {\r\n logger.error(\"Invalid callback payload\", { error: error.message });\r\n return new Response(JSON.stringify({ error: \"Invalid JSON\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n });\r\n }\r\n\r\n const {\r\n apiKey,\r\n mode,\r\n paymentAmount,\r\n merchantUniquePaymentId,\r\n reference,\r\n ValidationCode,\r\n PaymentStatus,\r\n timestamp,\r\n } = body;\r\n\r\n // 2. Validate required callback fields\r\n const requiredFields = [\r\n \"apiKey\",\r\n \"mode\",\r\n \"paymentAmount\",\r\n \"merchantUniquePaymentId\",\r\n \"reference\",\r\n \"ValidationCode\",\r\n ];\r\n const missingFields = requiredFields.filter((field) => !body[field]);\r\n\r\n if (missingFields.length > 0) {\r\n logger.error(\"Invalid callback payload - missing fields\", {\r\n missingFields,\r\n });\r\n return new Response(JSON.stringify({ error: \"Invalid callback\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n });\r\n }\r\n\r\n // 3. Verify ValidationCode (callback authentication)\r\n const expectedPaymentHashRequest = {\r\n apikey: apiKey,\r\n mode,\r\n paymentAmount,\r\n merchantUniquePaymentId: reference, // reference is used for callback validation\r\n timestamp: timestamp, // ensure timestamp is available in the callback body\r\n };\r\n const expectedValidationCode =\r\n PaymentFingerprintService.generatePaymentHash(\r\n expectedPaymentHashRequest\r\n ).fingerprint;\r\n\r\n if (expectedValidationCode !== ValidationCode) {\r\n logger.error(\"CRITICAL: Invalid ValidationCode in callback\", {\r\n merchantUniquePaymentId,\r\n expected: expectedValidationCode.substring(0, 10) + \"...\",\r\n received: ValidationCode.substring(0, 10) + \"...\",\r\n });\r\n return new Response(\r\n JSON.stringify({ error: \"Invalid callback authentication\" }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n );\r\n }\r\n\r\n // 4. Update booking status based on payment result\r\n const bookingStatus = PaymentStatus === 3 ? \"paid\" : \"failed\";\r\n\r\n await db.execute(\r\n `\r\n UPDATE app_tp_booking_orders\r\n SET status = ?, updated_at = datetime('now')\r\n WHERE id = ?\r\n `,\r\n [bookingStatus, merchantUniquePaymentId]\r\n );\r\n\r\n logger.info(\"Payment callback processed\", {\r\n merchantUniquePaymentId,\r\n paymentStatus: PaymentStatus,\r\n bookingStatus,\r\n validationCodeValid: true,\r\n });\r\n\r\n return new Response(null, { status: 204 });\r\n } catch (error) {\r\n logger.error(\"Error processing payment callback\", {\r\n error: error.message,\r\n });\r\n return new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n });\r\n }\r\n }\r\n\r\n /**\r\n * Validates and consumes a pay token (atomic operation)\r\n * GET /x/:payToken or similar pay token validation endpoint\r\n */\r\n async validatePayToken(request: Request, db: Database): Promise {\r\n try {\r\n const url = new URL(request.url);\r\n const pathParts = url.pathname.split(\"/\");\r\n const payToken = pathParts[pathParts.length - 1];\r\n\r\n // Get client IP\r\n const ip =\r\n request.headers.get(\"cf-connecting-ip\") ||\r\n request.headers.get(\"x-forwarded-for\") ||\r\n request.headers.get(\"x-real-ip\") ||\r\n \"unknown\";\r\n\r\n logger.info(\"Pay token validation attempt\", {\r\n token: payToken.substring(0, 8) + \"...\",\r\n ip,\r\n });\r\n\r\n // Atomic UPDATE to consume token (race-safe)\r\n const result = await db.execute(\r\n `UPDATE app_pay_tokens\r\n SET used = 1,\r\n last_ip = ?\r\n WHERE token = ?\r\n AND used = 0\r\n AND expires_at > datetime('now')`,\r\n [ip, payToken]\r\n );\r\n\r\n if (result.rowsAffected === 0) {\r\n logger.warn(\"Invalid or expired pay token\", {\r\n token: payToken.substring(0, 8) + \"...\",\r\n ip,\r\n });\r\n\r\n return new Response(\"Link expired or already used\", {\r\n status: 410,\r\n headers: { \"Content-Type\": \"text/plain\" },\r\n });\r\n }\r\n\r\n // Get booking ID for the validated token\r\n const tokenData = await db.query(\r\n `SELECT booking_id FROM app_pay_tokens WHERE token = ?`,\r\n [payToken]\r\n );\r\n\r\n if (!tokenData || tokenData.length === 0) {\r\n return new Response(\"Token not found\", {\r\n status: 404,\r\n headers: { \"Content-Type\": \"text/plain\" },\r\n });\r\n }\r\n\r\n const bookingId = tokenData[0].booking_id;\r\n logger.info(\"Pay token validated successfully\", { bookingId, ip });\r\n\r\n // TODO: Set session cookies and redirect to payment page\r\n // For now, return success response\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n success: true,\r\n bookingId,\r\n message: \"Token validated successfully\",\r\n }),\r\n {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n } catch (error) {\r\n logger.error(\"Error validating pay token\", { error: error.message });\r\n return new Response(\"Internal server error\", {\r\n status: 500,\r\n headers: { \"Content-Type\": \"text/plain\" },\r\n });\r\n }\r\n }\r\n\r\n /**\r\n * Creates a new pay token for a booking\r\n * This would typically be called by admin or after booking creation\r\n */\r\n async createPayToken(bookingId: string, db: Database): Promise {\r\n const token = newPayToken();\r\n const issuedAt = new Date().toISOString();\r\n const expiresAt = new Date(\r\n Date.now() + 10 * 24 * 60 * 60 * 1000\r\n ).toISOString(); // 10 days\r\n\r\n await db.execute(\r\n `INSERT INTO app_pay_tokens (token, booking_id, issued_at, expires_at)\r\n VALUES (?, ?, ?, ?)`,\r\n [token, bookingId, issuedAt, expiresAt]\r\n );\r\n\r\n logger.info(\"Pay token created\", {\r\n token: token.substring(0, 8) + \"...\",\r\n bookingId,\r\n expiresAt,\r\n });\r\n\r\n return token;\r\n }\r\n\r\n /**\r\n * POST /api/v1/create-booking\r\n * body: { \"tourId\": \"tour-paris-explorer\" }\r\n * returns: { bookingId }\r\n */\r\n async createBooking(request: Request, db: Database): Promise {\r\n try {\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n const { tourId } = await request.json();\r\n\r\n if (!tourId) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"tourId required\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n const bookingId = await createBookingForTour(db, tourId);\r\n\r\n logger.info(\"Booking created from tour\", { tourId, bookingId });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ success: true, bookingId }), {\r\n status: 201,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n origin\r\n );\r\n } catch (err) {\r\n logger.error(\"Failed to create booking\", { error: err.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n /**\r\n * POST /api/v1/s/booking/generate-token\r\n * Admin-only endpoint to create secure, single-use tokens for shareable links\r\n * Security: API Key authentication\r\n */\r\n async generatePayToken(request: Request, db: Database): Promise {\r\n try {\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // 1. Validate API Key authentication\r\n const authHeader = request.headers.get(\"Authorization\");\r\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\r\n logger.warn(\"Missing or invalid Authorization header\", {\r\n ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\",\r\n });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: \"Authorization header required\" }),\r\n {\r\n status: 401,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n const providedKey = authHeader.substring(7); // Remove \"Bearer \"\r\n const expectedKey = Deno.env.get(\"MASTER_KEY\");\r\n\r\n if (!expectedKey || providedKey !== expectedKey) {\r\n logger.warn(\"Invalid admin API key\", {\r\n ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\",\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid API key\" }), {\r\n status: 401,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // 2. Parse and validate request body\r\n let body: any;\r\n try {\r\n body = await request.json();\r\n } catch (error) {\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: `Invalid JSON body ${error.message}` }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n const { bookingId } = body;\r\n\r\n if (!bookingId) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"bookingId required\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // 3. Validate booking exists\r\n const booking = await db.queryOne(\r\n \"SELECT id, title FROM app_tp_booking_orders WHERE id = ?\",\r\n [bookingId]\r\n );\r\n\r\n if (!booking) {\r\n logger.warn(\"Booking not found for pay token generation\", {\r\n bookingId,\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // 4. Generate secure pay token\r\n const token =\r\n crypto.randomUUID().replace(/-/g, \"\") +\r\n Array.from(crypto.getRandomValues(new Uint8Array(16)), (byte) =>\r\n byte.toString(16).padStart(2, \"0\")\r\n ).join(\"\");\r\n\r\n const issuedAt = new Date().toISOString();\r\n const expiresAt = new Date(\r\n Date.now() + 14 * 24 * 60 * 60 * 1000\r\n ).toISOString(); // 14 days\r\n\r\n // 5. Store pay token in database\r\n await db.execute(\r\n `\r\n INSERT INTO app_pay_tokens\r\n (token, booking_id, issued_at, expires_at, used)\r\n VALUES (?, ?, ?, ?, 0)\r\n `,\r\n [token, bookingId, issuedAt, expiresAt]\r\n );\r\n\r\n const shareableUrl = `${\r\n request.url.split(\"/api/\")[0]\r\n }/api/v1/booking/${token}`;\r\n\r\n logger.info(\"Pay token generated\", {\r\n bookingId,\r\n token: token.substring(0, 8) + \"...\",\r\n expiresAt,\r\n admin: true,\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n shareableUrl,\r\n }),\r\n {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n } catch (error) {\r\n logger.error(\"Error generating pay token\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n\r\n /**\r\n * GET /api/v1/s/booking/{token}\r\n * Get booking information using secure token-based authentication\r\n * Industry standard: URL path contains token, not booking ID for security\r\n * Also handles single-use pay token validation for shareable link flow\r\n */\r\n async getBookingDetails(request: Request, db: Database): Promise {\r\n try {\r\n const url = new URL(request.url);\r\n const pathParts = url.pathname.split(\"/\");\r\n const token = pathParts[pathParts.length - 1]; // Extract token from URL\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // 1. Validate token format\r\n if (!token || token === \"\" || token.length < 32) {\r\n logger.warn(\"Invalid or missing booking token\", {\r\n token: token?.substring(0, 8) + \"...\" || \"missing\",\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid booking token\" }), {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // 2. Validate and consume pay token (single-use)\r\n const tokenData = await db.queryOne(\r\n `\r\n SELECT booking_id, expires_at, used\r\n FROM app_pay_tokens\r\n WHERE token = ?\r\n `,\r\n [token]\r\n );\r\n\r\n if (!tokenData) {\r\n logger.warn(\"Pay token not found\", {\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n error: \"Token not found, expired, or already used\",\r\n }),\r\n {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 3. Check if token is expired or already used\r\n const now = new Date();\r\n const expiresAt = new Date(tokenData.expires_at);\r\n\r\n if (now > expiresAt || tokenData.used === 1) {\r\n logger.warn(\"Pay token expired or already used\", {\r\n token: token.substring(0, 8) + \"...\",\r\n expired: now > expiresAt,\r\n used: tokenData.used === 1,\r\n });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n error: \"Token not found, expired, or already used\",\r\n }),\r\n {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 4. Mark token as used (single-use enforcement)\r\n await db.execute(\r\n `\r\n UPDATE app_pay_tokens\r\n SET used = 1\r\n WHERE token = ?\r\n `,\r\n [token]\r\n );\r\n\r\n // 5. Get booking details\r\n const booking = await db.queryOne(\r\n `\r\n SELECT id, title, tour_code, amount, currency, status, description\r\n FROM app_tp_booking_orders\r\n WHERE id = ?\r\n `,\r\n [tokenData.booking_id]\r\n );\r\n\r\n if (!booking) {\r\n logger.error(\"Booking not found for valid token\", {\r\n bookingId: tokenData.booking_id,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // 6. Find matching tour data for complete details\r\n const tour = TOURS.find((t) => t.meta?.code === booking.tour_code);\r\n if (!tour) {\r\n logger.warn(\"Tour data not found for booking\", {\r\n tourCode: booking.tour_code,\r\n bookingId: booking.id,\r\n });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: \"Tour information not available\" }),\r\n {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n origin\r\n );\r\n }\r\n\r\n // 7. Create CSRF session for cookie seeding (same as tour endpoint)\r\n const csrfSession = createCSRFSession();\r\n\r\n // 8. Prepare response matching OpenAPI schema\r\n const bookingResponse = {\r\n bookingId: booking.id,\r\n tourId: tour.tourId,\r\n customerName: \"Customer\", // This would come from booking data in production\r\n status: booking.status,\r\n tour: {\r\n title: tour.title,\r\n description: tour.description,\r\n duration: tour.duration,\r\n datesAvailable: tour.datesAvailable,\r\n price: tour.price,\r\n currency: tour.currency,\r\n heroImageUrl: tour.heroImageUrl,\r\n gallery: tour.gallery,\r\n inclusions: tour.inclusions,\r\n exclusions: tour.exclusions,\r\n },\r\n };\r\n\r\n // 9. Create response with security headers\r\n const response = new Response(JSON.stringify(bookingResponse), {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"application/json\",\r\n \"Strict-Transport-Security\":\r\n \"max-age=31536000; includeSubDomains; preload\",\r\n \"Content-Security-Policy\":\r\n \"default-src 'self'; script-src 'self' https://challenges.cloudflare.com https://payuat.travelpay.com.au; style-src 'self' https://payuat.travelpay.com.au;\",\r\n },\r\n });\r\n\r\n // 10. Set CSRF cookies (SESSION and XSRF-TOKEN)\r\n const responseWithCookies = setCSRFCookies(response, csrfSession);\r\n\r\n logger.info(\"Booking details served via pay token\", {\r\n bookingId: booking.id,\r\n tourCode: booking.tour_code,\r\n token: token.substring(0, 8) + \"...\",\r\n sessionId: csrfSession.sessionId.substring(0, 8) + \"...\",\r\n });\r\n\r\n return addCorsHeaders(responseWithCookies, origin);\r\n } catch (error) {\r\n logger.error(\"Error serving booking details\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n\r\n /**\r\n * Alternative booking retrieval using AuthService validation\r\n * Used when we need to support both pay tokens and regular booking tokens\r\n */\r\n async getBooking(request: Request, db: Database): Promise {\r\n try {\r\n const url = new URL(request.url);\r\n const pathParts = url.pathname.split(\"/\");\r\n const token = pathParts[pathParts.length - 1]; // Extract token from /api/v1/booking/:token\r\n\r\n // Handle missing token (path ends with booking/)\r\n if (!token || token === \"\") {\r\n logger.warn(\"Missing booking token in path\");\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Route not found\" }), {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Validate token format\r\n if (token.length < 32) {\r\n logger.warn(\"Invalid booking token format\", {\r\n token: token?.substring(0, 8) + \"...\",\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid booking token\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Validate booking token\r\n const tokenValidation = await AuthService.validateBookingToken(db, token);\r\n if (!tokenValidation.valid) {\r\n logger.warn(\"Invalid or expired booking token\", {\r\n token: token.substring(0, 8) + \"...\",\r\n error: tokenValidation.error,\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: tokenValidation.error }), {\r\n status: 401,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Query booking from database using validated booking ID\r\n const booking = await db.queryOne(\"SELECT * FROM bookings WHERE id = ?\", [\r\n tokenValidation.bookingId,\r\n ]);\r\n\r\n if (!booking) {\r\n logger.warn(\"Booking not found\", {\r\n bookingId: tokenValidation.bookingId,\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Prepare booking response (no PII exposure)\r\n const bookingInfo: BookingInfo = {\r\n id: booking.id,\r\n title: booking.title,\r\n description: booking.description || \"\",\r\n amount: parseFloat(booking.amount),\r\n currency: booking.currency || \"USD\",\r\n status: booking.status || \"pending\",\r\n };\r\n\r\n logger.info(\"Booking retrieved successfully\", {\r\n bookingId: tokenValidation.bookingId,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n success: true,\r\n booking: bookingInfo,\r\n }),\r\n {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n } catch (error) {\r\n logger.error(\"Error retrieving booking\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n\r\n /**\r\n * Generate a new booking token for sharing (admin/API use)\r\n */\r\n async generateBookingToken(\r\n request: Request,\r\n db: Database\r\n ): Promise {\r\n try {\r\n // First parse and validate the request body\r\n let body: any;\r\n try {\r\n body = await request.json();\r\n } catch (error) {\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: `Invalid JSON body: ${error.message}` }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Check if nonce is present in the body\r\n if (!body.nonce) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Missing nonce parameter\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Validate nonce format\r\n if (\r\n typeof body.nonce !== \"string\" ||\r\n body.nonce.length !== 64 ||\r\n !/^[0-9a-f]+$/i.test(body.nonce)\r\n ) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid nonce format\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Now validate API key for token generation\r\n const apiValidation = AuthService.validateApiKey(request);\r\n if (!apiValidation.valid) {\r\n logger.warn(\"Unauthorized token generation attempt\", {\r\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n error: apiValidation.error,\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: apiValidation.error }), {\r\n status: 401,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n const { bookingId } = body;\r\n\r\n // Validate booking exists\r\n const validation = ValidationService.validateBookingId(bookingId);\r\n if (!validation.valid) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: validation.error }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n const booking = await db.queryOne(\r\n \"SELECT id FROM bookings WHERE id = ?\",\r\n [bookingId]\r\n );\r\n if (!booking) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n\r\n // Generate booking token\r\n const token = await AuthService.createBookingToken(\r\n db,\r\n bookingId,\r\n request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n request.headers.get(\"user-agent\") || undefined\r\n );\r\n\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n success: true,\r\n token,\r\n bookingId,\r\n shareableUrl: `/booking/${token}`,\r\n expiresIn: 24 * 60 * 60, // 24 hours in seconds\r\n }),\r\n {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n ),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n } catch (error) {\r\n logger.error(\"Error generating booking token\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n}\r\n\r\nexport const adminHandler = new AdminHandler();\r\nexport const bookingHandler = adminHandler; // Alias for backwards compatibility\r\nexport const newPaymentHandler = adminHandler; // Alias for payment handlers\r\n",[],[269,409,468],{"_104":477,"_96":478,"_156":479,"_158":410,"_159":141,"_160":480,"_162":22,"_106":481,"_100":32,"_164":235,"_166":482,"_167":22,"_168":-5,"_169":483,"_99":484},"48fbacec-5e6d-11f0-a4b5-0224a6c84d84","businessLogic.ts","48fbaed6-5e6d-11f0-a4b5-0224a6c84d84",578,["D",1752248391731],"/**\r\n * Business Logic Handlers\r\n *\r\n * Pure business logic functions that:\r\n * - Receive clean, validated data\r\n * - Have no knowledge of HTTP details (headers, status codes, etc.)\r\n * - Focus ONLY on business requirements\r\n * - Return plain data objects\r\n *\r\n * These functions are called by the dynamic handler system\r\n */\r\n\r\nimport { Database } from \"../database/database.ts\";\r\nimport { TOURS } from \"../data/tours.ts\";\r\nimport { generateNonce } from \"../utils/crypto.ts\";\r\nimport { TurnstileService } from \"../services/turnstileService.ts\";\r\nimport { PaymentFingerprintService } from \"../services/zenpayFingerprintService.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { DocsHandler } from \"./docsHandler.ts\";\r\n\r\ninterface BusinessLogicContext {\r\n body?: any;\r\n params?: any;\r\n query?: any;\r\n headers?: any;\r\n db: Database;\r\n correlationId?: string;\r\n request: Request;\r\n context: any;\r\n}\r\n\r\n// ========================================\r\n// Tours Business Logic\r\n// ========================================\r\n\r\nexport async function listTours(ctx: BusinessLogicContext) {\r\n // Pure business logic - just return the tours data\r\n return TOURS;\r\n}\r\n\r\nexport async function getTourDetails(ctx: BusinessLogicContext) {\r\n const { tourId } = ctx.params;\r\n\r\n const tour = TOURS.find((t) => t.tourId === tourId);\r\n if (!tour) {\r\n throw new Error(`Tour not found: ${tourId}`);\r\n }\r\n\r\n return tour;\r\n}\r\n\r\n// ========================================\r\n// Payment Business Logic\r\n// ========================================\r\n\r\nexport async function createNonce(ctx: BusinessLogicContext) {\r\n const { tourId, cfToken, email_verify } = ctx.body;\r\n\r\n // Get IP from headers (this is infrastructure detail)\r\n const ip =\r\n ctx.headers[\"cf-connecting-ip\"] ||\r\n ctx.headers[\"x-forwarded-for\"] ||\r\n \"unknown\";\r\n\r\n // 1. Honeypot bot detection\r\n if (email_verify !== \"🍯\") {\r\n // Return fake nonce to waste bot resources\r\n return {\r\n nonce: `fake_${generateNonce().substring(0, 32)}`,\r\n expiresIn: 60,\r\n };\r\n }\r\n\r\n // 2. Validate Turnstile token\r\n const turnstileValidation = await TurnstileService.validateToken(cfToken, ip);\r\n if (!turnstileValidation.valid) {\r\n throw new Error(`Bot detection failed: ${turnstileValidation.error}`);\r\n }\r\n\r\n // 3. Generate and store nonce\r\n const nonce = generateNonce();\r\n const issuedAt = new Date().toISOString();\r\n const expiresAt = new Date(Date.now() + 60 * 1000).toISOString();\r\n\r\n await ctx.db.execute(\r\n `INSERT INTO app_payment_nonces\r\n (nonce, booking_id, ip_address, issued_at, expires_at, used)\r\n VALUES (?, ?, ?, ?, ?, 0)`,\r\n [nonce, tourId, ip, issuedAt, expiresAt]\r\n );\r\n\r\n logger.info(\"Payment nonce created\", {\r\n tourId,\r\n ip,\r\n nonce: nonce.substring(0, 8) + \"...\",\r\n expiresAt,\r\n });\r\n\r\n return {\r\n nonce,\r\n expiresIn: 60,\r\n };\r\n}\r\n\r\nexport async function exchangeNonce(ctx: BusinessLogicContext) {\r\n const { tourId } = ctx.body;\r\n const nonce = ctx.headers[\"x-payment-nonce\"];\r\n\r\n if (!nonce) {\r\n throw new Error(\"X-Payment-Nonce header required\");\r\n }\r\n\r\n const ip =\r\n ctx.headers[\"cf-connecting-ip\"] ||\r\n ctx.headers[\"x-forwarded-for\"] ||\r\n \"unknown\";\r\n\r\n // Atomically validate and consume nonce\r\n const result = await ctx.db.execute(\r\n `UPDATE app_payment_nonces\r\n SET used = 1\r\n WHERE nonce = ? AND ip_address = ? AND used = 0 AND expires_at > datetime('now')`,\r\n [nonce, ip]\r\n );\r\n\r\n if (result.rowsAffected === 0) {\r\n throw new Error(\"Invalid, expired, or already used nonce\");\r\n }\r\n\r\n // Generate payment fingerprint\r\n const tour = TOURS.find((t) => t.tourId === tourId);\r\n if (!tour) {\r\n throw new Error(\"Tour not found\");\r\n }\r\n\r\n const paymentHashRequest = {\r\n apikey: environment.ZP_API_KEY,\r\n mode: \"0\",\r\n paymentAmount: tour.price.toString(),\r\n merchantUniquePaymentId:\r\n PaymentFingerprintService.generateMerchantUniquePaymentId(),\r\n timestamp: PaymentFingerprintService.generateTimestamp(),\r\n };\r\n\r\n const fingerprintResult =\r\n PaymentFingerprintService.generatePaymentHash(paymentHashRequest);\r\n\r\n return {\r\n fingerprint: fingerprintResult.fingerprint,\r\n paymentParams: {\r\n url: \"https://pay.travelpay.com.au/online/v5\",\r\n merchantCode: \"MERCHANT123\",\r\n apiKey: fingerprintResult.apiKey,\r\n redirectUrl: \"https://myapp.com/payment/return\",\r\n mode: fingerprintResult.mode,\r\n displayMode: 0,\r\n customerName: \"Customer\",\r\n customerReference: \"ABC123\",\r\n merchantUniquePaymentId: fingerprintResult.merchantUniquePaymentId,\r\n paymentAmount:\r\n parseInt(fingerprintResult.paymentAmount.replace(\".\", \"\")) ||\r\n tour.price * 100,\r\n timestamp: fingerprintResult.timestamp,\r\n },\r\n };\r\n}\r\n\r\nexport async function handlePaymentCallback(ctx: BusinessLogicContext) {\r\n const callbackData = ctx.body;\r\n\r\n logger.info(\"Payment callback received\", {\r\n merchantUniquePaymentId: callbackData.merchantUniquePaymentId,\r\n status: callbackData.status,\r\n });\r\n\r\n // Process the callback...\r\n // This is where you'd update payment status, send confirmations, etc.\r\n\r\n return {\r\n status: \"processed\",\r\n timestamp: new Date().toISOString(),\r\n };\r\n}\r\n\r\n// ========================================\r\n// Booking Business Logic\r\n// ========================================\r\n\r\nexport async function createBooking(ctx: BusinessLogicContext) {\r\n // TODO: Implement booking creation logic\r\n throw new Error(\"createBooking not yet implemented\");\r\n}\r\n\r\nexport async function getBookingDetails(ctx: BusinessLogicContext) {\r\n // TODO: Implement booking details logic\r\n throw new Error(\"getBookingDetails not yet implemented\");\r\n}\r\n\r\nexport async function getBookingBySlugAndId(ctx: BusinessLogicContext) {\r\n // TODO: Implement booking by slug logic\r\n throw new Error(\"getBookingBySlugAndId not yet implemented\");\r\n}\r\n\r\nexport async function generateBookingToken(ctx: BusinessLogicContext) {\r\n // TODO: Implement booking token generation\r\n throw new Error(\"generateBookingToken not yet implemented\");\r\n}\r\n\r\n// ========================================\r\n// Admin Business Logic\r\n// ========================================\r\n\r\nexport async function generatePayToken(ctx: BusinessLogicContext) {\r\n // TODO: Implement pay token generation\r\n throw new Error(\"generatePayToken not yet implemented\");\r\n}\r\n\r\nexport async function validatePayToken(ctx: BusinessLogicContext) {\r\n // TODO: Implement pay token validation\r\n throw new Error(\"validatePayToken not yet implemented\");\r\n}\r\n\r\n// ========================================\r\n// Documentation Business Logic (delegated to DocsHandler)\r\n// ========================================\r\n\r\nexport async function rootRedirect(ctx: BusinessLogicContext) {\r\n return {\r\n redirect: \"/api/v1/playground\",\r\n };\r\n}\r\n\r\nexport async function serveDocs(ctx: BusinessLogicContext) {\r\n // Delegate to DocsHandler for Swagger UI\r\n return DocsHandler.serveSwaggerDocs(ctx.request);\r\n}\r\n\r\nexport async function serveDocsV1(ctx: BusinessLogicContext) {\r\n // Delegate to DocsHandler for V1 Swagger UI\r\n return DocsHandler.serveSwaggerDocs(ctx.request);\r\n}\r\n\r\nexport async function serveRedocs(ctx: BusinessLogicContext) {\r\n // Delegate to DocsHandler for ReDoc\r\n return DocsHandler.serveRedocDocs(ctx.request);\r\n}\r\n\r\nexport async function serveRedocsV1(ctx: BusinessLogicContext) {\r\n // Delegate to DocsHandler for V1 ReDoc\r\n return DocsHandler.serveRedocDocs(ctx.request);\r\n}\r\n\r\nexport async function playgroundRedirect(ctx: BusinessLogicContext) {\r\n return {\r\n redirect: \"/api/v1/playground\",\r\n };\r\n}\r\n\r\nexport async function servePlayground(ctx: BusinessLogicContext) {\r\n // Delegate to DocsHandler for Fiberplane playground\r\n return DocsHandler.serveFiberplanePlayground(ctx.request);\r\n}\r\n\r\n// ========================================\r\n// System/Utility Business Logic\r\n// ========================================\r\n\r\nexport async function getRoutes(ctx: BusinessLogicContext) {\r\n // Return route information from OpenAPI spec\r\n const routes = [\r\n { method: \"GET\", path: \"/\", operationId: \"rootRedirect\" },\r\n { method: \"GET\", path: \"/docs\", operationId: \"serveDocs\" },\r\n { method: \"GET\", path: \"/redocs\", operationId: \"serveRedocs\" },\r\n { method: \"GET\", path: \"/playground\", operationId: \"playgroundRedirect\" },\r\n { method: \"GET\", path: \"/api/v1/docs\", operationId: \"serveDocsV1\" },\r\n { method: \"GET\", path: \"/api/v1/redocs\", operationId: \"serveRedocsV1\" },\r\n {\r\n method: \"GET\",\r\n path: \"/api/v1/playground\",\r\n operationId: \"servePlayground\",\r\n },\r\n { method: \"GET\", path: \"/api/v1/tour/tour-list\", operationId: \"listTours\" },\r\n // Add more routes as needed\r\n ];\r\n return routes;\r\n}\r\n\r\nexport async function getOpenApiSpec(ctx: BusinessLogicContext) {\r\n // Return the OpenAPI spec JSON\r\n try {\r\n const spec = await Deno.readTextFile(\"./openapi.json\");\r\n return new Response(spec, {\r\n headers: { \"Content-Type\": \"application/json\" },\r\n });\r\n } catch (error) {\r\n throw new Error(\"Failed to load OpenAPI specification\");\r\n }\r\n}\r\n\r\nexport async function getOpenApiSpecV1(ctx: BusinessLogicContext) {\r\n // Return the OpenAPI spec JSON for v1\r\n try {\r\n const spec = await Deno.readTextFile(\"./openapi.json\");\r\n return new Response(spec, {\r\n headers: { \"Content-Type\": \"application/json\" },\r\n });\r\n } catch (error) {\r\n throw new Error(\"Failed to load OpenAPI specification\");\r\n }\r\n}\r\n\r\nexport async function serveTurnstileTestPage(ctx: BusinessLogicContext) {\r\n return { message: \"Turnstile test page\" };\r\n}\r\n\r\nexport async function healthCheck(ctx: BusinessLogicContext) {\r\n return {\r\n status: \"healthy\",\r\n timestamp: new Date().toISOString(),\r\n version: \"1.0.0\",\r\n };\r\n}\r\n\r\nexport async function verifyTurnstile(ctx: BusinessLogicContext) {\r\n // TODO: Implement turnstile verification\r\n throw new Error(\"verifyTurnstile not yet implemented\");\r\n}\r\n",[],[269,409,478],{"_104":486,"_96":487,"_156":488,"_158":410,"_159":141,"_160":489,"_162":22,"_106":490,"_100":491,"_164":235,"_166":492,"_167":22,"_168":-5,"_169":493,"_99":494},"49c4b24a-5e6d-11f0-b8a6-0224a6c84d84","docsHandler.ts","b8afbbb4-5abc-11f0-abfd-f69ea79377d9",595,["D",1752248393045],7,"/**\r\n * Documentation Handler - Serves dynamic API documentation\r\n * Uses OpenAPI loader system to generate documentation pages with advanced Swagger UI features\r\n */\r\nimport { OpenAPILoader } from \"../utils/openApiLoader.ts\";\r\n\r\nexport class DocsHandler {\r\n /**\r\n * Serves enhanced API documentation using latest Swagger UI\r\n * Features: Request snippets, OAuth2, custom theming, error handling, deep linking\r\n */\r\n static serveSwaggerDocs(request: Request): Response {\r\n const url = new URL(request.url);\r\n // Ensure we use the correct URL for Val Town or local development\r\n const specUrl = `${url.origin}/api/v1/openapi.json`;\r\n\r\n console.log(`Swagger UI will fetch OpenAPI spec from: ${specUrl}`);\r\n const oauthRedirectUrl = `${url.origin}/docs/oauth2-redirect.html`;\r\n\r\n // Get the title from OpenAPI spec or use default\r\n const apiTitle = \"🛡️ ZenPay API Documentation 📚\";\r\n const apiTitleEscaped = JSON.stringify(apiTitle).slice(1, -1); // Remove the quotes that JSON.stringify adds\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${apiTitle}\r\n \r\n \r\n \r\n \r\n\r\n\r\n

\r\n

Loading API Documentation...

\r\n

\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n \"X-Frame-Options\": \"SAMEORIGIN\",\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n }\r\n\r\n /**\r\n * Serves OAuth2 redirect page for Swagger UI authentication\r\n */\r\n static serveOAuth2Redirect(): Response {\r\n const html = `\r\n\r\n\r\n\r\n \r\n OAuth2 Redirect\r\n\r\n\r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=86400\", // Cache for 24 hours\r\n },\r\n });\r\n }\r\n\r\n /**\r\n * Serves Redocly-style documentation with enhanced features\r\n */\r\n static serveRedocDocs(request: Request): Response {\r\n try {\r\n const url = new URL(request.url);\r\n const specUrl = `${url.origin}/api/v1/openapi.json`;\r\n console.log(`Redoc will fetch OpenAPI spec from: ${specUrl}`);\r\n\r\n const title = \"🛡️ ZenPay API Documentation 📚\";\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${title}\r\n \r\n \r\n\r\n\r\n

Loading API Documentation...

\r\n \r\n \r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n \"X-Frame-Options\": \"SAMEORIGIN\",\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n } catch (error) {\r\n // Return error page\r\n const errorHtml = `\r\n\r\n\r\n\r\n \r\n \r\n API Documentation Error\r\n \r\n\r\n\r\n

\r\n

API Documentation Unavailable

\r\n

The API documentation could not be loaded at this time.

\r\n

\r\n Error: ${error.message}\r\n

\r\n

This usually happens when:

\r\n

The OpenAPI specification file is not accessible
The server is still initializing
There's a configuration error

\r\n \r\n

\r\n\r\n`;\r\n\r\n return new Response(errorHtml, {\r\n status: 500,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n },\r\n });\r\n }\r\n }\r\n\r\n /**\r\n * Serves interactive Fiberplane playground for API testing\r\n */\r\n static async serveFiberplanePlayground(request: Request): Promise {\r\n try {\r\n const url = new URL(request.url);\r\n const specUrl = `${url.origin}/api/v1/openapi.json`;\r\n\r\n // Load OpenAPI spec for Fiberplane\r\n let openApiSpec;\r\n try {\r\n const specResponse = await fetch(specUrl);\r\n if (!specResponse.ok) {\r\n throw new Error(\r\n `Failed to fetch OpenAPI spec: ${specResponse.status}`\r\n );\r\n }\r\n openApiSpec = await specResponse.json();\r\n } catch (error) {\r\n console.error(\"Failed to load OpenAPI spec for Fiberplane:\", error);\r\n // Fallback to local file\r\n try {\r\n const localSpec = await Deno.readTextFile(\"./openapi.json\");\r\n openApiSpec = JSON.parse(localSpec);\r\n } catch (localError) {\r\n throw new Error(`Cannot load OpenAPI spec: ${error.message}`);\r\n }\r\n }\r\n\r\n const title = \"🛡️ ZenPay API Playground ⚔️\";\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${title}\r\n \r\n\r\n\r\n

\r\n

${title}

\r\n

Interactive API Testing Environment

\r\n

\r\n \r\n

\r\n

API Endpoints

\r\n

Loading API endpoints...

\r\n

\r\n \r\n

\r\n

Request Builder

\r\n

Select an endpoint from the left to start building a request.

\r\n

\r\n \r\n

\r\n

Response

\r\n

Ready to send requests...

\r\n

\r\n\r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n \"X-Frame-Options\": \"SAMEORIGIN\",\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n } catch (error) {\r\n console.error(\"Error in serveFiberplanePlayground:\", error);\r\n\r\n const errorHtml = `\r\n\r\n\r\n\r\n \r\n \r\n Playground Error\r\n \r\n\r\n\r\n

\r\n

API Playground Unavailable

\r\n

The API playground could not be loaded at this time.

\r\n

\r\n Error: ${error.message}\r\n

\r\n

This usually happens when:

\r\n

The OpenAPI specification file is not accessible
The server is still initializing
There's a configuration error

\r\n \r\n

\r\n\r\n`;\r\n\r\n return new Response(errorHtml, {\r\n status: 500,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n },\r\n });\r\n }\r\n }\r\n}\r\n",[],[269,409,487],{"_104":496,"_96":497,"_156":498,"_158":410,"_159":141,"_160":499,"_162":22,"_106":500,"_100":32,"_164":235,"_166":501,"_167":22,"_168":-5,"_169":502,"_99":503},"49156aec-5e6d-11f0-b051-0224a6c84d84","dynamicHandler.ts","49156b8c-5e6d-11f0-b051-0224a6c84d84",580,["D",1752248391742],"/**\r\n * Dynamic Handler System\r\n *\r\n * This creates a truly dynamic system where:\r\n * 1. OpenAPI handles ALL validation automatically\r\n * 2. Handler routing is automatic based on operationId\r\n * 3. Business logic is separated from HTTP handling\r\n * 4. Adding new endpoints requires NO code changes here\r\n */\r\n\r\n// Note: AppContext type should be Context from Hono\r\ntype AppContext = any;\r\nimport * as businessLogic from \"./businessLogic.ts\";\r\n\r\ninterface HandlerContext {\r\n request: Request;\r\n context: AppContext;\r\n operationId: string;\r\n validatedData?: any;\r\n}\r\n\r\n/**\r\n * Universal Dynamic Handler\r\n *\r\n * This single handler can process ANY OpenAPI operation:\r\n * - Request validation: ✅ Done by OpenAPI middleware\r\n * - Response validation: ✅ Done by OpenAPI middleware\r\n * - Parameter parsing: ✅ Done by OpenAPI middleware\r\n * - Handler routing: ✅ Done dynamically here\r\n * - Business logic: ✅ Delegated to business logic modules\r\n */\r\nexport async function dynamicHandler({\r\n request,\r\n context,\r\n operationId,\r\n validatedData,\r\n}: HandlerContext): Promise {\r\n try {\r\n // Convert operationId to function name (camelCase)\r\n const handlerName = operationId;\r\n\r\n // Get the business logic function\r\n const businessLogicFunction = (businessLogic as any)[handlerName];\r\n\r\n if (!businessLogicFunction) {\r\n console.warn(`No business logic found for operation: ${operationId}`);\r\n return new Response(\r\n JSON.stringify({ error: `Handler not implemented: ${operationId}` }),\r\n { status: 501, headers: { \"Content-Type\": \"application/json\" } }\r\n );\r\n }\r\n\r\n // Call business logic with clean, validated data\r\n const result = await businessLogicFunction({\r\n // Pre-validated data from OpenAPI\r\n body: validatedData?.body,\r\n params: validatedData?.params,\r\n query: validatedData?.query,\r\n headers: validatedData?.headers,\r\n\r\n // Context\r\n db: context.get(\"db\"),\r\n correlationId: context.get(\"debugCorrelationId\"),\r\n request: request,\r\n\r\n // Raw context for advanced usage\r\n context: context,\r\n });\r\n\r\n // Business logic returns either:\r\n // 1. A Response object (for custom responses)\r\n // 2. { redirect: \"/path\" } object (for redirects)\r\n // 3. { data, status, headers } object\r\n // 4. Data object (for JSON responses)\r\n if (result instanceof Response) {\r\n return result;\r\n }\r\n\r\n if (result && typeof result === \"object\" && \"redirect\" in result) {\r\n return new Response(null, {\r\n status: 302,\r\n headers: { Location: result.redirect },\r\n });\r\n }\r\n\r\n if (result && typeof result === \"object\" && \"data\" in result) {\r\n return context.json(result.data, result.status || 200, result.headers);\r\n }\r\n\r\n return context.json(result);\r\n } catch (error) {\r\n console.error(`Error in dynamic handler for ${operationId}:`, error);\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"Internal server error\",\r\n operationId: operationId,\r\n message: error.message,\r\n }),\r\n {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n );\r\n }\r\n}\r\n\r\n/**\r\n * Auto-Generate Handler Map\r\n *\r\n * This function automatically creates a handler map for ANY OpenAPI spec\r\n * by analyzing the operationIds and creating dynamic handlers for each\r\n */\r\nexport function createDynamicHandlerMap(operationIds: string[]) {\r\n const handlerMap: Record = {};\r\n\r\n for (const operationId of operationIds) {\r\n handlerMap[operationId] = ({\r\n request,\r\n context,\r\n params,\r\n query,\r\n body,\r\n headers,\r\n }: any) => {\r\n return dynamicHandler({\r\n request,\r\n context,\r\n operationId,\r\n validatedData: { params, query, body, headers },\r\n });\r\n };\r\n }\r\n\r\n return handlerMap;\r\n}\r\n\r\n/**\r\n * Extract Operation IDs from OpenAPI Spec\r\n */\r\nexport function extractOperationIds(openApiSpec: any): string[] {\r\n const operationIds: string[] = [];\r\n\r\n if (!openApiSpec.paths) return operationIds;\r\n\r\n for (const path in openApiSpec.paths) {\r\n const pathObj = openApiSpec.paths[path];\r\n\r\n for (const method in pathObj) {\r\n if (pathObj[method]?.operationId) {\r\n operationIds.push(pathObj[method].operationId);\r\n }\r\n }\r\n }\r\n\r\n return operationIds;\r\n}\r\n",[],[269,409,497],{"_104":505,"_96":506,"_156":507,"_158":410,"_159":141,"_160":508,"_162":22,"_106":509,"_100":32,"_164":235,"_166":510,"_167":22,"_168":-5,"_169":511,"_99":512},"49189a78-5e6d-11f0-a473-0224a6c84d84","errorHandler.ts","49189b0e-5e6d-11f0-a473-0224a6c84d84",581,["D",1752248391911],"// ==================================================\r\n// SECTION: Global Error Handler\r\n// ==================================================\r\n\r\nimport { logger } from \"../utils/logger.ts\";\r\n\r\n/**\r\n * Global error handler for Hono/Deno apps.\r\n * Usage: app.onError(globalErrorHandler)\r\n */\r\nexport function globalErrorHandler(err: unknown, c: any) {\r\n // Optionally log the error (with correlation/request id if you have it)\r\n const correlationId = c.get?.(\"debugCorrelationId\");\r\n if (correlationId) {\r\n logger.error(`[ERROR][${correlationId}]`, err);\r\n } else {\r\n logger.error(\"[ERROR]\", err);\r\n }\r\n\r\n // Decide on status code (default 500, unless handler threw a Response)\r\n const status = 500;\r\n if (err instanceof Response) return err; // If someone threw a Response, honor it\r\n\r\n // Hide sensitive error details in production, expose only generic error message\r\n const showStack = Deno.env.get(\"ENV\") === \"dev\";\r\n\r\n // Safely extract stack and message if available\r\n let stack: string | undefined = undefined;\r\n let message: string | undefined = undefined;\r\n if (showStack && typeof err === \"object\" && err !== null) {\r\n if (\"stack\" in err && typeof (err as { stack?: unknown }).stack === \"string\") {\r\n stack = (err as { stack: string }).stack;\r\n }\r\n if (\"message\" in err && typeof (err as { message?: unknown }).message === \"string\") {\r\n message = (err as { message: string }).message;\r\n }\r\n }\r\n\r\n return c.json(\r\n {\r\n error: \"Internal server error\",\r\n ...(showStack && { stack, message }),\r\n },\r\n status\r\n );\r\n}\r\n",[],[269,409,506],{"_104":514,"_96":515,"_156":516,"_158":410,"_159":141,"_160":517,"_162":22,"_106":518,"_100":32,"_164":235,"_166":519,"_167":22,"_168":-5,"_169":520,"_99":521},"492c35b0-5e6d-11f0-afd9-0224a6c84d84","fallbackHandler.ts","492c3696-5e6d-11f0-afd9-0224a6c84d84",582,["D",1752248392037],"/**\n * Fallback Handler - Provides graceful error handling when the OpenAPI specification fails to load.\n * This handler is registered when the OpenAPILoader encounters a critical error during initialization.\n */\nimport { OpenAPIHono } from \"npm:@hono/zod-openapi\";\nimport { environment } from \"../config/environment.ts\";\nimport { Database } from \"../database/database.ts\";\n\ninterface AppEnv {\n Variables: {\n db: Database;\n debugCorrelationId: string;\n };\n}\n\n/**\n * Creates and registers a fallback handler on the Hono app instance.\n * This handler catches all requests and returns a user-friendly error page\n * or a JSON error, depending on the request path.\n *\n * @param app The Hono app instance to register the handler on.\n * @param loaderError The error that occurred during OpenAPI loader initialization.\n */\nexport function registerFallbackHandler(\n app: OpenAPIHono<{ Variables: AppEnv[\"Variables\"] }>,\n loaderError: Error\n) {\n app.all(\"*\", (c) => {\n const path = new URL(c.req.url).pathname;\n\n // For root, /api, or /api/v1, serve a detailed HTML error page\n if (path === \"/\" || path === \"/api\" || path === \"/api/v1\") {\n return c.html(\n `\n \n \n \n API Server - Configuration Error\n \n \n \n

🚨 API Server Configuration Error

\n INITIALIZATION FAILED\n \n

\n Error: ${loaderError?.message || \"Unknown error\"}\n

\n \n

What happened?

The server failed to load the OpenAPI specification during startup. This prevents the API from functioning properly.

\n \n

Common causes:

Environment variables not set correctly - Check OPENAPI_BLOB_KEY and OPENAPI_PUBLIC_URL
OpenAPI spec file not accessible - Verify the URL is correct and publicly accessible
Network connectivity issues - The server couldn't fetch the spec from the URL
Invalid OpenAPI specification - The spec file might have syntax errors

\n \n

Current Configuration:

APP_ENV: ${environment.APP_ENV}\nOPENAPI_BLOB_KEY: ${environment.OPENAPI_BLOB_KEY || \"(not set)\"}\nOPENAPI_PUBLIC_URL: ${environment.OPENAPI_PUBLIC_URL || \"(not set)\"}

\n \n

How to fix:

Check your Val Town environment variables
Ensure OPENAPI_BLOB_KEY is set to a valid key (e.g., \"openapi-spec\")
Ensure OPENAPI_PUBLIC_URL points to your OpenAPI JSON file
Verify the OpenAPI file is accessible by opening the URL in a browser
Check the server logs for more detailed error information

\n \n \n `,\n 500\n );\n }\n\n // For all other API paths, return a JSON error\n return c.json(\n {\n error: \"Server initialization failed\",\n message: \"The OpenAPI specification could not be loaded\",\n details: loaderError?.message || \"Unknown error\",\n path: path,\n timestamp: new Date().toISOString(),\n },\n 500\n );\n });\n}\n",[],[269,409,515],{"_104":523,"_96":524,"_156":525,"_158":410,"_159":141,"_160":526,"_162":22,"_106":527,"_100":528,"_164":235,"_166":529,"_167":22,"_168":-5,"_169":530,"_99":531},"49c92276-5e6d-11f0-922b-0224a6c84d84","tourHandler.ts","8c87aae8-5a93-11f0-b333-f69ea79377d9",596,["D",1752248393073],9,"/**\r\n * Tour Handler - implements GET /api/v1/tour/{id} and GET /api/v1/tour/tour-list\r\n * Seeds SESSION and XSRF-TOKEN cookies as specified in SOLUTION.md\r\n */\r\nimport { Context } from \"https://esm.sh/hono@4.2.7\";\r\nimport { Database } from \"../database/database.ts\";\r\nimport { TOURS, Tour } from \"../data/tours.ts\";\r\nimport { createCSRFSession, setCSRFCookies, CSRFSession } from \"../middleware/csrf.ts\";\r\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\r\nimport { getSecurityHeaders } from \"../middleware/csp.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\n\r\n\r\n/**\r\n * Availability entry with structured status\r\n */\r\ninterface AvailabilityEntry {\r\n date: string;\r\n available: boolean;\r\n spots_remaining?: number;\r\n}\r\n\r\n/**\r\n * Itinerary entry with timeline\r\n */\r\ninterface ItineraryEntry {\r\n time: string;\r\n activity: string;\r\n location?: string;\r\n duration?: string;\r\n}\r\n\r\n/**\r\n * Group size constraints\r\n */\r\ninterface GroupSize {\r\n min: number;\r\n max: number;\r\n}\r\n\r\n/**\r\n * Age restrictions\r\n */\r\ninterface AgeRestrictions {\r\n min_age?: number;\r\n max_age?: number;\r\n adult_supervision_required?: boolean;\r\n}\r\n\r\n/**\r\n * Accessibility information\r\n */\r\ninterface Accessibility {\r\n wheelchair_accessible?: boolean;\r\n mobility_notes?: string;\r\n visual_impairment_friendly?: boolean;\r\n hearing_impairment_friendly?: boolean;\r\n}\r\n\r\n/**\r\n * Extended Tour interface with all new fields\r\n */\r\ninterface ExtendedTour extends Tour {\r\n // Alternative naming fields (name is already required in base Tour)\r\n short_description?: string;\r\n long_description?: string;\r\n from_price_display?: number;\r\n image_url?: string;\r\n images?: string[];\r\n\r\n // Location fields\r\n start_location?: string;\r\n end_location?: string;\r\n pickup_points?: string[];\r\n\r\n // Categorization\r\n category?: string;\r\n tags?: string[];\r\n\r\n // Structured availability\r\n availability?: AvailabilityEntry[];\r\n\r\n // Detailed itinerary\r\n itinerary?: ItineraryEntry[];\r\n\r\n // Business fields\r\n terms_and_conditions?: string;\r\n tour_url?: string;\r\n\r\n // Tour characteristics\r\n group_size?: GroupSize;\r\n difficulty?: 'easy' | 'moderate' | 'challenging' | 'expert';\r\n age_restrictions?: AgeRestrictions;\r\n accessibility?: Accessibility;\r\n}\r\n\r\n// === Request/Response Types ===\r\n\r\n/**\r\n * Path parameters for GET /api/v1/tour/{id}\r\n */\r\ninterface GetTourDetailsParams {\r\n id: string;\r\n}\r\n\r\n/**\r\n * Query parameters for GET /api/v1/tour/tour-list\r\n */\r\ninterface ListToursQueryParams {\r\n page?: string;\r\n limit?: string;\r\n featured?: string;\r\n}\r\n\r\n/**\r\n * Parsed pagination parameters with validation\r\n */\r\ninterface PaginationParams {\r\n page: number;\r\n limit: number;\r\n featured?: boolean;\r\n}\r\n\r\n/**\r\n * Pagination metadata\r\n */\r\ninterface PaginationMeta {\r\n page: number;\r\n limit: number;\r\n total: number;\r\n totalPages: number;\r\n hasNext: boolean;\r\n hasPrev: boolean;\r\n}\r\n\r\n/**\r\n * Tour details response (matches OpenAPI schema)\r\n */\r\ninterface TourDetailsResponse extends ExtendedTour {\r\n // Explicitly typed to match ExtendedTour interface with all enriched fields\r\n}\r\n\r\n/**\r\n * Paginated tours response\r\n */\r\ninterface PaginatedToursResponse {\r\n tours: ExtendedTour[];\r\n pagination: PaginationMeta;\r\n}\r\n\r\n/**\r\n * Standard error response\r\n */\r\ninterface ErrorResponse {\r\n error: string;\r\n details?: string | string[];\r\n}\r\n\r\n/**\r\n * Tour handler context interface\r\n */\r\ninterface TourHandlerContext {\r\n req: {\r\n param: (key: string) => string;\r\n };\r\n}\r\n\r\n// === Handler Method Signatures ===\r\n\r\n/**\r\n * Tour handler method type for consistency\r\n */\r\ntype TourHandlerMethod = (\r\n request: Request,\r\n db: Database,\r\n context?: Context | TourHandlerContext\r\n) => Response;\r\n\r\nclass TourHandler {\r\n /**\r\n * GET /api/v1/tour/{id}\r\n * Returns tour details and seeds SESSION & XSRF-TOKEN cookies\r\n */\r\n getTourDetails(request: Request, _db: Database, context?: Context | TourHandlerContext): Response {\r\n try {\r\n const url = new URL(request.url);\r\n const origin: string | null = request.headers.get(\"origin\");\r\n\r\n // Get tour ID from Hono path parameter (via context) or fallback to manual parsing\r\n let tourId: string;\r\n if (context && context.req && context.req.param) {\r\n tourId = context.req.param('id');\r\n console.log(`🔍 DEBUG: Got tourId from Hono context: \"${tourId}\"`);\r\n } else {\r\n // Fallback: manual path parsing\r\n const pathParts = url.pathname.split('/');\r\n tourId = pathParts[pathParts.length - 1];\r\n console.log(`🔍 DEBUG: Got tourId from manual parsing: \"${tourId}\"`);\r\n console.log(`🔍 DEBUG: Full pathname: \"${url.pathname}\"`);\r\n console.log(`🔍 DEBUG: Path parts:`, pathParts);\r\n }\r\n\r\n // Validate tour ID format\r\n if (!tourId || tourId === '' || tourId === 'tour') {\r\n const errorResponse: ErrorResponse = {\r\n error: \"Validation failed\",\r\n details: [\"id: Required\"]\r\n };\r\n\r\n logger.warn(\"Validation failed in getTourDetails\", {\r\n path: url.pathname,\r\n received: { tourId },\r\n errors: errorResponse.details\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(errorResponse), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Find tour in static data\r\n const tour: ExtendedTour | undefined = TOURS.find(t => t.tourId === tourId) as ExtendedTour;\r\n if (!tour) {\r\n const errorResponse: ErrorResponse = {\r\n error: \"Tour not found\"\r\n };\r\n\r\n logger.warn(\"Tour not found\", { tourId });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(errorResponse), {\r\n status: 404,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Create CSRF session for cookie seeding\r\n const csrfSession: CSRFSession = createCSRFSession();\r\n\r\n // Prepare tour response matching OpenAPI schema\r\n // Spread all tour properties to include any extended fields\r\n const tourResponse: TourDetailsResponse = {\r\n ...tour // This will include all fields from the tour object\r\n };\r\n\r\n // Create response with tour data\r\n const response = new Response(JSON.stringify(tourResponse), {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"application/json\",\r\n // Add security headers from CSP middleware\r\n ...getSecurityHeaders()\r\n }\r\n });\r\n\r\n // Set CSRF cookies (SESSION and XSRF-TOKEN)\r\n const responseWithCookies = setCSRFCookies(response, csrfSession);\r\n\r\n logger.info(\"Tour details served with session cookies\", {\r\n tourId,\r\n sessionId: csrfSession.sessionId.substring(0, 8) + \"...\"\r\n });\r\n\r\n return addCorsHeaders(responseWithCookies, origin);\r\n\r\n } catch (error) {\r\n const errorResponse: ErrorResponse = {\r\n error: \"Internal server error\"\r\n };\r\n\r\n logger.error(\"Error serving tour details\", {\r\n error: error instanceof Error ? error.message : String(error)\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(errorResponse), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n\r\n /**\r\n * GET /api/v1/tour/tour-list\r\n * Returns paginated list of tours (max 10 per page)\r\n */\r\n listTours(request: Request, _db: Database, _context?: Context | TourHandlerContext): Response {\r\n try {\r\n const url = new URL(request.url);\r\n const origin: string | null = request.headers.get(\"origin\");\r\n\r\n // Parse query parameters\r\n const queryParams: ListToursQueryParams = {\r\n page: url.searchParams.get(\"page\") || undefined,\r\n limit: url.searchParams.get(\"limit\") || undefined,\r\n featured: url.searchParams.get(\"featured\") || undefined\r\n };\r\n\r\n const params: PaginationParams = {\r\n page: queryParams.page ? Math.max(1, parseInt(queryParams.page)) : 1,\r\n limit: queryParams.limit ? Math.min(10, Math.max(1, parseInt(queryParams.limit))) : 10,\r\n featured: queryParams.featured === \"true\" ? true : queryParams.featured === \"false\" ? false : undefined\r\n };\r\n\r\n // Validate parameters\r\n if (isNaN(params.page) || params.page < 1) {\r\n const errorResponse: ErrorResponse = {\r\n error: \"Validation failed\",\r\n details: [\"page: Must be a positive integer\"]\r\n };\r\n\r\n logger.warn(\"Invalid page parameter\", { page: queryParams.page });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(errorResponse), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n if (isNaN(params.limit) || params.limit < 1 || params.limit > 10) {\r\n const errorResponse: ErrorResponse = {\r\n error: \"Validation failed\",\r\n details: [\"limit: Must be between 1 and 10\"]\r\n };\r\n\r\n logger.warn(\"Invalid limit parameter\", { limit: queryParams.limit });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(errorResponse), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Filter tours if featured parameter is provided\r\n let filteredTours: ExtendedTour[] = TOURS as ExtendedTour[];\r\n if (params.featured !== undefined) {\r\n filteredTours = TOURS.filter((tour: ExtendedTour) => {\r\n const isFeatured: boolean = tour.meta?.featured === true;\r\n return params.featured ? isFeatured : !isFeatured;\r\n }) as ExtendedTour[];\r\n }\r\n\r\n // Calculate pagination\r\n const total: number = filteredTours.length;\r\n const totalPages: number = Math.ceil(total / params.limit);\r\n const startIndex: number = (params.page - 1) * params.limit;\r\n const endIndex: number = startIndex + params.limit;\r\n\r\n // Get tours for current page\r\n const paginatedTours: ExtendedTour[] = filteredTours.slice(startIndex, endIndex);\r\n\r\n // Build pagination metadata\r\n const paginationMeta: PaginationMeta = {\r\n page: params.page,\r\n limit: params.limit,\r\n total,\r\n totalPages,\r\n hasNext: params.page < totalPages,\r\n hasPrev: params.page > 1\r\n };\r\n\r\n // Build response\r\n const response: PaginatedToursResponse = {\r\n tours: paginatedTours,\r\n pagination: paginationMeta\r\n };\r\n\r\n logger.info(\"Tours list served\", {\r\n page: params.page,\r\n limit: params.limit,\r\n total,\r\n filtered: params.featured !== undefined,\r\n featuredOnly: params.featured\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(response), {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n\r\n } catch (error) {\r\n const errorResponse: ErrorResponse = {\r\n error: \"Internal server error\",\r\n details: \"Failed to retrieve tours list\"\r\n };\r\n\r\n logger.error(\"Error in listTours handler\", {\r\n error: error instanceof Error ? error.message : String(error),\r\n url: request.url\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(errorResponse), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n}\r\n\r\nexport const tourHandler = new TourHandler();",[],[269,409,524],{"_104":533,"_96":534,"_156":535,"_158":410,"_159":141,"_160":536,"_162":22,"_106":537,"_100":538,"_164":235,"_166":539,"_167":22,"_168":-5,"_169":540,"_99":541},"49d37596-5e6d-11f0-922b-0224a6c84d84","turnstileHandler.ts","9fcbee3e-58a9-11f0-9ead-f69ea79377d9",597,["D",1752248393140],11,"import { ValidationService } from \"../services/validationService.ts\";\r\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\nclass TurnstileHandler {\r\n /**\r\n * Serves an HTML page with Cloudflare Turnstile widget for token generation\r\n * This is for testing purposes only to verify Turnstile integration\r\n */\r\n serveTurnstileTestPage(_request: Request): Response {\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n Turnstile Token Generator\r\n \r\n \r\n\r\n\r\n

\r\n

Turnstile Token Generator

\r\n \r\n

\r\n

Site Key: 0x4AAAAAABjPDL4GDo6BXFza

\r\n

This page generates real Cloudflare Turnstile tokens for testing the payment flow.

\r\n

The token will be valid for 90 seconds once generated.

\r\n

\r\n\r\n \r\n \r\n

\r\n Generated Token:
\r\n \r\n

\r\n \r\n

\r\n \r\n

\r\n

\r\n\r\n \r\n\r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"no-cache, no-store, must-revalidate\"\r\n }\r\n });\r\n }\r\n\r\n async verifyTurnstile(request: Request): Promise {\r\n try {\r\n const ip = request.headers.get(\"cf-connecting-ip\") || \r\n request.headers.get(\"x-forwarded-for\") || \r\n \"unknown\";\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // Parse request body\r\n let body: any;\r\n try {\r\n body = await request.json();\r\n } catch (_error) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid JSON body\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Check for required fields\r\n if (!body || typeof body !== 'object') {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Request body required\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n const { token, remoteip } = body;\r\n\r\n // Validate token is present\r\n if (!token) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Token required\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Validate remoteip is present\r\n if (!remoteip) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Remote IP required\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Validate IP format\r\n const ipRegex = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/;\r\n if (!ipRegex.test(remoteip)) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid IP format\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Validate token length\r\n if (token.length > 2048) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Token too long\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Validate token format\r\n const validation = ValidationService.validateTurnstileToken(token);\r\n if (!validation.valid) {\r\n logger.warn(\"Invalid Turnstile token format\", { ip, error: validation.error });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: validation.error }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n // Verify token with Cloudflare Turnstile API\r\n const turnstileSecret = environment.TURNSTILE_SECRET_KEY;\r\n if (!turnstileSecret) {\r\n logger.error(\"Turnstile secret key not configured\");\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Turnstile verification not configured\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n const verificationResponse = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\r\n method: 'POST',\r\n headers: {\r\n 'Content-Type': 'application/x-www-form-urlencoded',\r\n },\r\n body: new URLSearchParams({\r\n secret: turnstileSecret,\r\n response: token,\r\n remoteip: ip\r\n })\r\n });\r\n\r\n const verificationResult = await verificationResponse.json();\r\n\r\n if (!verificationResult.success) {\r\n logger.warn(\"Turnstile verification failed\", { \r\n ip, \r\n errors: verificationResult['error-codes'] || [] \r\n });\r\n \r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ \r\n success: false,\r\n error: \"Turnstile verification failed\",\r\n details: verificationResult['error-codes'] || []\r\n }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n }\r\n\r\n logger.info(\"Turnstile verification successful\", { ip });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({\r\n success: true,\r\n message: \"Turnstile verification successful\"\r\n }), {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n origin\r\n );\r\n\r\n } catch (error) {\r\n logger.error(\"Error verifying Turnstile token\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n }),\r\n request.headers.get(\"origin\") || undefined\r\n );\r\n }\r\n }\r\n}\r\n\r\nexport const turnstileHandler = new TurnstileHandler();\r\n",[],[269,409,534],{"_104":543,"_96":544,"_156":545,"_158":410,"_159":141,"_160":546,"_162":22,"_106":547,"_100":340,"_164":235,"_166":548,"_167":22,"_168":-5,"_169":549,"_99":550},"49ec7064-5e6d-11f0-8d99-0224a6c84d84","webhookHandler.ts","9fcf371a-58a9-11f0-bc15-f69ea79377d9",598,["D",1752248393307],"import { Database } from \"../database/database.ts\";\r\nimport { AuthService } from \"../services/authService.ts\";\r\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { blob } from \"https://esm.town/v/std/blob\";\r\n\r\nexport interface WebhookResponse {\r\n id: string;\r\n timestamp: string;\r\n status: string;\r\n message: string;\r\n receivedAt: string;\r\n payloadSize: number;\r\n headers: Record;\r\n}\r\n\r\nclass WebhookHandler {\r\n /**\r\n * Generic webhook endpoint that accepts any JSON payload\r\n * Requires API key authentication via header or query parameter\r\n */\r\n async handleWebhook(request: Request, db: Database): Promise {\r\n try {\r\n // Parse JSON payload first to validate input\r\n let payload: any;\r\n try {\r\n payload = await request.json();\r\n } catch (error) {\r\n logger.warn(\"Webhook invalid JSON payload\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid JSON payload\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Validate payload is not empty\r\n if (!payload || Object.keys(payload).length === 0) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Empty webhook body\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Validate event type if present\r\n if (payload.event && typeof payload.event === \"string\") {\r\n const _validEvents = [\r\n \"payment.completed\",\r\n \"payment.failed\",\r\n \"subscription.created\",\r\n \"subscription.cancelled\",\r\n ];\r\n if (!payload.event.includes(\".\")) {\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({ error: \"Invalid event type format\" }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n },\r\n ),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n }\r\n\r\n // Now validate API key after input validation\r\n const apiValidation = AuthService.validateApiKey(request);\r\n if (!apiValidation.valid) {\r\n logger.warn(\"Webhook unauthorized access attempt\", {\r\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n userAgent: request.headers.get(\"user-agent\") || \"unknown\",\r\n error: apiValidation.error,\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: apiValidation.error }), {\r\n status: 401,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Generate webhook response\r\n const webhookId = crypto.randomUUID();\r\n const timestamp = new Date().toISOString();\r\n const payloadSize = JSON.stringify(payload).length;\r\n\r\n // Extract relevant headers for logging\r\n const relevantHeaders: Record = {};\r\n request.headers.forEach((value, key) => {\r\n if (\r\n key.toLowerCase().includes(\"content-\") ||\r\n key.toLowerCase().includes(\"x-\") ||\r\n key.toLowerCase() === \"user-agent\"\r\n ) {\r\n relevantHeaders[key] = value;\r\n }\r\n });\r\n\r\n // Log webhook receipt\r\n logger.info(\"Webhook received\", {\r\n id: webhookId,\r\n payloadSize,\r\n headers: relevantHeaders,\r\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n });\r\n\r\n // Store webhook data (optional - for audit purposes)\r\n await db.execute(\r\n \"INSERT INTO webhook_logs (id, payload, headers, ip_address, timestamp) VALUES (?, ?, ?, ?, ?)\",\r\n [\r\n webhookId,\r\n JSON.stringify(payload),\r\n JSON.stringify(relevantHeaders),\r\n request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n timestamp,\r\n ],\r\n );\r\n\r\n // Save webhook payload to blob storage\r\n try {\r\n const nowDate = new Date(timestamp);\r\n const y = nowDate.getFullYear();\r\n const m = String(nowDate.getMonth() + 1).padStart(2, \"0\");\r\n const d = String(nowDate.getDate()).padStart(2, \"0\");\r\n const hh = String(nowDate.getHours()).padStart(2, \"0\");\r\n const mm = String(nowDate.getMinutes()).padStart(2, \"0\");\r\n const ss = String(nowDate.getSeconds()).padStart(2, \"0\");\r\n const blobKey =\r\n `webhook/sys/${y}${m}${d}-${hh}${mm}${ss}-${webhookId}.json`;\r\n await blob.setJSON(blobKey, payload);\r\n } catch (e) {\r\n logger.warn(\"Failed to save webhook payload to blob storage\", {\r\n error: e.message,\r\n });\r\n }\r\n\r\n // Prepare response\r\n const response: WebhookResponse = {\r\n id: webhookId,\r\n timestamp,\r\n status: \"received\",\r\n message: \"Webhook processed successfully\",\r\n receivedAt: timestamp,\r\n payloadSize,\r\n headers: relevantHeaders,\r\n };\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify(response), {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n } catch (error) {\r\n logger.error(\"Webhook processing error\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n }\r\n\r\n /**\r\n * OAuth/Payment callback endpoint\r\n * Handles callbacks with state parameter validation\r\n */\r\n async handleCallback(request: Request, db: Database): Promise {\r\n try {\r\n // Parse JSON payload first to validate input\r\n let payload: any;\r\n try {\r\n payload = await request.json();\r\n } catch (error) {\r\n logger.warn(\"Callback invalid JSON payload\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid JSON payload\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Validate payload is not empty\r\n if (!payload || Object.keys(payload).length === 0) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Empty callback body\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Check for required state parameter (CSRF protection)\r\n if (!payload.state) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Missing state parameter\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Validate state format\r\n if (typeof payload.state !== \"string\" || payload.state.length < 32) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Invalid state format\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Check for error callbacks\r\n if (payload.error) {\r\n logger.warn(\"Error callback received\", {\r\n error: payload.error,\r\n errorDescription: payload.error_description,\r\n state: payload.state.substring(0, 8) + \"...\",\r\n });\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n error: \"Callback error\",\r\n details: payload.error,\r\n description: payload.error_description,\r\n }),\r\n {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n },\r\n ),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Validate provider if present\r\n if (payload.provider && typeof payload.provider === \"string\") {\r\n const validProviders = [\r\n \"oauth_provider\",\r\n \"payment_provider\",\r\n \"google\",\r\n \"github\",\r\n \"stripe\",\r\n \"paypal\",\r\n ];\r\n if (!validProviders.includes(payload.provider)) {\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Unknown provider\" }), {\r\n status: 400,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n }\r\n\r\n // Check for CSRF attack indicators\r\n const origin = request.headers.get(\"origin\");\r\n const referer = request.headers.get(\"referer\");\r\n if (origin && origin.includes(\"evil-site.com\")) {\r\n logger.warn(\"Potential CSRF attack detected\", {\r\n origin,\r\n referer,\r\n state: payload.state.substring(0, 8) + \"...\",\r\n });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Forbidden\" }), {\r\n status: 403,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Now validate API key after input validation\r\n const apiValidation = AuthService.validateApiKey(request);\r\n if (!apiValidation.valid) {\r\n logger.warn(\"Callback unauthorized access attempt\", {\r\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n userAgent: request.headers.get(\"user-agent\") || \"unknown\",\r\n error: apiValidation.error,\r\n });\r\n\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: apiValidation.error }), {\r\n status: 401,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n\r\n // Generate callback response\r\n const callbackId = crypto.randomUUID();\r\n const timestamp = new Date().toISOString();\r\n\r\n // Log callback receipt\r\n logger.info(\"Callback received\", {\r\n id: callbackId,\r\n state: payload.state.substring(0, 8) + \"...\",\r\n provider: payload.provider,\r\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n });\r\n\r\n // Store callback data for audit\r\n await db.execute(\r\n \"INSERT INTO callback_logs (id, payload, state, ip_address, timestamp) VALUES (?, ?, ?, ?, ?)\",\r\n [\r\n callbackId,\r\n JSON.stringify(payload),\r\n payload.state,\r\n request.headers.get(\"x-forwarded-for\") || \"unknown\",\r\n timestamp,\r\n ],\r\n );\r\n\r\n // Save callback payload to blob storage\r\n try {\r\n const nowDate = new Date(timestamp);\r\n const y = nowDate.getFullYear();\r\n const m = String(nowDate.getMonth() + 1).padStart(2, \"0\");\r\n const d = String(nowDate.getDate()).padStart(2, \"0\");\r\n const hh = String(nowDate.getHours()).padStart(2, \"0\");\r\n const mm = String(nowDate.getMinutes()).padStart(2, \"0\");\r\n const ss = String(nowDate.getSeconds()).padStart(2, \"0\");\r\n const blobKey =\r\n `callback/sys/${y}${m}${d}-${hh}${mm}${ss}-${callbackId}.json`;\r\n await blob.setJSON(blobKey, payload);\r\n } catch (e) {\r\n logger.warn(\"Failed to save callback payload to blob storage\", {\r\n error: e.message,\r\n });\r\n }\r\n\r\n return addCorsHeaders(\r\n new Response(\r\n JSON.stringify({\r\n id: callbackId,\r\n timestamp,\r\n status: \"processed\",\r\n message: \"Callback processed successfully\",\r\n state: payload.state,\r\n }),\r\n {\r\n status: 200,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n },\r\n ),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n } catch (error) {\r\n logger.error(\"Callback processing error\", { error: error.message });\r\n return addCorsHeaders(\r\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }),\r\n request.headers.get(\"origin\") || undefined,\r\n );\r\n }\r\n }\r\n}\r\n\r\nexport const webhookHandler = new WebhookHandler();\r\n",[],[269,409,544],[269,409],{"_104":553,"_96":554,"_156":555,"_158":270,"_159":141,"_160":340,"_162":118,"_106":556,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":557,"_99":659},"9e985f7a-58a9-11f0-bc5c-f69ea79377d9","middleware","9e986038-58a9-11f0-bc5c-f69ea79377d9",["D",1751614598193],[558,567,576,586,595,604,613,622,632,641,650],{"_104":559,"_96":560,"_156":561,"_158":555,"_159":141,"_160":562,"_162":118,"_106":563,"_100":323,"_164":235,"_166":564,"_167":22,"_168":-5,"_169":565,"_99":566},"49f0bf66-5e6d-11f0-b4d7-0224a6c84d84","basicAuth.ts","ca99c48a-5c67-11f0-b675-0224a6c84d84",599,["D",1752248393335],"/**\r\n * Basic Authentication Middleware using Hono's built-in basicAuth\r\n * Provides HTTP Basic Authentication for admin and webhook endpoints\r\n */\r\n\r\nimport { basicAuth } from \"npm:hono/basic-auth\";\r\nimport type { Context } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\n\r\n/**\r\n * Creates basic auth middleware for admin endpoints\r\n * Uses environment variables for credentials\r\n */\r\nexport function createBasicAuthMiddleware() {\r\n return basicAuth({\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n realm: \"ZenServer Admin Area\",\r\n invalidUserMessage: {\r\n error: \"Unauthorized\",\r\n message: \"Invalid username or password\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware with custom user verification\r\n * Allows for dynamic user validation against database or external service\r\n */\r\nexport function createDynamicBasicAuthMiddleware(\r\n verifyUser: (\r\n username: string,\r\n password: string,\r\n c: Context\r\n ) => boolean | Promise\r\n) {\r\n return basicAuth({\r\n verifyUser: async (username: string, password: string, c: Context) => {\r\n try {\r\n const isValid = await verifyUser(username, password, c);\r\n\r\n if (!isValid) {\r\n logger.warn(\"Basic auth failed\", {\r\n username,\r\n ip: getClientIP(c),\r\n userAgent: c.req.header(\"user-agent\"),\r\n });\r\n }\r\n\r\n return isValid;\r\n } catch (error) {\r\n logger.error(\"Basic auth verification error\", {\r\n error: error.message,\r\n username,\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer Secure Area\",\r\n invalidUserMessage: {\r\n error: \"Authentication failed\",\r\n message: \"Invalid credentials\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware for webhook endpoints\r\n * Uses webhook-specific credentials\r\n */\r\nexport function createWebhookBasicAuthMiddleware() {\r\n return basicAuth({\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n realm: \"ZenServer Webhook Area\",\r\n invalidUserMessage: {\r\n error: \"Webhook authentication failed\",\r\n message: \"Invalid webhook credentials\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware supporting multiple users\r\n * Useful for different admin roles or service accounts\r\n */\r\nexport function createMultiUserBasicAuthMiddleware() {\r\n const adminUsers = [\r\n {\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n },\r\n ];\r\n\r\n return basicAuth(\r\n {\r\n realm: \"ZenServer Admin Area\",\r\n invalidUserMessage: {\r\n error: \"Access denied\",\r\n message: \"Invalid admin credentials\",\r\n },\r\n ...adminUsers[0],\r\n },\r\n ...adminUsers.slice(1)\r\n );\r\n}\r\n\r\n/**\r\n * Default basic auth middleware for general admin access\r\n */\r\nexport const basicAuthMiddleware = createBasicAuthMiddleware();\r\n",[],[269,554,560],{"_104":568,"_96":569,"_156":570,"_158":555,"_159":141,"_160":571,"_162":118,"_106":572,"_100":278,"_164":235,"_166":573,"_167":22,"_168":-5,"_169":574,"_99":575},"49f672e4-5e6d-11f0-b051-0224a6c84d84","bearerAuth.ts","caa96d5e-5c67-11f0-bbdb-0224a6c84d84",600,["D",1752248393365],"/**\r\n * Bearer Authentication Middleware using Hono's built-in bearerAuth\r\n * Provides Bearer token authentication for API endpoints\r\n * Supports both static tokens and dynamic token verification\r\n */\r\n\r\nimport { bearerAuth } from \"npm:hono/bearer-auth\";\r\nimport type { Context } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { AuthService } from \"../services/authService.ts\";\r\nimport { Database } from \"../database/database.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\n\r\n/**\r\n * Creates bearer auth middleware for API endpoints\r\n * Uses static API key from environment\r\n */\r\nexport function createBearerAuthMiddleware() {\r\n const apiKey = environment.MASTER_KEY;\r\n return bearerAuth({\r\n token: apiKey,\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Invalid API key\",\r\n message: \"Bearer token authentication failed\",\r\n },\r\n noAuthenticationHeaderMessage: {\r\n error: \"Missing authentication\",\r\n message: \"Bearer token required in Authorization header\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware with custom token verification\r\n * Integrates with AuthService for dynamic token validation\r\n */\r\nexport function createDynamicBearerAuthMiddleware(\r\n verifyToken: (token: string, c: Context) => boolean | Promise\r\n) {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n try {\r\n const isValid = await verifyToken(token, c);\r\n\r\n if (!isValid) {\r\n logger.warn(\"Bearer auth failed\", {\r\n token: token.substring(0, 8) + \"...\",\r\n ip: getClientIP(c),\r\n userAgent: c.req.header(\"user-agent\"),\r\n });\r\n }\r\n\r\n return isValid;\r\n } catch (error) {\r\n logger.error(\"Bearer auth verification error\", {\r\n error: error.message,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Token verification failed\",\r\n message: \"Invalid or expired bearer token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware using AuthService validation\r\n * Integrates with existing AuthService.validateApiKey logic\r\n */\r\nexport function createAuthServiceBearerMiddleware() {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n // Create a mock request with the token in Authorization header\r\n const mockRequest = new Request(c.req.url, {\r\n headers: {\r\n Authorization: `Bearer ${token}`,\r\n \"x-forwarded-for\": c.req.header(\"x-forwarded-for\") || \"\",\r\n \"user-agent\": c.req.header(\"user-agent\") || \"\",\r\n },\r\n });\r\n\r\n const validation = AuthService.validateApiKey(mockRequest);\r\n return validation.valid;\r\n },\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"API authentication failed\",\r\n message: \"Invalid API key provided\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware with multiple token support\r\n * Useful for different access levels (read/write permissions)\r\n */\r\nexport function createMultiTokenBearerAuthMiddleware() {\r\n const tokens = [\r\n environment.MASTER_KEY,\r\n environment.WEBHOOK_SECRET,\r\n environment.VALTOWN_TOKEN,\r\n ].filter(Boolean); // Remove undefined values\r\n\r\n return bearerAuth({\r\n token: tokens,\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Access denied\",\r\n message: \"Invalid API token provided\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware for webhook endpoints\r\n * Uses webhook-specific token validation\r\n */\r\nexport function createWebhookBearerAuthMiddleware() {\r\n return bearerAuth({\r\n token: environment.WEBHOOK_SECRET,\r\n realm: \"ZenServer Webhook API\",\r\n invalidTokenMessage: {\r\n error: \"Webhook authentication failed\",\r\n message: \"Invalid webhook bearer token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware for booking token validation\r\n * Integrates with booking token system\r\n */\r\nexport function createBookingTokenBearerAuthMiddleware() {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n try {\r\n const db = c.get(\"db\") as Database;\r\n if (!db) {\r\n logger.error(\"Database not available in booking token auth\");\r\n return false;\r\n }\r\n\r\n const validation = await AuthService.validateBookingToken(db, token);\r\n\r\n if (validation.valid && validation.bookingId) {\r\n // Store booking ID in context for use in handlers\r\n c.set(\"bookingId\", validation.bookingId);\r\n return true;\r\n }\r\n\r\n return false;\r\n } catch (error) {\r\n logger.error(\"Booking token verification error\", {\r\n error: error.message,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer Booking API\",\r\n invalidTokenMessage: {\r\n error: \"Booking token invalid\",\r\n message: \"Invalid or expired booking token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Default bearer auth middleware for general API access\r\n */\r\nexport const bearerAuthMiddleware = createBearerAuthMiddleware();\r\n\r\n/**\r\n * AuthService-integrated bearer auth middleware\r\n */\r\nexport const authServiceBearerMiddleware = createAuthServiceBearerMiddleware();\r\n",[],[269,554,569],{"_104":577,"_96":578,"_156":579,"_158":555,"_159":141,"_160":580,"_162":22,"_106":581,"_100":582,"_164":235,"_166":583,"_167":22,"_168":-5,"_169":584,"_99":585},"49fd5b68-5e6d-11f0-981a-0224a6c84d84","cors.ts","9fe0a658-58a9-11f0-b6a5-f69ea79377d9",601,["D",1752248393420],15,"import { environment } from \"../config/environment.ts\";\r\nimport { logWarn } from \"../utils/logger.ts\";\r\nimport { logSecurityCheck } from \"./debugger.ts\";\r\n\r\nconst ALLOWED_ORIGINS = environment.ALLOWED_ORIGINS;\r\nconst ALLOWED_METHODS = [\"GET\", \"POST\", \"OPTIONS\"];\r\nconst ALLOWED_HEADERS = environment.ALLOWED_HEADERS;\r\n\r\nexport function corsMiddleware(request: Request, correlationId?: string): Response | null {\r\n const origin = request.headers.get(\"origin\");\r\n const method = request.method;\r\n const ip = request.headers.get(\"cf-connecting-ip\") || request.headers.get(\"x-forwarded-for\") || \"unknown\";\r\n\r\n // Debug security checks\r\n if (correlationId) {\r\n logSecurityCheck(correlationId, \"CORS Origin Check\", \"Validating request origin against allowed origins\", true, {\r\n origin,\r\n allowedOrigins: ALLOWED_ORIGINS,\r\n method\r\n });\r\n }\r\n\r\n // Handle preflight requests\r\n if (method === \"OPTIONS\") {\r\n // Check if origin is allowed\r\n const originAllowed = origin && ALLOWED_ORIGINS.includes(origin);\r\n\r\n if (correlationId) {\r\n logSecurityCheck(correlationId, \"CORS Preflight Check\", \"Handling OPTIONS preflight request\", originAllowed, {\r\n origin,\r\n originAllowed,\r\n allowedMethods: ALLOWED_METHODS,\r\n allowedHeaders: ALLOWED_HEADERS\r\n });\r\n }\r\n\r\n const headers = new Headers();\r\n\r\n if (originAllowed) {\r\n headers.set(\"Access-Control-Allow-Origin\", origin);\r\n }\r\n // Don't set Access-Control-Allow-Origin for disallowed origins\r\n\r\n headers.set(\"Access-Control-Allow-Methods\", ALLOWED_METHODS.join(\", \"));\r\n headers.set(\"Access-Control-Allow-Headers\", ALLOWED_HEADERS.join(\", \"));\r\n headers.set(\"Access-Control-Allow-Credentials\", \"true\");\r\n headers.set(\"Access-Control-Max-Age\", \"86400\"); // 24 hours\r\n headers.set(\"Vary\", \"Origin\");\r\n\r\n return new Response(null, {\r\n status: 200,\r\n headers\r\n });\r\n }\r\n\r\n // Validate origin for non-preflight requests\r\n if (origin && !ALLOWED_ORIGINS.includes(origin)) {\r\n if (correlationId) {\r\n logSecurityCheck(correlationId, \"CORS Origin Validation\", \"Origin not in allowed list - BLOCKED\", false, {\r\n origin,\r\n allowedOrigins: ALLOWED_ORIGINS,\r\n ip,\r\n userAgent: request.headers.get(\"user-agent\")\r\n });\r\n }\r\n\r\n logWarn(`CORS violation - invalid origin ${origin} - ip: ${ip}`);\r\n return new Response(JSON.stringify({ error: \"CORS policy violation\" }), {\r\n status: 403,\r\n headers: { \"Content-Type\": \"application/json\" }\r\n });\r\n }\r\n\r\n if (correlationId) {\r\n logSecurityCheck(correlationId, \"CORS Validation Passed\", \"Request origin is allowed\", true, {\r\n origin: origin || \"no-origin\",\r\n ip\r\n });\r\n }\r\n\r\n // Allow the request to continue\r\n return null;\r\n}\r\n\r\nexport function addCorsHeaders(response: Response, origin?: string): Response {\r\n const headers = new Headers(response.headers);\r\n\r\n if (origin && ALLOWED_ORIGINS.includes(origin)) {\r\n headers.set(\"Access-Control-Allow-Origin\", origin);\r\n } else if (origin) {\r\n // Don't set CORS headers for disallowed origins\r\n // This is more secure than defaulting to first allowed origin\r\n return response;\r\n } else {\r\n // No origin header - likely a non-browser request\r\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\r\n }\r\n\r\n headers.set(\"Access-Control-Allow-Credentials\", \"true\");\r\n headers.set(\"Vary\", \"Origin\");\r\n\r\n return new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers\r\n });\r\n}\r\n",[],[269,554,578],{"_104":587,"_96":588,"_156":589,"_158":555,"_159":141,"_160":590,"_162":118,"_106":591,"_100":32,"_164":235,"_166":592,"_167":22,"_168":-5,"_169":593,"_99":594},"4933f19c-5e6d-11f0-b051-0224a6c84d84","csp.ts","4933f26e-5e6d-11f0-b051-0224a6c84d84",583,["D",1752248392102],"/**\r\n * Content Security Policy (CSP) middleware for ZenServer\r\n * Provides centralized CSP configuration and header management\r\n */\r\n\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\n// CSP directive configuration\r\ninterface CSPDirectives {\r\n defaultSrc: string[];\r\n scriptSrc: string[];\r\n styleSrc: string[];\r\n imgSrc: string[];\r\n connectSrc: string[];\r\n fontSrc: string[];\r\n objectSrc: string[];\r\n mediaSrc: string[];\r\n frameSrc: string[];\r\n childSrc: string[];\r\n workerSrc: string[];\r\n manifestSrc: string[];\r\n baseUri: string[];\r\n formAction: string[];\r\n frameAncestors: string[];\r\n upgradeInsecureRequests: boolean;\r\n blockAllMixedContent: boolean;\r\n}\r\n\r\n// Default CSP configuration\r\nconst defaultCSPDirectives: CSPDirectives = {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile\r\n \"https://payuat.travelpay.com.au\" // Zenpay payment gateway\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"https://payuat.travelpay.com.au\", // Zenpay payment gateway styles\r\n \"'unsafe-inline'\" // Allow inline styles (consider removing in production)\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\", // Allow data URLs for images\r\n \"https:\", // Allow HTTPS images\r\n \"https://images.unsplash.com\" // Unsplash for tour images\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile API\r\n \"https://payuat.travelpay.com.au\" // Zenpay payment gateway API\r\n ],\r\n fontSrc: [\r\n \"'self'\",\r\n \"https:\", // Allow HTTPS fonts\r\n \"data:\" // Allow data URL fonts\r\n ],\r\n objectSrc: [\"'none'\"], // Disable object/embed/applet\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\" // Cloudflare Turnstile iframe\r\n ],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"], // Prevent clickjacking\r\n upgradeInsecureRequests: true, // Upgrade HTTP to HTTPS\r\n blockAllMixedContent: true // Block mixed content\r\n};\r\n\r\n// Development CSP configuration (more permissive)\r\nconst developmentCSPDirectives: Partial = {\r\n scriptSrc: [\r\n \"'self'\",\r\n \"'unsafe-eval'\", // Allow eval for dev tools\r\n \"'unsafe-inline'\", // Allow inline scripts for dev\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\"\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"'unsafe-inline'\", // Allow inline styles for dev\r\n \"https://payuat.travelpay.com.au\"\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"ws:\", // Allow WebSocket for dev servers\r\n \"wss:\", // Allow secure WebSocket\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\"\r\n ]\r\n};\r\n\r\n/**\r\n * Get CSP directives based on environment\r\n */\r\nfunction getCSPDirectives(): CSPDirectives {\r\n const baseDirectives = { ...defaultCSPDirectives };\r\n \r\n // Apply development overrides if not in production\r\n if (environment.APP_ENV !== \"prod\") {\r\n return {\r\n ...baseDirectives,\r\n ...developmentCSPDirectives\r\n };\r\n }\r\n \r\n return baseDirectives;\r\n}\r\n\r\n/**\r\n * Convert CSP directives object to CSP header string\r\n */\r\nfunction buildCSPHeader(directives: CSPDirectives): string {\r\n const policies: string[] = [];\r\n \r\n // Add directive-based policies\r\n if (directives.defaultSrc.length > 0) {\r\n policies.push(`default-src ${directives.defaultSrc.join(' ')}`);\r\n }\r\n if (directives.scriptSrc.length > 0) {\r\n policies.push(`script-src ${directives.scriptSrc.join(' ')}`);\r\n }\r\n if (directives.styleSrc.length > 0) {\r\n policies.push(`style-src ${directives.styleSrc.join(' ')}`);\r\n }\r\n if (directives.imgSrc.length > 0) {\r\n policies.push(`img-src ${directives.imgSrc.join(' ')}`);\r\n }\r\n if (directives.connectSrc.length > 0) {\r\n policies.push(`connect-src ${directives.connectSrc.join(' ')}`);\r\n }\r\n if (directives.fontSrc.length > 0) {\r\n policies.push(`font-src ${directives.fontSrc.join(' ')}`);\r\n }\r\n if (directives.objectSrc.length > 0) {\r\n policies.push(`object-src ${directives.objectSrc.join(' ')}`);\r\n }\r\n if (directives.mediaSrc.length > 0) {\r\n policies.push(`media-src ${directives.mediaSrc.join(' ')}`);\r\n }\r\n if (directives.frameSrc.length > 0) {\r\n policies.push(`frame-src ${directives.frameSrc.join(' ')}`);\r\n }\r\n if (directives.childSrc.length > 0) {\r\n policies.push(`child-src ${directives.childSrc.join(' ')}`);\r\n }\r\n if (directives.workerSrc.length > 0) {\r\n policies.push(`worker-src ${directives.workerSrc.join(' ')}`);\r\n }\r\n if (directives.manifestSrc.length > 0) {\r\n policies.push(`manifest-src ${directives.manifestSrc.join(' ')}`);\r\n }\r\n if (directives.baseUri.length > 0) {\r\n policies.push(`base-uri ${directives.baseUri.join(' ')}`);\r\n }\r\n if (directives.formAction.length > 0) {\r\n policies.push(`form-action ${directives.formAction.join(' ')}`);\r\n }\r\n if (directives.frameAncestors.length > 0) {\r\n policies.push(`frame-ancestors ${directives.frameAncestors.join(' ')}`);\r\n }\r\n \r\n // Add boolean directives\r\n if (directives.upgradeInsecureRequests) {\r\n policies.push('upgrade-insecure-requests');\r\n }\r\n if (directives.blockAllMixedContent) {\r\n policies.push('block-all-mixed-content');\r\n }\r\n \r\n return policies.join('; ');\r\n}\r\n\r\n/**\r\n * Get the complete CSP header value\r\n */\r\nexport function getCSPHeader(): string {\r\n const directives = getCSPDirectives();\r\n return buildCSPHeader(directives);\r\n}\r\n\r\n/**\r\n * Get HSTS header value\r\n */\r\nexport function getHSTSHeader(): string {\r\n // More restrictive in production\r\n if (environment.APP_ENV === \"prod\") {\r\n return \"max-age=31536000; includeSubDomains; preload\";\r\n }\r\n // Less restrictive in development\r\n return \"max-age=3600; includeSubDomains\";\r\n}\r\n\r\n/**\r\n * Get all security headers as an object\r\n */\r\nexport function getSecurityHeaders(): Record {\r\n return {\r\n \"Content-Security-Policy\": getCSPHeader(),\r\n \"Strict-Transport-Security\": getHSTSHeader(),\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n \"X-Frame-Options\": \"DENY\",\r\n \"X-XSS-Protection\": \"1; mode=block\",\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\"\r\n };\r\n}\r\n\r\n/**\r\n * Apply security headers to a Response object\r\n */\r\nexport function addSecurityHeaders(response: Response): Response {\r\n const headers = getSecurityHeaders();\r\n \r\n // Clone the response to avoid mutating the original\r\n const newResponse = new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers: new Headers(response.headers)\r\n });\r\n \r\n // Add security headers\r\n Object.entries(headers).forEach(([name, value]) => {\r\n newResponse.headers.set(name, value);\r\n });\r\n \r\n return newResponse;\r\n}\r\n\r\n/**\r\n * CSP middleware for Hono\r\n */\r\nexport function cspMiddleware() {\r\n return async (c: any, next: any) => {\r\n await next();\r\n \r\n // Add security headers to the response\r\n const securityHeaders = getSecurityHeaders();\r\n Object.entries(securityHeaders).forEach(([name, value]) => {\r\n c.res.headers.set(name, value);\r\n });\r\n };\r\n}\r\n\r\n// Export directives for testing and customization\r\nexport { getCSPDirectives, buildCSPHeader };\r\nexport type { CSPDirectives };",[],[269,554,588],{"_104":596,"_96":597,"_156":598,"_158":555,"_159":141,"_160":599,"_162":22,"_106":600,"_100":528,"_164":235,"_166":601,"_167":22,"_168":-5,"_169":602,"_99":603},"4a183b54-5e6d-11f0-a473-0224a6c84d84","csrf.ts","8c938ec6-5a93-11f0-a7b1-f69ea79377d9",602,["D",1752248393595],"/**\r\n * Comprehensive CSRF Protection Module\r\n *\r\n * This module provides two layers of CSRF protection:\r\n * 1. Origin-based validation (using Hono's built-in CSRF) - for app-wide protection\r\n * 2. Token-based validation (double-submit cookies) - for sensitive endpoints\r\n *\r\n * @module csrf\r\n */\r\n\r\nimport { csrf } from \"npm:hono/csrf\";\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger, logDebug, logWarn, logInfo } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\nimport {\r\n setCSRFCookies,\r\n validateCSRFToken,\r\n type CSRFSession,\r\n type TokenValidationResult,\r\n} from \"../utils/cookies.ts\";\r\nimport { generateSecureToken } from \"../utils/crypto.ts\";\r\n\r\n// ============================================================================\r\n// TYPES AND INTERFACES\r\n// ============================================================================\r\n\r\n/**\r\n * Configuration for origin-based CSRF protection\r\n */\r\nexport interface CSRFOriginConfig {\r\n allowedOrigins: string[];\r\n allowValTownDomains: boolean;\r\n allowLocalhost: boolean;\r\n logValidation: boolean;\r\n}\r\n\r\n// ============================================================================\r\n// TOKEN-BASED CSRF PROTECTION (Double-Submit Cookies)\r\n// ============================================================================\r\n\r\n// Re-export types from cookies utility for backward compatibility\r\nexport type { CSRFSession, TokenValidationResult };\r\n\r\n/**\r\n * Create a new CSRF session with secure tokens\r\n * Now uses centralized crypto utilities with SESSION_SECRET entropy\r\n *\r\n * @returns CSRFSession object with sessionId, xsrfToken, and timestamps\r\n */\r\nexport function createCSRFSession(): CSRFSession {\r\n const sessionId = generateSecureToken(environment.SESSION_SECRET);\r\n const xsrfToken = generateSecureToken(environment.SESSION_SECRET);\r\n const createdAt = new Date();\r\n const expiresAt = new Date(createdAt.getTime() + 30 * 60 * 1000); // 30 minutes\r\n\r\n return {\r\n sessionId,\r\n xsrfToken,\r\n createdAt,\r\n expiresAt,\r\n };\r\n}\r\n\r\n// Re-export cookie functions from utils for backward compatibility\r\nexport { setCSRFCookies, validateCSRFToken };\r\n\r\n/**\r\n * Token-based CSRF protection middleware\r\n * Use this for sensitive endpoints (e.g., payment processing)\r\n *\r\n * @param request - The incoming HTTP request\r\n * @returns Error response if validation fails, null if passes\r\n */\r\nexport function csrfProtection(request: Request): Response | null {\r\n const validation = validateCSRFToken(request);\r\n\r\n if (!validation.valid) {\r\n logger.warn(\"CSRF validation failed\", {\r\n error: validation.error,\r\n ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\",\r\n userAgent: request.headers.get(\"user-agent\") || \"unknown\",\r\n });\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"CSRF validation failed\",\r\n details: validation.error,\r\n }),\r\n {\r\n status: 403,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n );\r\n }\r\n\r\n return null; // Continue processing\r\n}\r\n\r\n// Alias for backward compatibility\r\nexport const tokenBasedCSRFProtection = csrfProtection;\r\n\r\n// ============================================================================\r\n// ORIGIN-BASED CSRF PROTECTION (Using Hono's Built-in Middleware)\r\n// ============================================================================\r\n\r\n/**\r\n * Get default origin-based CSRF configuration based on environment\r\n *\r\n * @returns Default configuration object\r\n */\r\nexport const getDefaultOriginConfig = (): CSRFOriginConfig => {\r\n const isDevelopment = environment.APP_ENV === \"dev\";\r\n\r\n return {\r\n allowedOrigins: [\r\n // Use all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS,\r\n // Also include BASE_URL if it's not already in the list\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ].filter(Boolean), // Remove any undefined values\r\n allowValTownDomains: isDevelopment, // Allow val.town domains in development\r\n allowLocalhost: isDevelopment, // Allow localhost in development\r\n logValidation: isDevelopment, // Log validation in development\r\n };\r\n};\r\n\r\n// Backward compatibility alias\r\nexport const getDefaultConfig = getDefaultOriginConfig;\r\n\r\n/**\r\n * Create origin validation function for Hono CSRF middleware\r\n *\r\n * @param config - Origin validation configuration\r\n * @returns Function that validates origin strings\r\n */\r\nexport const createOriginValidator = (config: CSRFOriginConfig) => {\r\n return (origin: string): boolean => {\r\n try {\r\n // Check against explicitly allowed origins\r\n for (const allowedOrigin of config.allowedOrigins) {\r\n if (origin === allowedOrigin || origin.startsWith(allowedOrigin)) {\r\n if (config.logValidation) {\r\n logDebug(\"CSRF origin validation passed\", \"csrf_origin\", {\r\n origin,\r\n matchedOrigin: allowedOrigin,\r\n });\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Allow val.town domains for development\r\n if (config.allowValTownDomains) {\r\n const valTownRegex = /^https:\\/\\/[\\w-]+\\.val\\.run$/;\r\n if (valTownRegex.test(origin)) {\r\n if (config.logValidation) {\r\n logDebug(\r\n \"CSRF origin validation passed (val.town)\",\r\n \"csrf_origin\",\r\n {\r\n origin,\r\n reason: \"val.town domain\",\r\n }\r\n );\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Allow localhost for development\r\n if (config.allowLocalhost) {\r\n const localhostRegex = /^https?:\\/\\/localhost(:\\d+)?$/;\r\n if (localhostRegex.test(origin)) {\r\n if (config.logValidation) {\r\n logDebug(\r\n \"CSRF origin validation passed (localhost)\",\r\n \"csrf_origin\",\r\n {\r\n origin,\r\n reason: \"localhost\",\r\n }\r\n );\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Log rejected origins\r\n if (config.logValidation) {\r\n logWarn(\"CSRF origin validation failed\", \"csrf_origin\", {\r\n origin,\r\n allowedOrigins: config.allowedOrigins,\r\n allowValTownDomains: config.allowValTownDomains,\r\n allowLocalhost: config.allowLocalhost,\r\n });\r\n }\r\n\r\n return false;\r\n } catch (error) {\r\n logWarn(\"CSRF origin validation error\", \"csrf_origin\", {\r\n origin,\r\n error: error instanceof Error ? error.message : String(error),\r\n });\r\n return false;\r\n }\r\n };\r\n};\r\n\r\n/**\r\n * Create Hono CSRF middleware with custom configuration\r\n *\r\n * @param customConfig - Optional custom configuration to override defaults\r\n * @returns Configured Hono CSRF middleware\r\n */\r\nexport const createHonoCSRFMiddleware = (\r\n customConfig?: Partial\r\n) => {\r\n const config = { ...getDefaultOriginConfig(), ...customConfig };\r\n const originValidator = createOriginValidator(config);\r\n\r\n return csrf({\r\n origin: originValidator,\r\n });\r\n};\r\n\r\n/**\r\n * Enhanced CSRF middleware that combines origin validation with custom logic\r\n *\r\n * @param customConfig - Optional custom configuration\r\n * @returns Enhanced CSRF middleware function\r\n */\r\nexport const createEnhancedCSRFMiddleware = (\r\n customConfig?: Partial\r\n) => {\r\n const honoMiddleware = createHonoCSRFMiddleware(customConfig);\r\n\r\n return async (c: Context, next: Next) => {\r\n // Get client IP for enhanced logging\r\n const clientIP = getClientIP(c);\r\n\r\n try {\r\n // Apply Hono CSRF middleware\r\n await honoMiddleware(c, next);\r\n } catch (error) {\r\n // Enhanced error logging with client information\r\n logWarn(\"CSRF middleware error\", \"csrf_enhanced\", {\r\n clientIP,\r\n origin: c.req.header(\"Origin\"),\r\n referer: c.req.header(\"Referer\"),\r\n userAgent: c.req.header(\"User-Agent\")?.substring(0, 100),\r\n path: c.req.path,\r\n method: c.req.method,\r\n error: error instanceof Error ? error.message : String(error),\r\n });\r\n\r\n // Re-throw the error to maintain the original behavior\r\n throw error;\r\n }\r\n };\r\n};\r\n\r\n// ============================================================================\r\n// PRESET MIDDLEWARE CONFIGURATIONS\r\n// ============================================================================\r\n\r\n/**\r\n * Default CSRF middleware - balanced security for most use cases\r\n */\r\nexport const defaultCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware();\r\n};\r\n\r\n/**\r\n * Strict CSRF middleware - maximum security, minimal allowlists\r\n */\r\nexport const strictCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: false,\r\n allowLocalhost: false,\r\n logValidation: true,\r\n });\r\n};\r\n\r\n/**\r\n * Development CSRF middleware - relaxed settings for local development\r\n */\r\nexport const developmentCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: true,\r\n allowLocalhost: true,\r\n logValidation: true,\r\n });\r\n};\r\n\r\n/**\r\n * Public API CSRF middleware - for public endpoints that need some protection\r\n */\r\nexport const publicAPICSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: true,\r\n allowLocalhost: environment.APP_ENV === \"dev\",\r\n logValidation: false,\r\n });\r\n};\r\n\r\n/**\r\n * Get default CSRF middleware based on environment\r\n */\r\nexport function getDefaultCSRFMiddleware(correlationId?: string) {\r\n const config = getDefaultOriginConfig();\r\n\r\n if (correlationId) {\r\n logInfo(`Initializing CSRF middleware`, \"csrf_init\", {\r\n correlationId,\r\n config: {\r\n allowedOrigins: config.allowedOrigins.length,\r\n allowValTownDomains: config.allowValTownDomains,\r\n allowLocalhost: config.allowLocalhost,\r\n environment: environment.APP_ENV,\r\n },\r\n });\r\n }\r\n\r\n return createEnhancedCSRFMiddleware(config);\r\n}\r\n\r\n// ============================================================================\r\n// UTILITY EXPORTS\r\n// ============================================================================\r\n\r\n/**\r\n * Collection of CSRF utilities for testing and advanced configuration\r\n */\r\nexport const CSRFUtils = {\r\n // Origin-based utilities\r\n getDefaultConfig: getDefaultOriginConfig,\r\n createOriginValidator,\r\n createHonoCSRFMiddleware,\r\n createEnhancedCSRFMiddleware,\r\n\r\n // Token-based utilities\r\n generateSecureToken,\r\n createCSRFSession,\r\n setCSRFCookies,\r\n validateCSRFToken,\r\n\r\n // Middleware factories\r\n originBased: {\r\n default: defaultCSRFMiddleware,\r\n strict: strictCSRFMiddleware,\r\n development: developmentCSRFMiddleware,\r\n publicAPI: publicAPICSRFMiddleware,\r\n },\r\n\r\n tokenBased: {\r\n middleware: csrfProtection,\r\n protection: tokenBasedCSRFProtection,\r\n },\r\n};\r\n\r\n// Default export for easy importing\r\nexport default getDefaultCSRFMiddleware;\r\n\r\n// ============================================================================\r\n// USAGE EXAMPLES\r\n// ============================================================================\r\n\r\n/**\r\n * Example 1: Global origin-based protection\r\n * ```typescript\r\n * import { getDefaultCSRFMiddleware } from \"./csrf\";\r\n * app.use(getDefaultCSRFMiddleware());\r\n * ```\r\n *\r\n * Example 2: Token-based protection for specific routes\r\n * ```typescript\r\n * import { csrfProtection, createCSRFSession, setCSRFCookies } from \"./csrf\";\r\n *\r\n * // Set cookies on initial visit\r\n * app.get(\"/api/v1/tour/:id\", (c) => {\r\n * const session = createCSRFSession();\r\n * // ... handle request\r\n * return setCSRFCookies(response, session);\r\n * });\r\n *\r\n * // Validate token on sensitive endpoints\r\n * app.post(\"/api/v1/payment\", (c) => {\r\n * const error = csrfProtection(c.req.raw);\r\n * if (error) return error;\r\n * // ... process payment\r\n * });\r\n * ```\r\n */\r\n",[],[269,554,597],{"_104":605,"_96":606,"_156":607,"_158":555,"_159":141,"_160":608,"_162":22,"_106":609,"_100":528,"_164":235,"_166":610,"_167":22,"_168":-5,"_169":611,"_99":612},"4a1beede-5e6d-11f0-922b-0224a6c84d84","debugger.ts","8c9eeeb0-5a93-11f0-b403-f69ea79377d9",603,["D",1752248393617],"import * as log from \"https://deno.land/std@0.203.0/log/mod.ts\";\r\nimport { getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS } from \"../utils/dateUtils.ts\";\r\nimport { OPERATION_EMOJIS } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\nconst DBG_EMOJI = OPERATION_EMOJIS[\"debug_event\"] ?? \"🐞\";\r\n\r\n// ANSI color codes for debug output (maintained from original)\r\nconst DEBUG_COLORS = {\r\n reset: \"\\x1b[0m\",\r\n bright: \"\\x1b[1m\",\r\n dim: \"\\x1b[2m\",\r\n red: \"\\x1b[31m\",\r\n green: \"\\x1b[32m\",\r\n yellow: \"\\x1b[33m\",\r\n blue: \"\\x1b[34m\",\r\n magenta: \"\\x1b[35m\",\r\n cyan: \"\\x1b[36m\",\r\n white: \"\\x1b[37m\",\r\n gray: \"\\x1b[90m\",\r\n brightRed: \"\\x1b[91m\",\r\n brightGreen: \"\\x1b[92m\",\r\n brightYellow: \"\\x1b[93m\",\r\n brightBlue: \"\\x1b[94m\",\r\n brightMagenta: \"\\x1b[95m\",\r\n brightCyan: \"\\x1b[96m\",\r\n brightWhite: \"\\x1b[97m\",\r\n bgRed: \"\\x1b[41m\",\r\n bgGreen: \"\\x1b[42m\",\r\n bgYellow: \"\\x1b[43m\",\r\n bgBlue: \"\\x1b[44m\",\r\n bgMagenta: \"\\x1b[45m\",\r\n bgCyan: \"\\x1b[46m\",\r\n} as const;\r\n\r\n// Custom formatter that maintains color support\r\nfunction coloredJsonFormatter(record: log.LogRecord): string {\r\n const entry = {\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n level: record.levelName,\r\n message: record.msg,\r\n ...(record.args[0] ? { data: record.args[0] } : {}),\r\n };\r\n\r\n // Apply color based on log level (only if colors are enabled)\r\n if (!environment.DEBUG_ENABLE_COLORS) {\r\n return JSON.stringify(entry);\r\n }\r\n\r\n let color: string = DEBUG_COLORS.reset;\r\n switch (record.level) {\r\n case log.LogLevels.DEBUG:\r\n color = DEBUG_COLORS.gray;\r\n break;\r\n case log.LogLevels.INFO:\r\n color = DEBUG_COLORS.cyan;\r\n break;\r\n case log.LogLevels.WARNING:\r\n color = DEBUG_COLORS.yellow;\r\n break;\r\n case log.LogLevels.ERROR:\r\n color = DEBUG_COLORS.red;\r\n break;\r\n case log.LogLevels.CRITICAL:\r\n color = DEBUG_COLORS.brightRed;\r\n break;\r\n }\r\n\r\n return `${color}${JSON.stringify(entry)}${DEBUG_COLORS.reset}`;\r\n}\r\n\r\n// Configure logger with our custom formatter\r\nawait log.setup({\r\n handlers: {\r\n debugConsole: new log.handlers.ConsoleHandler(\r\n environment.DEBUG_LOG_LEVEL as log.LevelName,\r\n {\r\n formatter: coloredJsonFormatter,\r\n }\r\n ),\r\n },\r\n loggers: {\r\n default: {\r\n level: environment.DEBUG_LOG_LEVEL as log.LevelName,\r\n handlers: [\"debugConsole\"],\r\n },\r\n },\r\n});\r\ninterface DebugRequestData {\r\n method: string;\r\n url: string;\r\n headers: Record;\r\n body?: string;\r\n timestamp: string;\r\n ip?: string;\r\n userAgent?: string;\r\n origin?: string;\r\n correlationId?: string;\r\n}\r\n\r\ninterface DebugResponseData {\r\n status: number;\r\n statusText: string;\r\n headers: Record;\r\n body?: string;\r\n timestamp: string;\r\n duration?: number;\r\n}\r\n\r\ninterface DebugRequestResponse {\r\n request: DebugRequestData;\r\n response: DebugResponseData;\r\n correlationId: string;\r\n totalDuration: number;\r\n}\r\n\r\ninterface SecurityCheck {\r\n checkNumber: number;\r\n checkName: string;\r\n description: string;\r\n passed: boolean;\r\n details?: Record;\r\n timestamp: string;\r\n duration?: number;\r\n}\r\n\r\n// Global state remains the same\r\nlet securityCheckCounter = 0;\r\n// ---------- Global state ----------\r\nconst activeRequests = new Map<\r\n string,\r\n {\r\n request: DebugRequestData;\r\n startTime: number;\r\n securityChecks: SecurityCheck[];\r\n }\r\n>();\r\n\r\nconst debugSessions = new Map<\r\n string,\r\n {\r\n correlationId: string;\r\n startTime: number;\r\n request: {\r\n method: string;\r\n url: string;\r\n ip: string;\r\n userAgent: string;\r\n };\r\n }\r\n>();\r\n\r\nexport function isDebugEnabled(): boolean {\r\n return environment.APP_ENV === \"dev\";\r\n}\r\n\r\nfunction generateCorrelationId(): string {\r\n return `dbg_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Bulk security-check helper\r\n// -----------------------------------------------------------\r\nexport function logSecurityChecks(\r\n correlationId: string,\r\n checks: Array<{\r\n checkName: string;\r\n description: string;\r\n passed: boolean;\r\n details?: Record;\r\n }>\r\n): void {\r\n if (!isDebugEnabled() || !correlationId) return;\r\n for (const chk of checks) {\r\n logSecurityCheck(\r\n correlationId,\r\n chk.checkName,\r\n chk.description,\r\n chk.passed,\r\n chk.details\r\n );\r\n }\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Debug timer utility\r\n// -----------------------------------------------------------\r\nexport function createDebugTimer(operation: string): {\r\n stop: (details?: Record) => number;\r\n} {\r\n if (!isDebugEnabled()) return { stop: () => 0 };\r\n\r\n const startTime = performance.now();\r\n return {\r\n stop: (details?: Record) => {\r\n const ms = Math.round(performance.now() - startTime);\r\n debugLog(`${DBG_EMOJI} ⏱️ ${operation} took ${ms} ms`, details);\r\n return ms;\r\n },\r\n };\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Correlation-ID passthrough for downstream handlers\r\n// -----------------------------------------------------------\r\nexport function getDebugCorrelationId(ctx: any): string {\r\n return ctx?.get?.(\"debugCorrelationId\") ?? \"\";\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Hono-style middleware (unchanged logic, now w/ std/log)\r\n// -----------------------------------------------------------\r\nexport function createDebugMiddleware() {\r\n return async (c: any, next: any) => {\r\n if (!isDebugEnabled()) return await next();\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}🔧 Debug middleware: ${c.req.method} ${c.req.url}${colorEnd}`\r\n );\r\n log.debug(`${DBG_EMOJI} middleware`, {\r\n method: c.req.method,\r\n url: c.req.url,\r\n });\r\n\r\n const cid = captureRequest(c.req.raw);\r\n c.set(\"debugCorrelationId\", cid);\r\n const started = performance.now();\r\n\r\n try {\r\n await next();\r\n if (c.res) {\r\n await captureResponse(cid, c.res);\r\n } else {\r\n captureResponseFromContext(cid, c, performance.now() - started);\r\n }\r\n } catch (err) {\r\n log.error(`${DBG_EMOJI} middleware error`, { message: err.message });\r\n const fallback = new Response(JSON.stringify({ error: err.message }), {\r\n status: 500,\r\n headers: { \"content-type\": \"application/json\" },\r\n });\r\n await captureResponse(cid, fallback);\r\n throw err;\r\n }\r\n };\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Session lifecycle helpers (for long-lived flows)\r\n// -----------------------------------------------------------\r\nexport function initializeDebugSession(req: Request): string {\r\n const cid = crypto.randomUUID();\r\n debugSessions.set(cid, {\r\n correlationId: cid,\r\n startTime: Date.now(),\r\n request: {\r\n method: req.method,\r\n url: req.url,\r\n ip:\r\n req.headers.get(\"cf-connecting-ip\") ??\r\n req.headers.get(\"x-forwarded-for\") ??\r\n \"unknown\",\r\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\r\n },\r\n });\r\n\r\n // pre-seed map so security-checks land correctly\r\n if (!activeRequests.has(cid)) {\r\n activeRequests.set(cid, {\r\n request: {\r\n method: req.method,\r\n url: req.url,\r\n headers: Object.fromEntries(req.headers.entries()),\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n ip: debugSessions.get(cid)!.request.ip,\r\n userAgent: debugSessions.get(cid)!.request.userAgent,\r\n origin: req.headers.get(\"origin\") ?? \"\",\r\n correlationId: cid,\r\n },\r\n startTime: Date.now(),\r\n securityChecks: [],\r\n });\r\n }\r\n\r\n if (isDebugEnabled()) {\r\n console.log(`\\n🔍 DEBUG SESSION STARTED — ${cid}`);\r\n log.info(`${DBG_EMOJI} session start`, { cid, url: req.url });\r\n }\r\n return cid;\r\n}\r\n\r\nexport function finalizeDebugSession(\r\n cid: string,\r\n _req: Request,\r\n res: Response\r\n): void {\r\n const session = debugSessions.get(cid);\r\n const reqData = activeRequests.get(cid);\r\n if (!session) return; // nothing to do\r\n\r\n if (isDebugEnabled()) {\r\n const elapsed = Date.now() - session.startTime;\r\n const checks = reqData?.securityChecks ?? [];\r\n const summary = {\r\n total: checks.length,\r\n passed: checks.filter((c) => c.passed).length,\r\n failed: checks.filter((c) => !c.passed).length,\r\n status: res.status,\r\n duration: `${elapsed} ms`,\r\n };\r\n\r\n console.log(\"───────────────────────────────────────\");\r\n console.log(`🔒 SECURITY CHECKS SUMMARY`);\r\n console.table(summary);\r\n console.log(`🔍 DEBUG SESSION ENDED\\n`);\r\n log.info(`${DBG_EMOJI} session end`, { cid, ...summary });\r\n }\r\n\r\n debugSessions.delete(cid);\r\n activeRequests.delete(cid);\r\n}\r\n\r\n// Modified functions to use both std/log and colors\r\nexport function initializeDebugger(): void {\r\n const debug = isDebugEnabled();\r\n const isValTown = Boolean(\r\n Deno.env.get(\"DENO_DEPLOYMENT_ID\") ||\r\n globalThis?.location?.hostname?.includes?.(\".val.run\") ||\r\n Deno.env.get(\"VAL_TOWN_AUTHOR\")\r\n );\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n if (debug) {\r\n console.log(`${colorStart}🐛 DEBUG MODE ENABLED${colorEnd}`);\r\n log.info(\"Debug mode initialized\", {\r\n runtime: isValTown ? \"Val.Town\" : \"Local Deno\",\r\n denoVersion: Deno.version.deno,\r\n debugSettings: {\r\n enableColors: environment.DEBUG_ENABLE_COLORS,\r\n enableRequestCapture: environment.DEBUG_ENABLE_REQUEST_CAPTURE,\r\n enableResponseCapture: environment.DEBUG_ENABLE_RESPONSE_CAPTURE,\r\n enableSecurityChecks: environment.DEBUG_ENABLE_SECURITY_CHECKS,\r\n logLevel: environment.DEBUG_LOG_LEVEL,\r\n bodySizeLimit: environment.DEBUG_RESPONSE_BODY_SIZE_LIMIT,\r\n },\r\n });\r\n } else {\r\n console.log(`${grayColor}🐛 Debug mode: OFF${colorEnd}`);\r\n }\r\n}\r\nexport function captureRequest(request: Request): string {\r\n if (!isDebugEnabled() || !environment.DEBUG_ENABLE_REQUEST_CAPTURE) return \"\";\r\n\r\n const correlationId = generateCorrelationId();\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n // Flatten headers\r\n const headers: Record = {};\r\n request.headers.forEach((v, k) => (headers[k.toLowerCase()] = v));\r\n\r\n const requestData: DebugRequestData = {\r\n method: request.method,\r\n url: request.url,\r\n headers,\r\n timestamp,\r\n ip:\r\n headers[\"cf-connecting-ip\"] ||\r\n headers[\"x-forwarded-for\"] ||\r\n headers[\"x-real-ip\"] ||\r\n \"unknown\",\r\n userAgent: headers[\"user-agent\"],\r\n origin: headers[\"origin\"],\r\n correlationId,\r\n };\r\n\r\n activeRequests.set(correlationId, {\r\n request: requestData,\r\n startTime: performance.now(),\r\n securityChecks: [],\r\n });\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightCyan\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(`\\n${colorStart}📥 DEBUG REQUEST [${correlationId}]${colorEnd}`);\r\n log.debug(\"Incoming request\", requestData);\r\n return correlationId;\r\n}\r\n\r\nexport async function captureResponse(\r\n correlationId: string,\r\n response: Response\r\n): Promise {\r\n if (!isDebugEnabled() || !correlationId) return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n const duration = performance.now() - requestData.startTime;\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n // Headers → plain object\r\n const headers: Record = {};\r\n response.headers.forEach((v, k) => (headers[k.toLowerCase()] = v));\r\n\r\n const responseData: DebugResponseData = {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers,\r\n timestamp,\r\n duration: Math.round(duration),\r\n };\r\n\r\n // Non-destructive JSON body capture (configurable size limit)\r\n try {\r\n if (\r\n environment.DEBUG_ENABLE_RESPONSE_CAPTURE &&\r\n response.body &&\r\n headers[\"content-type\"]?.includes(\"application/json\")\r\n ) {\r\n const bodyText = await response.clone().text();\r\n if (bodyText.length < environment.DEBUG_RESPONSE_BODY_SIZE_LIMIT) {\r\n responseData.body = bodyText;\r\n }\r\n }\r\n } catch {\r\n /* ignore */\r\n }\r\n\r\n const debugData: DebugRequestResponse = {\r\n request: requestData.request,\r\n response: responseData,\r\n correlationId,\r\n totalDuration: Math.round(duration),\r\n };\r\n\r\n const statusColor =\r\n response.status >= 400\r\n ? DEBUG_COLORS.brightRed\r\n : response.status >= 300\r\n ? DEBUG_COLORS.brightYellow\r\n : DEBUG_COLORS.brightGreen;\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightMagenta\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}📤 DEBUG RESPONSE [${correlationId}] ${statusColorStart}${response.status}${colorEnd}`\r\n );\r\n\r\n if (response.status >= 400) log.error(\"Request failed\", debugData);\r\n else if (response.status >= 300) log.warning(\"Request redirected\", debugData);\r\n else log.info(\"Request completed\", debugData);\r\n\r\n // Security-check summary\r\n if (\r\n requestData.securityChecks.length &&\r\n environment.DEBUG_ENABLE_SECURITY_CHECKS\r\n ) {\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `\\n${colorStart}🔒 SECURITY CHECKS SUMMARY [${correlationId}]${colorEnd}`\r\n );\r\n log.debug(\"Security checks summary\", {\r\n total: requestData.securityChecks.length,\r\n passed: requestData.securityChecks.filter((c) => c.passed).length,\r\n });\r\n }\r\n\r\n activeRequests.delete(correlationId);\r\n}\r\n\r\nexport function logSecurityCheck(\r\n correlationId: string,\r\n checkName: string,\r\n description: string,\r\n passed: boolean,\r\n details?: Record\r\n): void {\r\n if (\r\n !isDebugEnabled() ||\r\n !environment.DEBUG_ENABLE_SECURITY_CHECKS ||\r\n !correlationId\r\n )\r\n return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n securityCheckCounter++;\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n const securityCheck: SecurityCheck = {\r\n checkNumber: securityCheckCounter,\r\n checkName,\r\n description,\r\n passed,\r\n details,\r\n timestamp,\r\n };\r\n\r\n requestData.securityChecks.push(securityCheck);\r\n\r\n const statusColor = passed\r\n ? DEBUG_COLORS.brightGreen\r\n : DEBUG_COLORS.brightRed;\r\n const statusIcon = passed ? \"✅\" : \"❌\";\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightBlue\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}Check${securityCheck.checkNumber}:${colorEnd} ${statusColorStart}${statusIcon} ${checkName}${colorEnd}`\r\n );\r\n console.log(`${grayColor} └─ ${description}${colorEnd}`);\r\n\r\n if (passed) log.debug(`Security check passed: ${checkName}`, securityCheck);\r\n else log.warning(`Security check failed: ${checkName}`, securityCheck);\r\n}\r\nfunction captureResponseFromContext(\r\n correlationId: string,\r\n context: any,\r\n duration: number\r\n): void {\r\n if (\r\n !isDebugEnabled() ||\r\n !environment.DEBUG_ENABLE_RESPONSE_CAPTURE ||\r\n !correlationId\r\n )\r\n return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n const status = context?.status ?? context?._status ?? 200;\r\n const statusText = context?.statusText ?? \"OK\";\r\n\r\n const headers: Record = {};\r\n if (context.headers?.forEach) {\r\n context.headers.forEach(\r\n (v: string, k: string) => (headers[k.toLowerCase()] = v)\r\n );\r\n }\r\n\r\n const responseData: DebugResponseData = {\r\n status,\r\n statusText,\r\n headers,\r\n timestamp,\r\n duration: Math.round(duration),\r\n };\r\n\r\n const debugData: DebugRequestResponse = {\r\n request: requestData.request,\r\n response: responseData,\r\n correlationId,\r\n totalDuration: Math.round(duration),\r\n };\r\n\r\n const statusColor =\r\n status >= 400\r\n ? DEBUG_COLORS.brightRed\r\n : status >= 300\r\n ? DEBUG_COLORS.brightYellow\r\n : DEBUG_COLORS.brightGreen;\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightMagenta\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}📤 DEBUG RESPONSE [${correlationId}] ${statusColorStart}${status}${colorEnd} (fallback)`\r\n );\r\n log.warning(\"Synthetic response captured\", debugData);\r\n\r\n activeRequests.delete(correlationId);\r\n}\r\n\r\n// Maintain all other original functions with their color support\r\nexport function debugLog(message: string, data?: any): void {\r\n if (!isDebugEnabled()) return;\r\n\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const cyanColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.cyan : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${grayColor}[${timestamp}]${colorEnd} ${cyanColor}🐛 ${message}${colorEnd}`\r\n );\r\n log.debug(message, data);\r\n}\r\n\r\n// ... (keep all other functions with their original implementations)\r\n\r\nexport default {\r\n initializeDebugger,\r\n isDebugEnabled,\r\n captureRequest,\r\n captureResponse,\r\n logSecurityCheck,\r\n logSecurityChecks, // <- now included\r\n createDebugMiddleware,\r\n getDebugCorrelationId,\r\n debugLog,\r\n createDebugTimer, // <- newly wired\r\n initializeDebugSession, // <- newly wired\r\n finalizeDebugSession, // <- newly wired\r\n};\r\n",[],[269,554,606],{"_104":614,"_96":615,"_156":616,"_158":555,"_159":141,"_160":617,"_162":118,"_106":618,"_100":376,"_164":235,"_166":619,"_167":22,"_168":-5,"_169":620,"_99":621},"4a20d0a2-5e6d-11f0-a4b5-0224a6c84d84","ipRestriction.ts","caa0ce60-5c67-11f0-ac5b-0224a6c84d84",604,["D",1752248393636],"// F:\\val.town\\ZenServer\\src\\middleware\\ipRestriction.ts\r\n/**\r\n * IP Restriction Middleware\r\n * Provides IP-based access control using the IP utilities\r\n */\r\n\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { getClientIP, performIPSecurityCheck } from \"../utils/ipUtils.ts\";\r\nimport { logInfo, logWarn } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\ninterface IPRestrictionOptions {\r\n allowList?: string[];\r\n denyList?: string[];\r\n allowPrivate?: boolean;\r\n allowLoopback?: boolean;\r\n errorMessage?: string;\r\n errorHandler?: (\r\n c: Context,\r\n ip: string,\r\n reason: string\r\n ) => Response | Promise;\r\n}\r\n\r\n/**\r\n * Create IP restriction middleware\r\n */\r\nexport const ipRestrictionMiddleware = (options?: IPRestrictionOptions) => {\r\n return async (c: Context, next: Next) => {\r\n const ip = getClientIP(c);\r\n\r\n // Perform security check\r\n const check = performIPSecurityCheck(ip, {\r\n allowList: options?.allowList,\r\n denyList: options?.denyList,\r\n allowPrivate: options?.allowPrivate ?? environment.ALLOW_PRIVATE_IPS,\r\n allowLoopback: options?.allowLoopback ?? environment.ALLOW_LOOPBACK_IPS,\r\n });\r\n\r\n if (!check.allowed) {\r\n logWarn(`IP access denied`, \"ipRestriction\", {\r\n ip,\r\n reason: check.reason,\r\n path: c.req.path,\r\n method: c.req.method,\r\n });\r\n\r\n // Use custom error handler if provided\r\n if (options?.errorHandler) {\r\n return await options.errorHandler(\r\n c,\r\n ip,\r\n check.reason || \"Access denied\"\r\n );\r\n }\r\n\r\n // Default error response\r\n const message = options?.errorMessage || `Access denied: ${check.reason}`;\r\n return c.text(message, 403);\r\n }\r\n\r\n // Log successful access in development\r\n if (environment.APP_ENV === \"dev\") {\r\n logInfo(`IP access allowed`, \"ipRestriction\", {\r\n ip,\r\n path: c.req.path,\r\n });\r\n }\r\n\r\n // Add IP to context for downstream use\r\n c.set(\"clientIP\", ip);\r\n\r\n await next();\r\n };\r\n};\r\n\r\n/**\r\n * Create admin-only IP restriction middleware\r\n * Uses environment configuration for admin IP allowlist\r\n */\r\nexport const adminIPRestrictionMiddleware = () => {\r\n // Get admin IPs from environment or use defaults\r\n const adminIPs = environment.ADMIN_IPS;\r\n\r\n return ipRestrictionMiddleware({\r\n allowList: adminIPs,\r\n allowPrivate: false,\r\n allowLoopback: environment.ALLOW_LOOPBACK_IPS,\r\n errorMessage: \"Unauthorized: Admin access only\",\r\n errorHandler: async (c, ip, reason) => {\r\n // Custom error response for admin endpoints\r\n return c.json(\r\n {\r\n error: \"Unauthorized\",\r\n message: \"This endpoint requires admin access\",\r\n timestamp: new Date().toISOString(),\r\n },\r\n 403\r\n );\r\n },\r\n });\r\n};\r\n\r\n/**\r\n * Create rate limit bypass middleware\r\n * Allows certain IPs to bypass rate limiting\r\n */\r\nexport const rateLimitBypassMiddleware = () => {\r\n return async (c: Context, next: Next) => {\r\n const ip = getClientIP(c);\r\n\r\n // Check if IP should bypass rate limiting\r\n if (environment.ADMIN_IPS.includes(ip)) {\r\n c.set(\"bypassRateLimit\", true);\r\n logInfo(`Rate limit bypassed for IP`, \"ipRestriction\", { ip });\r\n }\r\n\r\n await next();\r\n };\r\n};\r\n\r\n/**\r\n * Create development-only middleware\r\n * Restricts access to development IPs only\r\n */\r\nexport const developmentOnlyMiddleware = () => {\r\n return ipRestrictionMiddleware({\r\n allowPrivate: environment.ALLOW_PRIVATE_IPS,\r\n allowLoopback: environment.ALLOW_LOOPBACK_IPS,\r\n denyList: [], // Override any global deny list\r\n errorMessage: \"This endpoint is only available in development\",\r\n });\r\n};\r\n\r\nexport default ipRestrictionMiddleware;\r\n",[],[269,554,615],{"_104":623,"_96":624,"_156":625,"_158":555,"_159":141,"_160":626,"_162":22,"_106":627,"_100":628,"_164":235,"_166":629,"_167":22,"_168":-5,"_169":630,"_99":631},"4a2aca44-5e6d-11f0-8d99-0224a6c84d84","rateLimit.ts","9fea39ac-58a9-11f0-b67c-f69ea79377d9",605,["D",1752248393715],16,"// ======================\r\n// Configuration Section\r\n// ======================\r\n\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { logSecurityCheck } from \"../middleware/debugger.ts\";\r\n\r\ninterface RateLimitConfig {\r\n [endpoint: string]: {\r\n requests: number;\r\n windowMs: number;\r\n };\r\n}\r\n\r\n// Rate limiting per endpoint (using environment configuration)\r\nconst RATE_LIMITS: RateLimitConfig = {\r\n \"/api/v1/payment/create-nonce\": {\r\n requests: environment.RATE_LIMIT_CREATE_NONCE_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_CREATE_NONCE_WINDOW_MS,\r\n },\r\n \"/api/v1/payment/exchange-nonce\": {\r\n requests: environment.RATE_LIMIT_EXCHANGE_NONCE_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_EXCHANGE_NONCE_WINDOW_MS,\r\n },\r\n \"/api/v1/payment/refresh\": {\r\n requests: environment.RATE_LIMIT_PAYMENT_REFRESH_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_PAYMENT_REFRESH_WINDOW_MS,\r\n },\r\n \"/api/v1/turnstile/verify\": {\r\n requests: environment.RATE_LIMIT_TURNSTILE_VERIFY_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_TURNSTILE_VERIFY_WINDOW_MS,\r\n },\r\n};\r\n\r\n// ======================\r\n// Implementation Section\r\n// ======================\r\n\r\n// In-memory rate limiting for better performance\r\nconst rateLimitCache = new Map();\r\n\r\nexport function rateLimitMiddleware(\r\n request: Request,\r\n correlationId?: string\r\n): Response | null {\r\n const url = new URL(request.url);\r\n const endpoint = url.pathname;\r\n\r\n // Determine IP address using prioritized header list from environment config\r\n let ip: string | null = null;\r\n for (const headerKey of environment.IP_HEADER_KEYS) {\r\n ip = request.headers.get(headerKey);\r\n if (ip) break;\r\n }\r\n if (!ip) ip = \"unknown\";\r\n\r\n // Check if endpoint has rate limiting configured\r\n const limitConfig = RATE_LIMITS[endpoint];\r\n if (!limitConfig) {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Rate Limit Validation\",\r\n \"No rate limiting configured\",\r\n true,\r\n { endpoint, ip }\r\n );\r\n }\r\n return null; // No rate limiting for this endpoint\r\n }\r\n\r\n const key = `${ip}:${endpoint}`;\r\n const now = Date.now();\r\n const currentWindow = Math.floor(now / limitConfig.windowMs);\r\n\r\n // Get or create rate limit entry\r\n let rateLimitEntry = rateLimitCache.get(key);\r\n\r\n if (!rateLimitEntry || rateLimitEntry.resetTime !== currentWindow) {\r\n // Create new window\r\n rateLimitEntry = {\r\n count: 0,\r\n resetTime: currentWindow,\r\n };\r\n rateLimitCache.set(key, rateLimitEntry);\r\n }\r\n\r\n // Increment request count\r\n rateLimitEntry.count++;\r\n\r\n // Check if limit exceeded\r\n const limitExceeded = rateLimitEntry.count > limitConfig.requests;\r\n const remaining = Math.max(0, limitConfig.requests - rateLimitEntry.count);\r\n\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Rate Limit Validation\",\r\n limitExceeded ? \"Rate limit exceeded\" : \"Within rate limits\",\r\n !limitExceeded,\r\n {\r\n endpoint,\r\n count: rateLimitEntry.count,\r\n limit: limitConfig.requests,\r\n remaining,\r\n ip,\r\n }\r\n );\r\n }\r\n\r\n if (limitExceeded) {\r\n logger.warn(\"Rate limit exceeded\", {\r\n ip,\r\n endpoint,\r\n count: rateLimitEntry.count,\r\n limit: limitConfig.requests,\r\n });\r\n\r\n const resetTime = (currentWindow + 1) * limitConfig.windowMs;\r\n const retryAfter = Math.ceil((resetTime - now) / 1000);\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"Too many requests\",\r\n message: \"Rate limit exceeded. Please try again later.\",\r\n retryAfter,\r\n }),\r\n {\r\n status: 429,\r\n headers: {\r\n \"Content-Type\": \"application/json\",\r\n \"Retry-After\": retryAfter.toString(),\r\n \"X-RateLimit-Limit\": limitConfig.requests.toString(),\r\n \"X-RateLimit-Remaining\": remaining.toString(),\r\n \"X-RateLimit-Reset\": resetTime.toString(),\r\n },\r\n }\r\n );\r\n }\r\n\r\n // Clean up old entries periodically using environment config\r\n if (Math.random() < environment.RATE_LIMIT_CLEANUP_PROBABILITY) {\r\n cleanupRateLimitCache();\r\n }\r\n\r\n return null; // Allow request to continue\r\n}\r\n\r\nfunction cleanupRateLimitCache(): void {\r\n const now = Date.now();\r\n const cutoff = now - environment.RATE_LIMIT_CLEANUP_CUTOFF_AGE_MS;\r\n\r\n for (const [key, entry] of rateLimitCache.entries()) {\r\n // Calculate the time the entry was created (convert window back to ms)\r\n // Use the largest window size defined, to ensure correct comparison\r\n const maxWindowMs = Math.max(\r\n ...Object.values(RATE_LIMITS).map((c) => c.windowMs)\r\n );\r\n const entryTime = entry.resetTime * maxWindowMs;\r\n if (entryTime < cutoff) {\r\n rateLimitCache.delete(key);\r\n }\r\n }\r\n}\r\n",[],[269,554,624],{"_104":633,"_96":634,"_156":635,"_158":555,"_159":141,"_160":636,"_162":22,"_106":637,"_100":376,"_164":235,"_166":638,"_167":22,"_168":-5,"_169":639,"_99":640},"4a411150-5e6d-11f0-a4b5-0224a6c84d84","requestLogger.ts","cabb505a-5c67-11f0-93f2-0224a6c84d84",606,["D",1752248393860],"import { requestId } from \"npm:hono/request-id\";\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { logInfo } from \"../utils/logger.ts\";\r\nimport {\r\n getClientInfo,\r\n anonymizeIP,\r\n parseIPAddress,\r\n createRateLimitKey,\r\n performIPSecurityCheck,\r\n} from \"../utils/ipUtils.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { generateUUID } from \"../utils/crypto.ts\";\r\n\r\ninterface MinimalRequestLog {\r\n method: string;\r\n url: string;\r\n headers: Record;\r\n ip?: string;\r\n ipAnonymized?: string;\r\n ipType?: string;\r\n ipVersion?: string;\r\n userAgent?: string;\r\n referer?: string;\r\n origin?: string;\r\n requestId?: string;\r\n rateLimitKey?: string;\r\n securityWarning?: string;\r\n}\r\n\r\ninterface MinimalResponseLog {\r\n status: number;\r\n statusText: string;\r\n headers: Record;\r\n duration?: number;\r\n}\r\n\r\nfunction extractRequestLog(c: Context): MinimalRequestLog {\r\n const req = c.req.raw;\r\n const headers: Record = {};\r\n req.headers.forEach((value: string, key: string) => {\r\n headers[key.toLowerCase()] = value;\r\n });\r\n\r\n // Sanitize sensitive headers\r\n const sensitiveHeaders = [\r\n \"authorization\",\r\n \"cookie\",\r\n \"x-api-key\",\r\n \"x-auth-token\",\r\n ];\r\n sensitiveHeaders.forEach((header) => {\r\n if (headers[header]) {\r\n headers[header] = \"[REDACTED]\";\r\n }\r\n });\r\n\r\n // Use improved IP detection\r\n const clientInfo = getClientInfo(c);\r\n\r\n // Parse IP for additional info\r\n const ipInfo = parseIPAddress(clientInfo.ip);\r\n\r\n // Get request ID from Hono context\r\n const reqId = c.get(\"requestId\") as string;\r\n\r\n // Create rate limit key\r\n const rateLimitKey = createRateLimitKey(clientInfo.ip);\r\n\r\n // Perform security check\r\n const securityCheck = performIPSecurityCheck(clientInfo.ip);\r\n\r\n return {\r\n method: req.method,\r\n url: req.url,\r\n headers,\r\n ip: clientInfo.ip,\r\n ipAnonymized: anonymizeIP(clientInfo.ip),\r\n ipType: ipInfo ? (ipInfo.isPrivate ? \"private\" : \"public\") : undefined,\r\n ipVersion: ipInfo?.version,\r\n userAgent: clientInfo.userAgent,\r\n referer: clientInfo.referer || undefined,\r\n origin: clientInfo.origin || undefined,\r\n requestId: reqId,\r\n rateLimitKey,\r\n securityWarning: !securityCheck.allowed ? securityCheck.reason : undefined,\r\n };\r\n}\r\n\r\nfunction extractResponseLog(\r\n res: Response,\r\n duration?: number\r\n): MinimalResponseLog {\r\n const headers: Record = {};\r\n res.headers.forEach((value, key) => {\r\n headers[key.toLowerCase()] = value;\r\n });\r\n return {\r\n status: res.status,\r\n statusText: res.statusText,\r\n headers,\r\n duration,\r\n };\r\n}\r\n\r\n/**\r\n * Request ID middleware - generates unique ID for each request\r\n */\r\nexport const requestIdMiddleware = requestId({\r\n limitLength: 255,\r\n headerName: \"X-Request-Id\",\r\n generator: (c: Context) => generateUUID(),\r\n});\r\n\r\n/**\r\n * Request logger middleware - logs request/response with request ID\r\n */\r\nexport async function requestLoggerMiddleware(c: Context, next: Next) {\r\n const startTime = performance.now();\r\n const reqLog = extractRequestLog(c);\r\n const requestId = c.get(\"requestId\") as string;\r\n\r\n // Get client info and set in context for downstream middleware\r\n const clientInfo = getClientInfo(c);\r\n c.set(\"clientIP\", clientInfo.ip);\r\n c.set(\"clientInfo\", clientInfo);\r\n\r\n // Check if this IP should bypass rate limiting (admin IPs)\r\n if (environment.ADMIN_IPS.includes(clientInfo.ip)) {\r\n c.set(\"bypassRateLimit\", true);\r\n }\r\n\r\n await next();\r\n\r\n const duration = Math.round(performance.now() - startTime);\r\n const resLog = extractResponseLog(c.res, duration);\r\n\r\n // Ensure request ID is in response headers\r\n c.res.headers.set(\"X-Request-Id\", requestId);\r\n\r\n // Determine log level based on response status and security warnings\r\n const isError = resLog.status >= 500 || reqLog.securityWarning;\r\n const isWarning = resLog.status >= 400;\r\n\r\n // Build comprehensive log entry\r\n const logEntry = {\r\n request: reqLog,\r\n response: resLog,\r\n requestId,\r\n duration,\r\n timestamp: new Date().toISOString(),\r\n path: new URL(reqLog.url).pathname,\r\n // Additional metadata\r\n metadata: {\r\n ipType: reqLog.ipType,\r\n ipVersion: reqLog.ipVersion,\r\n rateLimitKey: reqLog.rateLimitKey,\r\n securityWarning: reqLog.securityWarning,\r\n bypassRateLimit: c.get(\"bypassRateLimit\") || false,\r\n },\r\n };\r\n\r\n // Log with appropriate level\r\n if (isError) {\r\n logInfo(JSON.stringify(logEntry), \"http_error\", { level: \"ERROR\" });\r\n } else if (isWarning) {\r\n logInfo(JSON.stringify(logEntry), \"http_response\", { level: \"WARN\" });\r\n } else {\r\n logInfo(JSON.stringify(logEntry), \"http_response\");\r\n }\r\n\r\n // Log security warnings separately for monitoring\r\n if (reqLog.securityWarning) {\r\n logInfo(`Security warning for request`, \"security_check\", {\r\n requestId,\r\n ip: reqLog.ipAnonymized,\r\n warning: reqLog.securityWarning,\r\n path: new URL(reqLog.url).pathname,\r\n });\r\n }\r\n}\r\n",[],[269,554,634],{"_104":642,"_96":643,"_156":644,"_158":555,"_159":141,"_160":645,"_162":118,"_106":646,"_100":340,"_164":235,"_166":647,"_167":22,"_168":-5,"_169":648,"_99":649},"4a4a3d20-5e6d-11f0-8719-0224a6c84d84","secureHeaders.ts","cacf7c42-5c67-11f0-b3bd-0224a6c84d84",607,["D",1752248393921],"import { secureHeaders, NONCE } from \"npm:hono/secure-headers\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\n/**\r\n * Secure Headers Middleware\r\n *\r\n * Uses the following environment configurations:\r\n * - environment.APP_ENV: Determines production vs development CSP policies\r\n * - environment.ALLOWED_ORIGINS: Used in CSP connectSrc directive for allowed API endpoints\r\n * - environment.BASE_URL: Included in CSP connectSrc if not already in ALLOWED_ORIGINS\r\n *\r\n * CSP Policies:\r\n * - Production: Strict policies with minimal allowances\r\n * - Development: More permissive with unsafe-eval, unsafe-inline, and additional CDNs\r\n */\r\n// Hono secure-headers types (since they're not exported)\r\ntype SecureHeadersOptions = {\r\n contentSecurityPolicy?: ContentSecurityPolicyOptions | false;\r\n strictTransportSecurity?: string | false;\r\n xFrameOptions?: string | false;\r\n xContentTypeOptions?: string | false;\r\n xXssProtection?: string | false;\r\n referrerPolicy?: string | false;\r\n crossOriginResourcePolicy?: string | false;\r\n crossOriginOpenerPolicy?: string | false;\r\n crossOriginEmbedderPolicy?: string | false;\r\n originAgentCluster?: boolean;\r\n xDnsPrefetchControl?: string | false;\r\n xDownloadOptions?: string | false;\r\n xPermittedCrossDomainPolicies?: string | false;\r\n permissionsPolicy?: Record;\r\n removePoweredBy?: boolean;\r\n};\r\ntype ContentSecurityPolicyOptions = Record;\r\n\r\n// CSP directive configuration interface with index signature\r\ninterface CSPDirectives {\r\n defaultSrc?: string[];\r\n scriptSrc?: string[];\r\n styleSrc?: string[];\r\n imgSrc?: string[];\r\n connectSrc?: string[];\r\n fontSrc?: string[];\r\n objectSrc?: string[];\r\n mediaSrc?: string[];\r\n frameSrc?: string[];\r\n childSrc?: string[];\r\n workerSrc?: string[];\r\n manifestSrc?: string[];\r\n baseUri?: string[];\r\n formAction?: string[];\r\n frameAncestors?: string[];\r\n sandbox?: string[];\r\n reportTo?: string;\r\n upgradeInsecureRequests?: string[];\r\n blockAllMixedContent?: boolean;\r\n scriptSrcAttr?: string[];\r\n scriptSrcElem?: string[];\r\n styleSrcAttr?: string[];\r\n styleSrcElem?: string[];\r\n // Add index signature to make it compatible with ContentSecurityPolicyOptions\r\n [key: string]: string | string[] | boolean | undefined;\r\n}\r\n\r\n// Permissions Policy configuration interface with index signature\r\ninterface PermissionsPolicyDirectives {\r\n accelerometer?: string[] | boolean;\r\n ambientLightSensor?: string[] | boolean;\r\n autoplay?: string[] | boolean;\r\n battery?: string[] | boolean;\r\n bluetooth?: string[] | boolean;\r\n browsingTopics?: string[] | boolean;\r\n camera?: string[] | boolean;\r\n displayCapture?: string[] | boolean;\r\n documentDomain?: string[] | boolean;\r\n encryptedMedia?: string[] | boolean;\r\n executionWhileNotRendered?: string[] | boolean;\r\n executionWhileOutOfViewport?: string[] | boolean;\r\n fullscreen?: string[] | boolean;\r\n gamepad?: string[] | boolean;\r\n geolocation?: string[] | boolean;\r\n gyroscope?: string[] | boolean;\r\n hid?: string[] | boolean;\r\n identityCredentialsGet?: string[] | boolean;\r\n idleDetection?: string[] | boolean;\r\n localFonts?: string[] | boolean;\r\n magnetometer?: string[] | boolean;\r\n microphone?: string[] | boolean;\r\n midi?: string[] | boolean;\r\n navigationOverride?: string[] | boolean;\r\n otpCredentials?: string[] | boolean;\r\n payment?: string[] | boolean;\r\n pictureInPicture?: string[] | boolean;\r\n publickeyCredentialsCreate?: string[] | boolean;\r\n publickeyCredentialsGet?: string[] | boolean;\r\n screenWakeLock?: string[] | boolean;\r\n serial?: string[] | boolean;\r\n speakerSelection?: string[] | boolean;\r\n storageAccess?: string[] | boolean;\r\n syncXhr?: string[] | boolean;\r\n usb?: string[] | boolean;\r\n webShare?: string[] | boolean;\r\n windowManagement?: string[] | boolean;\r\n xrSpatialTracking?: string[] | boolean;\r\n // Add index signature to make it compatible with Record\r\n [key: string]: string[] | boolean | undefined;\r\n}\r\n\r\nexport function addSecurityHeaders(response: Response): Response {\r\n const headers = getSecurityHeaders();\r\n\r\n // Clone the response to avoid mutating the original\r\n const newResponse = new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers: new Headers(response.headers),\r\n });\r\n\r\n // Add security headers\r\n Object.entries(headers).forEach(([name, value]) => {\r\n newResponse.headers.set(name, value);\r\n });\r\n\r\n return newResponse;\r\n}\r\n\r\n// Production CSP configuration (strict)\r\nfunction getProductionCSPDirectives(): CSPDirectives {\r\n return {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway styles\r\n \"'unsafe-inline'\", // Required for inline styles - consider using nonces in future\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\", // Allow data URLs for images\r\n \"https:\", // Allow HTTPS images\r\n \"https://images.unsplash.com\", // Unsplash for tour images\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile API\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway API\r\n // Include all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS.filter(\r\n (origin) => origin !== \"'self'\" && origin !== \"*\"\r\n ),\r\n // Include BASE_URL if not already in ALLOWED_ORIGINS\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ],\r\n fontSrc: [\r\n \"'self'\",\r\n \"https:\", // Allow HTTPS fonts\r\n \"data:\", // Allow data URL fonts\r\n ],\r\n objectSrc: [\"'none'\"], // Disable object/embed/applet for security\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile iframe\r\n ],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"], // Prevent clickjacking\r\n upgradeInsecureRequests: [], // Enable upgrade-insecure-requests\r\n blockAllMixedContent: true, // Block mixed content\r\n };\r\n}\r\n\r\n// Development CSP configuration (more permissive)\r\nfunction getDevelopmentCSPDirectives(): CSPDirectives {\r\n return {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"'unsafe-eval'\", // Allow eval for dev tools\r\n \"'unsafe-inline'\", // Allow inline scripts for dev\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\",\r\n \"https://cdn.twind.style\", // Twind CSS\r\n \"https://cdn.jsdelivr.net\", // CDN for dev libraries\r\n \"https://unpkg.com\", // CDN for dev libraries\r\n \"https://esm.sh\", // ES modules CDN\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"'unsafe-inline'\", // Allow inline styles for dev\r\n \"https://payuat.travelpay.com.au\",\r\n \"https://cdn.jsdelivr.net\",\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\",\r\n \"https:\",\r\n \"https://placehold.co\", // Placeholder images for dev\r\n \"https://source.unsplash.com\", // Dev image sources\r\n \"https://images.unsplash.com\",\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"ws:\", // Allow WebSocket for dev servers\r\n \"wss:\", // Allow secure WebSocket\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\",\r\n // Include all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS.filter(\r\n (origin) => origin !== \"'self'\" && origin !== \"*\"\r\n ),\r\n // Include BASE_URL if not already in ALLOWED_ORIGINS\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ],\r\n fontSrc: [\"'self'\", \"https:\", \"data:\"],\r\n objectSrc: [\"'none'\"],\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\"'self'\", \"https://challenges.cloudflare.com\"],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"],\r\n upgradeInsecureRequests: [],\r\n blockAllMixedContent: false, // Allow mixed content in dev\r\n };\r\n}\r\n\r\n// Permissions Policy configuration\r\nconst permissionsPolicyDirectives: PermissionsPolicyDirectives = {\r\n // Disable dangerous permissions by default\r\n bluetooth: false,\r\n camera: false,\r\n microphone: false,\r\n geolocation: false,\r\n usb: false,\r\n serial: false,\r\n hid: false,\r\n\r\n // Allow safe permissions for self\r\n fullscreen: [\"'self'\"],\r\n payment: [\"'self'\", \"https://payuat.travelpay.com.au\"], // Allow payment for ZenPay\r\n\r\n // Disable synchronous XHR (deprecated)\r\n syncXhr: [],\r\n\r\n // Allow autoplay for self (for better UX)\r\n autoplay: [\"'self'\"],\r\n\r\n // Allow picture-in-picture for self\r\n pictureInPicture: [\"'self'\"],\r\n\r\n // Disable other potentially risky features\r\n ambientLightSensor: false,\r\n accelerometer: false,\r\n gyroscope: false,\r\n magnetometer: false,\r\n battery: false,\r\n displayCapture: false,\r\n documentDomain: false,\r\n encryptedMedia: false,\r\n gamepad: false,\r\n idleDetection: false,\r\n midi: false,\r\n otpCredentials: false,\r\n publickeyCredentialsCreate: [\"'self'\"],\r\n publickeyCredentialsGet: [\"'self'\"],\r\n screenWakeLock: false,\r\n speakerSelection: false,\r\n storageAccess: false,\r\n webShare: [\"'self'\"],\r\n windowManagement: false,\r\n xrSpatialTracking: false,\r\n};\r\n\r\n/**\r\n * Get CSP directives based on environment\r\n */\r\nfunction getCSPDirectives(): ContentSecurityPolicyOptions {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n const directives = isProduction\r\n ? getProductionCSPDirectives()\r\n : getDevelopmentCSPDirectives();\r\n\r\n // Log CSP configuration for debugging\r\n console.log(`🛡️ CSP Configuration (${environment.APP_ENV}):`, {\r\n environment: environment.APP_ENV,\r\n isProduction,\r\n allowedOrigins: environment.ALLOWED_ORIGINS,\r\n baseUrl: environment.BASE_URL,\r\n connectSrcCount: Array.isArray(directives.connectSrc)\r\n ? directives.connectSrc.length\r\n : 0,\r\n scriptSrcCount: Array.isArray(directives.scriptSrc)\r\n ? directives.scriptSrc.length\r\n : 0,\r\n blockAllMixedContent: directives.blockAllMixedContent,\r\n });\r\n\r\n return directives;\r\n}\r\n\r\n/**\r\n * Get comprehensive secure headers configuration\r\n */\r\n/**\r\n * Get comprehensive secure headers configuration\r\n */\r\nexport function getSecureHeadersOptions(): SecureHeadersOptions {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n\r\n const baseOptions: SecureHeadersOptions = {\r\n // Remove X-Powered-By header\r\n removePoweredBy: true,\r\n\r\n // Strict Transport Security - more restrictive in production\r\n strictTransportSecurity: isProduction\r\n ? \"max-age=31536000; includeSubDomains; preload\"\r\n : \"max-age=3600; includeSubDomains\",\r\n\r\n // X-Frame-Options - prevent clickjacking\r\n xFrameOptions: \"DENY\",\r\n\r\n // X-Content-Type-Options - prevent MIME sniffing\r\n xContentTypeOptions: \"nosniff\",\r\n\r\n // X-XSS-Protection - legacy XSS protection\r\n xXssProtection: \"0\", // Recommended to disable as per modern security practices\r\n\r\n // Referrer Policy - control referrer information\r\n referrerPolicy: \"strict-origin-when-cross-origin\",\r\n\r\n // Cross-Origin policies\r\n crossOriginResourcePolicy: \"same-origin\",\r\n crossOriginOpenerPolicy: \"same-origin\",\r\n crossOriginEmbedderPolicy: false, // Disable if not needed\r\n\r\n // Origin Agent Cluster\r\n originAgentCluster: true,\r\n\r\n // DNS Prefetch Control\r\n xDnsPrefetchControl: \"off\",\r\n\r\n // Download Options (IE-specific)\r\n xDownloadOptions: \"noopen\",\r\n\r\n // Permitted Cross-Domain Policies\r\n xPermittedCrossDomainPolicies: \"none\",\r\n\r\n // Permissions Policy\r\n permissionsPolicy: permissionsPolicyDirectives,\r\n };\r\n\r\n // Only add contentSecurityPolicy if it's not disabled\r\n const cspDirectives = getCSPDirectives();\r\n if (Object.keys(cspDirectives).length > 0) {\r\n baseOptions.contentSecurityPolicy = cspDirectives;\r\n }\r\n\r\n return baseOptions;\r\n}\r\n\r\n/**\r\n * Display startup information about security headers configuration\r\n */\r\nfunction logSecurityHeadersStartup(): void {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n const cspDirectives = getCSPDirectives();\r\n\r\n console.log(`🛡️ Security Headers Configuration:`);\r\n console.log(` Environment: ${environment.APP_ENV}`);\r\n console.log(\r\n ` CSP Policy: ${\r\n isProduction ? \"Production (Strict)\" : \"Development (Permissive)\"\r\n }`\r\n );\r\n console.log(\r\n ` Allowed Origins: ${environment.ALLOWED_ORIGINS.length} configured`\r\n );\r\n console.log(` Base URL: ${environment.BASE_URL}`);\r\n console.log(\r\n ` Connect Sources: ${\r\n Array.isArray(cspDirectives.connectSrc)\r\n ? cspDirectives.connectSrc.length\r\n : 0\r\n } allowed`\r\n );\r\n console.log(\r\n ` Script Sources: ${\r\n Array.isArray(cspDirectives.scriptSrc)\r\n ? cspDirectives.scriptSrc.length\r\n : 0\r\n } allowed`\r\n );\r\n console.log(\r\n ` Mixed Content: ${\r\n cspDirectives.blockAllMixedContent ? \"Blocked\" : \"Allowed\"\r\n }`\r\n );\r\n console.log(\r\n ` Frame Ancestors: ${\r\n Array.isArray(cspDirectives.frameAncestors)\r\n ? cspDirectives.frameAncestors.join(\", \")\r\n : \"None\"\r\n }`\r\n );\r\n}\r\n\r\n/**\r\n * Create Hono secure headers middleware\r\n */\r\nexport function createSecureHeadersMiddleware() {\r\n // Log startup information\r\n logSecurityHeadersStartup();\r\n\r\n const options = getSecureHeadersOptions();\r\n // Only pass to secureHeaders if contentSecurityPolicy is not false\r\n if (options.contentSecurityPolicy === false) {\r\n const {\r\n contentSecurityPolicy: _contentSecurityPolicy,\r\n ...optionsWithoutCSP\r\n } = options;\r\n return secureHeaders(optionsWithoutCSP as any); // Type assertion needed due to Hono's type definitions\r\n }\r\n return secureHeaders(options as any); // Type assertion needed due to Hono's type definitions\r\n}\r\n\r\n/**\r\n * Get security headers as a plain object (for manual header setting)\r\n */\r\nexport function getSecurityHeaders(): Record {\r\n const options = getSecureHeadersOptions();\r\n const headers: Record = {};\r\n\r\n // Build CSP header\r\n if (options.contentSecurityPolicy) {\r\n const csp = options.contentSecurityPolicy;\r\n const policies: string[] = [];\r\n\r\n Object.entries(csp).forEach(([directive, value]) => {\r\n if (Array.isArray(value) && value.length > 0) {\r\n const kebabDirective = directive\r\n .replace(/([A-Z])/g, \"-$1\")\r\n .toLowerCase();\r\n policies.push(`${kebabDirective} ${value.join(\" \")}`);\r\n } else if (\r\n directive === \"upgradeInsecureRequests\" &&\r\n Array.isArray(value)\r\n ) {\r\n policies.push(\"upgrade-insecure-requests\");\r\n } else if (directive === \"blockAllMixedContent\" && value === true) {\r\n policies.push(\"block-all-mixed-content\");\r\n } else if (typeof value === \"string\") {\r\n const kebabDirective = directive\r\n .replace(/([A-Z])/g, \"-$1\")\r\n .toLowerCase();\r\n policies.push(`${kebabDirective} ${value}`);\r\n }\r\n });\r\n\r\n if (policies.length > 0) {\r\n headers[\"Content-Security-Policy\"] = policies.join(\"; \");\r\n }\r\n }\r\n\r\n // Build Permissions Policy header\r\n if (options.permissionsPolicy) {\r\n const policies: string[] = [];\r\n Object.entries(options.permissionsPolicy).forEach(([feature, value]) => {\r\n const kebabFeature = feature.replace(/([A-Z])/g, \"-$1\").toLowerCase();\r\n if (value === false) {\r\n policies.push(`${kebabFeature}=()`);\r\n } else if (value === true) {\r\n policies.push(`${kebabFeature}=*`);\r\n } else if (Array.isArray(value)) {\r\n if (value.length === 0) {\r\n policies.push(`${kebabFeature}=()`);\r\n } else {\r\n const origins = value\r\n .map((origin) =>\r\n origin === \"'self'\" || origin === \"'none'\" || origin === \"*\"\r\n ? origin\r\n : `\"${origin}\"`\r\n )\r\n .join(\" \");\r\n policies.push(`${kebabFeature}=(${origins})`);\r\n }\r\n }\r\n });\r\n\r\n if (policies.length > 0) {\r\n headers[\"Permissions-Policy\"] = policies.join(\", \");\r\n }\r\n }\r\n\r\n // Add other security headers\r\n if (options.strictTransportSecurity) {\r\n headers[\"Strict-Transport-Security\"] = options.strictTransportSecurity;\r\n }\r\n\r\n if (options.xFrameOptions) {\r\n headers[\"X-Frame-Options\"] = options.xFrameOptions;\r\n }\r\n\r\n if (options.xContentTypeOptions) {\r\n headers[\"X-Content-Type-Options\"] = options.xContentTypeOptions;\r\n }\r\n\r\n if (options.xXssProtection) {\r\n headers[\"X-XSS-Protection\"] = options.xXssProtection;\r\n }\r\n\r\n if (options.referrerPolicy) {\r\n headers[\"Referrer-Policy\"] = options.referrerPolicy;\r\n }\r\n\r\n if (options.crossOriginResourcePolicy) {\r\n headers[\"Cross-Origin-Resource-Policy\"] = options.crossOriginResourcePolicy;\r\n }\r\n\r\n if (options.crossOriginOpenerPolicy) {\r\n headers[\"Cross-Origin-Opener-Policy\"] = options.crossOriginOpenerPolicy;\r\n }\r\n\r\n if (options.crossOriginEmbedderPolicy) {\r\n headers[\"Cross-Origin-Embedder-Policy\"] = options.crossOriginEmbedderPolicy;\r\n }\r\n\r\n if (options.originAgentCluster) {\r\n headers[\"Origin-Agent-Cluster\"] = \"?1\";\r\n }\r\n\r\n if (options.xDnsPrefetchControl) {\r\n headers[\"X-DNS-Prefetch-Control\"] = options.xDnsPrefetchControl;\r\n }\r\n\r\n if (options.xDownloadOptions) {\r\n headers[\"X-Download-Options\"] = options.xDownloadOptions;\r\n }\r\n\r\n if (options.xPermittedCrossDomainPolicies) {\r\n headers[\"X-Permitted-Cross-Domain-Policies\"] =\r\n options.xPermittedCrossDomainPolicies;\r\n }\r\n\r\n return headers;\r\n}\r\n\r\n/**\r\n * Middleware function that applies security headers\r\n */\r\nexport function secureHeadersMiddleware() {\r\n return async (c: any, next: any) => {\r\n await next();\r\n\r\n // Add security headers to the response\r\n const securityHeaders = getSecurityHeaders();\r\n Object.entries(securityHeaders).forEach(([name, value]) => {\r\n c.res.headers.set(name, value);\r\n });\r\n\r\n // Remove X-Powered-By if removePoweredBy is enabled\r\n const options = getSecureHeadersOptions();\r\n if (options.removePoweredBy) {\r\n c.res.headers.delete(\"X-Powered-By\");\r\n }\r\n };\r\n}\r\n\r\n/**\r\n * Enhanced secure headers middleware with nonce support\r\n */\r\nexport function createNonceSecureHeadersMiddleware() {\r\n const baseOptions = getSecureHeadersOptions();\r\n const cspDirectives = getCSPDirectives();\r\n\r\n // Safely handle scriptSrc and styleSrc which might not be arrays\r\n const scriptSrc = cspDirectives.scriptSrc;\r\n const styleSrc = cspDirectives.styleSrc;\r\n\r\n const updatedOptions = {\r\n ...baseOptions,\r\n contentSecurityPolicy: {\r\n ...cspDirectives,\r\n scriptSrc: [\r\n NONCE,\r\n ...(Array.isArray(scriptSrc)\r\n ? scriptSrc.filter((src) => src !== \"'unsafe-inline'\")\r\n : []),\r\n ],\r\n styleSrc: [\r\n NONCE,\r\n ...(Array.isArray(styleSrc)\r\n ? styleSrc.filter((src) => src !== \"'unsafe-inline'\")\r\n : []),\r\n ],\r\n },\r\n };\r\n\r\n // Handle the case where contentSecurityPolicy might be false\r\n if (baseOptions.contentSecurityPolicy === false) {\r\n return secureHeaders(baseOptions as any);\r\n }\r\n\r\n return secureHeaders(updatedOptions);\r\n}\r\n\r\n// Export types and constants\r\nexport type {\r\n CSPDirectives,\r\n PermissionsPolicyDirectives,\r\n SecureHeadersOptions,\r\n ContentSecurityPolicyOptions,\r\n};\r\nexport { NONCE };\r\n\r\n// Default export for backwards compatibility\r\nexport default {\r\n createSecureHeadersMiddleware,\r\n getSecureHeadersOptions,\r\n getSecurityHeaders,\r\n secureHeadersMiddleware,\r\n createNonceSecureHeadersMiddleware,\r\n NONCE,\r\n};\r\n",[],[269,554,643],{"_104":651,"_96":652,"_156":653,"_158":555,"_159":141,"_160":654,"_162":118,"_106":655,"_100":271,"_164":235,"_166":656,"_167":22,"_168":-5,"_169":657,"_99":658},"4a56b7bc-5e6d-11f0-8ec4-0224a6c84d84","security.ts","50c82d46-5c70-11f0-9378-0224a6c84d84",608,["D",1752248393999],"import { logger } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logSecurityCheck } from \"../middleware/debugger.ts\";\r\n\r\nexport function securityMiddleware(\r\n request: Request,\r\n correlationId?: string\r\n): Response | null {\r\n const url = new URL(request.url);\r\n const ip =\r\n request.headers.get(\"cf-connecting-ip\") ||\r\n request.headers.get(\"x-forwarded-for\") ||\r\n \"unknown\";\r\n const userAgent = request.headers.get(\"user-agent\") || \"\";\r\n const referer = request.headers.get(\"referer\") || \"\";\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // Basic security headers validation\r\n const securityViolations: string[] = [];\r\n\r\n // Check for suspicious user agents using configuration\r\n const suspiciousPatterns = environment.SECURITY_SUSPICIOUS_USER_AGENTS.map(\r\n (pattern) => new RegExp(pattern, \"i\")\r\n );\r\n\r\n if (suspiciousPatterns.some((pattern) => pattern.test(userAgent))) {\r\n securityViolations.push(\"suspicious_user_agent\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"User Agent Security Scan\",\r\n \"Suspicious pattern detected\",\r\n false,\r\n { userAgent: userAgent.substring(0, 50), ip }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"User Agent Security Scan\",\r\n \"Clean user agent\",\r\n true,\r\n { userAgent: userAgent.substring(0, 50), ip }\r\n );\r\n }\r\n }\r\n\r\n // Validate referer for sensitive endpoints using configuration\r\n const sensitiveEndpoints = environment.SECURITY_SENSITIVE_ENDPOINTS;\r\n\r\n if (sensitiveEndpoints.includes(url.pathname)) {\r\n if (\r\n referer &&\r\n !environment.ALLOWED_ORIGINS.some((allowedOrigin) =>\r\n referer.startsWith(allowedOrigin)\r\n )\r\n ) {\r\n securityViolations.push(\"invalid_referer\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Referer Validation\",\r\n `Invalid referer for ${url.pathname}`,\r\n false,\r\n { referer, endpoint: url.pathname }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Referer Validation\",\r\n `Valid referer for ${url.pathname}`,\r\n true,\r\n { referer: referer || \"none\", endpoint: url.pathname }\r\n );\r\n }\r\n }\r\n\r\n if (origin && !environment.ALLOWED_ORIGINS.includes(origin)) {\r\n securityViolations.push(\"invalid_origin\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Origin Validation\",\r\n `Invalid origin for ${url.pathname}`,\r\n false,\r\n { origin, endpoint: url.pathname }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Origin Validation\",\r\n `Valid origin for ${url.pathname}`,\r\n true,\r\n { origin: origin || \"none\", endpoint: url.pathname }\r\n );\r\n }\r\n }\r\n }\r\n\r\n // Check for common attack patterns in headers\r\n const dangerousPatterns = [\r\n /` to HTML to capture client-side errors\n- **Error Handling:** Only use try...catch when there's a clear local resolution; Avoid catches that merely log or return 500s. Let errors bubble up with full context\n- **Environment Variables:** Use `Deno.env.get('keyname')` when you need to, but generally prefer APIs that don't require keys\n- **Imports:** Use `https://esm.sh` for npm and Deno dependencies to ensure compatibility on server and browser\n- **Storage Strategy:** Only use backend storage if explicitly required; prefer simple static client-side sites\n- **React Configuration:** When using React libraries, pin versions with `?deps=react@18.2.0,react-dom@18.2.0` and start the file with `/** @jsxImportSource https://esm.sh/react@18.2.0 */`\n- Ensure all React dependencies and sub-dependencies are pinned to the same version\n- **Styling:** Default to using TailwindCSS via `` unless otherwise specified\n\n## Project Structure and Design Patterns\n\n### Recommended Directory Structure\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts # Schema definitions\n│ │ ├── queries.ts # DB query functions\n│ │ └── README.md\n│ └── routes/ # Route modules\n│ ├── [route].ts\n│ └── static.ts # Static file serving\n│ ├── index.ts # Main entry point\n│ └── README.md\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html # Main HTML template\n│ ├── index.tsx # Frontend JS entry point\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n ├── README.md\n └── utils.ts # Shared types and functions\n```\n\n### Backend (Hono) Best Practices\n\n- Hono is the recommended API framework\n- Main entry point should be `backend/index.ts`\n- **Static asset serving:** Use the utility functions to read and serve project files:\n ```ts\n import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n \n // serve all files in frontend/ and shared/\n app.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\n app.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n \n // For index.html, often you'll want to bootstrap with initial data\n app.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Inject data to avoid extra round-trips\n const initialData = await fetchInitialData();\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n });\n ```\n- Create RESTful API routes for CRUD operations\n- Always include this snippet at the top-level Hono app to re-throwing errors to see full stack traces:\n ```ts\n // Unwrap Hono errors to see original error details\n app.onError((err, c) => {\n throw err;\n });\n ```\n\n### Database Patterns\n- Run migrations on startup or comment out for performance\n- Change table names when modifying schemas rather than altering\n- Export clear query functions with proper TypeScript typing\n\n## Common Gotchas and Solutions\n\n1. **Environment Limitations:** \n - Val Town runs on Deno in a serverless context, not Node.js\n - Code in `shared/` must work in both frontend and backend environments\n - Cannot use `Deno` keyword in shared code\n - Use `https://esm.sh` for imports that work in both environments\n\n2. **SQLite Peculiarities:**\n - Limited support for ALTER TABLE operations\n - Create new tables with updated schemas and copy data when needed\n - Always run table creation before querying\n\n3. **React Configuration:**\n - All React dependencies must be pinned to 18.2.0\n - Always include `@jsxImportSource https://esm.sh/react@18.2.0` at the top of React files\n - Rendering issues often come from mismatched React versions\n\n4. **File Handling:**\n - Val Town only supports text files, not binary\n - Use the provided utilities to read files across branches and forks\n - For files in the project, use `readFile` helpers\n\n5. **API Design:**\n - `fetch` handler is the entry point for HTTP vals\n - Run the Hono app with `export default app.fetch // This is the entry point for HTTP vals`\n\n",[],[891],{"_104":899,"_96":900,"_156":901,"_158":-5,"_159":141,"_160":902,"_162":22,"_106":903,"_100":32,"_164":225,"_166":895,"_167":22,"_168":-5,"_169":904,"_99":905},"f950808c-5c55-11f0-8e32-0224a6c84d84","CLAUDE.md","f9508230-5c55-11f0-8e32-0224a6c84d84",321,["D",1752018477318],[],[900],{"_104":907,"_96":908,"_156":909,"_158":-5,"_159":141,"_160":910,"_162":22,"_106":911,"_100":32,"_164":225,"_166":912,"_167":22,"_168":-5,"_169":913,"_99":914},"8230bf18-5f4c-11f0-9f40-0224a6c84d84","PLAN.md","8230bff4-5f4c-11f0-9f40-0224a6c84d84",630,["D",1752344265463],"# Plan to Complete Migration to Automatic Validation Style\r\n\r\n## Current Situation Analysis\r\nBased on careful review of map.md and PROJECT_MAPPING.md:\r\n\r\n### What's Already Working ✅\r\n- **businessLogic.ts** has basic implementations of core payment functions (createNonce, exchangeNonce, handlePaymentCallback)\r\n- **Dynamic handler system** is already functional\r\n- **Documentation system** is fully implemented\r\n- **adminHandler.ts** contains complete, working implementations of all missing functions\r\n\r\n### The Real Problem\r\nWe have **duplicated functionality** where:\r\n- businessLogic.ts has basic/placeholder implementations\r\n- adminHandler.ts has complete, production-ready implementations\r\n- The architecture is sound, just incomplete migration\r\n\r\n## Required Steps\r\n\r\n### Step 1: Complete Missing Functions in businessLogic.ts\r\nReplace the \"not yet implemented\" placeholders with actual implementations from adminHandler.ts:\r\n\r\n- [ ] **createBooking()** - Port from adminHandler.ts, adapt to return `{ bookingId }` object\r\n- [ ] **getBookingDetails()** - Port from adminHandler.ts, adapt to return booking object\r\n- [ ] **generatePayToken()** - Port from adminHandler.ts, adapt to return `{ shareableUrl }` object\r\n- [ ] **validatePayToken()** - Port from adminHandler.ts, adapt to return validation object\r\n- [ ] **generateBookingToken()** - Port from adminHandler.ts\r\n- [ ] **verifyTurnstile()** - Port from turnstileHandler.ts\r\n\r\n### Step 2: Add Missing OpenAPI Functions\r\nAdd these functions that exist in openapi.json but not in businessLogic.ts:\r\n- [ ] **getRoutesV1()** - for GET /api/v1/routes\r\n- [ ] **getBookingById()** - for GET /api/v1/booking/{bookingId}\r\n- [ ] **getBookingByToken()** - for GET /api/v1/s/booking/{token}\r\n\r\n### Step 3: Enhance Existing Basic Implementations\r\nUpgrade the basic implementations in businessLogic.ts with features from adminHandler.ts:\r\n- [ ] **createNonce()** - Add comprehensive security checks from adminHandler.ts\r\n- [ ] **exchangeNonce()** - Add validation improvements from adminHandler.ts \r\n- [ ] **handlePaymentCallback()** - Add proper validation and status updates from adminHandler.ts\r\n\r\n### Step 4: Remove Duplicate Files\r\nOnce all functions are properly implemented in businessLogic.ts:\r\n- [ ] Delete `src/handlers/adminHandler.ts`\r\n- [ ] Delete `src/handlers/tourHandler.ts` (if it's truly redundant)\r\n- [ ] Ensure no routes are pointing to the deleted handlers\r\n\r\n### Step 5: Verify Integration\r\n- [ ] Ensure all OpenAPI operationIds have corresponding functions in businessLogic.ts\r\n- [ ] Test that dynamicHandler.ts properly routes to all functions\r\n- [ ] Verify automatic validation is working for all endpoints\r\n\r\n### Step 6: End-to-End Testing\r\n- [ ] Test complete payment flow (nonce → exchange → callback)\r\n- [ ] Test booking creation and retrieval\r\n- [ ] Test admin token generation\r\n- [ ] Verify all security features work as expected\r\n\r\n## Key Principles for Migration\r\n1. **Don't rewrite working code** - adapt existing implementations\r\n2. **Convert Response objects to plain objects** when porting\r\n3. **Remove manual validation** (OpenAPI handles it)\r\n4. **Preserve all security features** from original implementations\r\n5. **Keep the same business logic** but change the return format\r\n6. **USE EXISTING UTILITIES** - We have comprehensive utility functions that should be used\r\n\r\n## Utility Functions to Leverage\r\n\r\n### From `src/utils/crypto.ts`:\r\n- **generateNonce()** - Already used in adminHandler.ts for secure nonce generation\r\n- **generateUUID()** - Used for creating booking IDs (currently using crypto.randomUUID() directly)\r\n- **generateSecureToken()** - Should be used for pay token generation\r\n- **hashString()** - For secure hashing when needed\r\n\r\n### From `src/utils/cookies.ts`:\r\n- **setCSRFCookies()** - Already used in adminHandler.ts\r\n- **validateTokenBasedCSRFToken()** - For CSRF validation\r\n- NOTE: These might not be needed in businessLogic.ts if middleware handles it\r\n\r\n### From `src/utils/ipUtils.ts`:\r\n- **getClientIP()** - Extract IP from request/context (currently done manually)\r\n- **performIPSecurityCheck()** - For IP-based access control\r\n- **anonymizeIP()** - For privacy-compliant logging\r\n\r\n### From `src/utils/logger.ts`:\r\n- **logInfo()**, **logError()**, **logWarn()** - Already used throughout\r\n- **withCorrelationId()** - For request tracing\r\n- **measureAndLog()** - For performance monitoring\r\n- **logSecurityEvent()** - For security-sensitive operations\r\n\r\n### From `src/utils/dateUtils.ts`:\r\n- **getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS()** - For consistent timestamps\r\n\r\n### From Services:\r\n- **TurnstileService.validateToken()** - Already used in createNonce\r\n- **PaymentFingerprintService.generatePaymentHash()** - Already used in exchangeNonce\r\n- **AuthService.validateApiKey()** - For API authentication\r\n- **ValidationService** - For complex validation logic\r\n- **PublicPayNonceService.createPublicPaymentNonce()** - UNUSED! Should replace manual nonce creation\r\n\r\n## Major Issues Found by Cross-Referencing PROJECT_MAPPING.md\r\n\r\n### 1. UNUSED SERVICE: `publicPayNonceService.ts`\r\n- **Problem**: Both handlers manually implement nonce creation\r\n- **Solution**: Use `PublicPayNonceService.createPublicPaymentNonce()` instead\r\n\r\n### 2. MIDDLEWARE ALREADY HANDLES THINGS WE'RE DUPLICATING:\r\n- **CORS**: `corsMiddleware()` handles this - remove manual `addCorsHeaders()` calls\r\n- **CSRF**: `getOriginBasedCSRFMiddleware()` provides protection - check if manual CSRF needed\r\n- **Security Headers**: `secureHeaders.ts` adds these automatically\r\n- **Rate Limiting**: Already handled by `rateLimitMiddleware()`\r\n\r\n### 3. DATABASE SCHEMA NOT BEING USED:\r\n- **Security Tables**: `sys_security_events`, `sys_blocked_ips`, `sys_whitelisted_ips` defined but unused\r\n- **Webhook Tables**: `sys_webhooks`, `sys_webhook_logs` exist but not integrated with payment flow\r\n- **Rate Limit Table**: `sys_rate_limits` may not be connected to middleware\r\n\r\n### 4. COMPLETE HANDLERS BEING IGNORED:\r\n- **webhookHandler.ts**: Fully implemented but not integrated with payment callbacks\r\n- **turnstileHandler.ts**: Has `verifyTurnstile()` but businessLogic.ts throws \"not implemented\"\r\n- **docsHandler.ts**: Working perfectly, being used correctly\r\n\r\n### 5. IP SECURITY COMPLETELY UNUSED:\r\n- **Available**: `performIPSecurityCheck()`, IP firewall tables, geographic restrictions\r\n- **Problem**: No IP-based security happening despite full implementation\r\n\r\n### 6. LOGGING UNDERUTILIZED:\r\n- **Available**: `withCorrelationId()`, `measureAndLog()`, `logSecurityEvent()`\r\n- **Problem**: Basic logging instead of structured, traceable logging\r\n\r\n## CRITICAL SECURITY ISSUES TO FIX FIRST\r\n\r\n### 1. **CREDENTIAL LOGGING** (HIGH PRIORITY - SECURITY RISK)\r\n- **File**: `src/services/zenpayFingerprintService.ts` lines 47-55\r\n- **Problem**: Logging username and password in plaintext\r\n- **Fix**: Remove ALL credential logging immediately\r\n\r\n### 2. **DATABASE CLASS BYPASS** (HIGH PRIORITY)\r\n- **Files**: `src/handlers/adminHandler.ts` lines 388-398, 572-578\r\n- **Problem**: Bypassing Database class error handling\r\n- **Fix**: ALL database operations MUST use `db.execute()` or `db.query()`\r\n- **Never**: Construct SQL strings manually\r\n\r\n## DUPLICATIONS TO REMOVE\r\n\r\n### 1. **Crypto Function Duplications**\r\n- **Remove**: `AuthService` wrapper functions (lines 33-35, 146-148)\r\n- **Use**: Direct imports from `src/utils/crypto.ts`\r\n- **Specific**: `newPayToken()` duplicated in adminHandler.ts lines 86-93\r\n\r\n### 2. **Service/Utils Duplications**\r\n- **PublicPayNonceService**: Has `createPublicPaymentNonce()` but handlers implement manually\r\n- **AuthService**: Re-wraps crypto functions unnecessarily\r\n- **Fix**: Use services directly, remove manual implementations\r\n\r\n### 3. **Middleware vs Handler Duplications**\r\n- **CORS**: Middleware handles it - remove ALL `addCorsHeaders()` calls\r\n- **CSRF**: Middleware handles it - remove manual CSRF validation\r\n- **Security Headers**: Middleware adds them - remove manual header additions\r\n- **Rate Limiting**: Middleware enforces it - remove any manual rate limit code\r\n\r\n### 4. **Old Files to DELETE**\r\n- **Delete ALL files in**: `src/handlers/OldFiles/`\r\n- **Reason**: Deprecated duplicates with outdated imports\r\n- **Keep**: Current implementations are more mature\r\n\r\n## UNUSED INFRASTRUCTURE TO CONNECT\r\n\r\n### 1. **Security Tables (NOT USED AT ALL)**\r\n- `sys_security_events` - Should log all security events\r\n- `sys_blocked_ips` / `sys_whitelisted_ips` - IP firewall ready but unused\r\n- `sys_blocked_geos` / `sys_whitelisted_geos` - Geo restrictions ready but unused\r\n- **Fix**: Use `performIPSecurityCheck()` from ipUtils.ts\r\n\r\n### 2. **Webhook Infrastructure (BUILT BUT NOT CONNECTED)**\r\n- **Tables**: `sys_webhooks`, `sys_webhook_logs` exist\r\n- **Handler**: `webhookHandler.ts` fully implemented\r\n- **Problem**: Payment callbacks not using this infrastructure\r\n- **Fix**: Route payment callbacks through webhookHandler\r\n\r\n### 3. **IP Security System (COMPLETELY UNUSED)**\r\n- **Available**: Full IP validation, CIDR checks, anonymization\r\n- **Functions**: `getClientIP()`, `performIPSecurityCheck()`, `anonymizeIP()`\r\n- **Fix**: Replace manual IP extraction with these utilities\r\n\r\n### 4. **Advanced Logging (UNDERUTILIZED)**\r\n- **Available**: `withCorrelationId()`, `measureAndLog()`, `logSecurityEvent()`\r\n- **Current**: Basic logging without correlation IDs\r\n- **Fix**: Wrap handlers with correlation ID tracking\r\n\r\n## ARCHITECTURAL FIXES REQUIRED\r\n\r\n### 1. **Business Logic Separation**\r\n- **Problem**: `adminHandler.ts` has 1,337 lines mixing HTTP and business logic\r\n- **Solution**: Move ALL business logic to `businessLogic.ts`\r\n- **Pattern**: Handlers should ONLY handle HTTP concerns\r\n\r\n### 2. **Database Usage Pattern**\r\n- **Always use**: `Database` class methods\r\n- **Never**: Direct SQL string construction\r\n- **Always**: Parameterized queries through Database class\r\n- **Example**: \r\n ```typescript\r\n // CORRECT\r\n await db.execute(\"INSERT INTO table (col) VALUES (?)\", [value]);\r\n // WRONG\r\n await db.execute(`INSERT INTO table (col) VALUES ('${value}')`);\r\n ```\r\n\r\n### 3. **Service Layer Usage**\r\n- **Use**: `PublicPayNonceService.createPublicPaymentNonce()`\r\n- **Use**: `TurnstileService.validateToken()`\r\n- **Use**: `PaymentFingerprintService.generatePaymentHash()`\r\n- **Use**: `ValidationService` for all complex validation\r\n- **Use**: `AuthService.validateApiKey()` consistently\r\n\r\n## SPECIFIC MIGRATION STEPS WITH DETAILS\r\n\r\n### Step 1: Security Fixes (DO FIRST)\r\n- [ ] Remove credential logging from `zenpayFingerprintService.ts`\r\n- [ ] Fix all database operations to use Database class\r\n- [ ] Add `logSecurityEvent()` calls for all security operations\r\n\r\n### Step 2: Remove Duplications\r\n- [ ] Delete entire `src/handlers/OldFiles/` directory\r\n- [ ] Remove `addCorsHeaders()` from ALL handlers\r\n- [ ] Remove manual CSRF validation from handlers\r\n- [ ] Remove crypto wrappers from AuthService\r\n- [ ] Replace `newPayToken()` with `generatePayToken()` from crypto utils\r\n\r\n### Step 3: Connect Unused Infrastructure\r\n- [ ] Add IP security checks using `performIPSecurityCheck()`\r\n- [ ] Log security events to `sys_security_events` table\r\n- [ ] Route payment callbacks through webhookHandler\r\n- [ ] Use correlation IDs for all request tracking\r\n\r\n### Step 4: Migrate Business Logic (FROM adminHandler.ts TO businessLogic.ts)\r\n- [ ] **createBooking()** - Port lines 712-752, return `{ bookingId }`\r\n- [ ] **getBookingDetails()** - Port lines 907-1089, return booking object\r\n- [ ] **generatePayToken()** - Port lines 758-899, return `{ shareableUrl }`\r\n- [ ] **validatePayToken()** - Port lines 604-684, return validation object\r\n- [ ] **verifyTurnstile()** - Use existing from turnstileHandler.ts\r\n\r\n### Step 5: Add Missing OpenAPI Functions\r\n- [ ] **getRoutesV1()** - Copy logic from `getRoutes()`\r\n- [ ] **getBookingById()** - Use Database to query by ID\r\n- [ ] **getBookingByToken()** - Port from `getBookingDetails()`\r\n\r\n### Step 6: Use ALL Utilities Properly\r\n- [ ] Replace manual IP extraction with `getClientIP()`\r\n- [ ] Replace `crypto.randomUUID()` with `generateUUID()`\r\n- [ ] Use `generateSecureToken()` for all token generation\r\n- [ ] Use `getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS()` for timestamps\r\n- [ ] Use `measureAndLog()` for performance tracking\r\n\r\n## ZenApp.md ALIGNMENT CHECKLIST\r\n- [ ] Progressive security model (CSRF + Turnstile + Rate limiting) ✅\r\n- [ ] Nonce-gated payment flow ✅\r\n- [ ] Session seeding for tour endpoints (MISSING - needs middleware)\r\n- [ ] Parameterized queries (PARTIAL - some handlers bypass)\r\n- [ ] Business logic separation (POOR - needs migration)\r\n\r\n## DO NOT FORGET\r\n1. **Security credentials must NEVER be logged**\r\n2. **Always use Database class, never direct SQL**\r\n3. **Middleware handles CORS/CSRF/Headers - don't duplicate**\r\n4. **Use existing utilities - don't reimplement**\r\n5. **Old files are deprecated - delete them**\r\n6. **Business logic belongs in businessLogic.ts, not handlers**\r\n\r\n## Notes\r\n- This is NOT just migration - it's fixing architectural violations\r\n- Security issues must be fixed FIRST before any migration\r\n- Use existing infrastructure instead of reimplementing\r\n- The codebase has good architecture but poor implementation consistency\r\n- **CRITICAL**: Fix credential logging immediately - this is a security vulnerability",[],[908],{"_104":916,"_96":917,"_156":918,"_158":-5,"_159":141,"_160":919,"_162":22,"_106":920,"_100":32,"_164":225,"_166":921,"_167":22,"_168":-5,"_169":922,"_99":923},"824e28be-5f4c-11f0-8123-0224a6c84d84","PROJECT_MAPPING.MD","824e2954-5f4c-11f0-8123-0224a6c84d84",631,["D",1752344265673],"# ZenServer Project Function Map\n\n## Files Reviewed So Far\n\n### 1. **main.ts** (Entry Point)\n- Imports environment config\n- Validates production secrets\n- Initializes debugger and logging\n- Imports and starts the API gateway\n- Exports app for Val Town\n\n### 2. **src/gateway/apiGateway.ts** (Main App Configuration)\n- Creates OpenAPIHono app with database context\n- Sets up middleware chain:\n - Error handling\n - Request ID\n - Debug middleware\n - Request logging\n - Database attachment\n - CORS\n - Security headers\n - Rate limiting\n - CSRF protection\n- Loads OpenAPI spec\n- Dynamically registers routes using `dynamicHandler.ts`\n- Has fallback handler when OpenAPI loader fails\n\n### 3. **src/handlers/dynamicHandler.ts** (Route Handler System)\n- **dynamicHandler()** - Universal handler that routes requests to business logic\n- **createDynamicHandlerMap()** - Auto-generates handler map from operationIds\n- **extractOperationIds()** - Extracts all operationIds from OpenAPI spec\n- Maps operationIds → businessLogic functions with same name\n\n### 4. **src/handlers/businessLogic.ts** (Business Logic Implementation)\n\n#### ✅ IMPLEMENTED Functions:\n- **listTours()** - Returns TOURS data\n- **getTourDetails()** - Gets specific tour by ID\n- **createNonce()** - Generates payment nonce with:\n - Honeypot validation (email_verify: \"🍯\")\n - Turnstile token validation\n - Database storage of nonce\n- **exchangeNonce()** - Exchanges nonce for payment fingerprint\n- **handlePaymentCallback()** - Processes payment webhook\n- **rootRedirect()** - Redirects to /api/v1/playground\n- **serveDocs()** - Serves Swagger UI\n- **serveDocsV1()** - Serves Swagger UI v1\n- **serveRedocs()** - Serves ReDoc\n- **serveRedocsV1()** - Serves ReDoc v1\n- **playgroundRedirect()** - Redirects to playground\n- **servePlayground()** - Serves Fiberplane playground\n- **getRoutes()** - Returns route information\n- **getOpenApiSpec()** - Returns OpenAPI JSON\n- **getOpenApiSpecV1()** - Returns OpenAPI JSON v1\n- **serveTurnstileTestPage()** - Returns turnstile test message\n- **healthCheck()** - Returns health status\n\n#### ❌ NOT IMPLEMENTED (Throw Errors):\n- **createBooking()** - \"not yet implemented\"\n- **getBookingDetails()** - \"not yet implemented\"\n- **getBookingBySlugAndId()** - \"not yet implemented\"\n- **generateBookingToken()** - \"not yet implemented\"\n- **generatePayToken()** - \"not yet implemented\"\n- **validatePayToken()** - \"not yet implemented\"\n- **verifyTurnstile()** - \"not yet implemented\"\n\n### 5. **openapi.json** (API Specification)\n\n#### All Operation IDs Expected:\n1. **Documentation:**\n - rootRedirect ✅\n - playgroundRedirect ✅\n - servePlayground ✅\n - serveDocs ✅\n - serveDocsV1 ✅\n - serveRedocs ✅\n - serveRedocsV1 ✅\n - getRoutes ✅\n - getRoutesV1 ❓ (Not in businessLogic.ts)\n - getOpenApiSpec ✅\n - getOpenApiSpecV1 ✅\n\n2. **System/Testing:**\n - healthCheck ✅\n - serveTurnstileTestPage ✅\n\n3. **Public Flow:**\n - listTours ✅\n - getTourDetails ✅\n - createBooking ❌ (exists but not implemented)\n - getBookingById ❓ (Not in businessLogic.ts)\n - getBookingBySlugAndId ❌ (exists but not implemented)\n - createNonce ✅\n - exchangeNonce ✅\n - handlePaymentCallback ✅\n\n4. **Admin Flow:**\n - generatePayToken ❌ (exists but not implemented)\n - getBookingByToken ❓ (Not in businessLogic.ts)\n\n## Missing Functions in businessLogic.ts:\n1. **getRoutesV1** - for GET /api/v1/routes\n2. **getBookingById** - for GET /api/v1/booking/{bookingId}\n3. **getBookingByToken** - for GET /api/v1/s/booking/{token}\n\n## Dependencies Noted:\n- Uses `Database` from \"../database/database.ts\"\n- Uses `TOURS` from \"../data/tours.ts\"\n- Uses `TurnstileService` from \"../services/turnstileService.ts\"\n- Uses `PaymentFingerprintService` from \"../services/zenpayFingerprintService.ts\"\n- Uses `DocsHandler` from \"./docsHandler.ts\"\n- Uses utilities from \"../utils/crypto.ts\", \"../utils/logger.ts\"\n- Uses `environment` from \"../config/environment.ts\"\n\n## Database Operations Observed:\n- Table: `app_payment_nonces` (used in createNonce/exchangeNonce)\n - Columns: nonce, booking_id, ip_address, issued_at, expires_at, used\n\n## Services/Utils Referenced But Not Reviewed:\n- TurnstileService.validateToken()\n- PaymentFingerprintService.generateMerchantUniquePaymentId()\n- PaymentFingerprintService.generateTimestamp()\n- PaymentFingerprintService.generatePaymentHash()\n- generateNonce() from crypto utils\n- DocsHandler methods\n\n## Old Handler Files Analysis\n\n### 1. **src/handlers/OldFiles/old.adminHandler.ts** (FULLY IMPLEMENTED)\nThis file contains COMPLETE implementations for:\n\n#### ✅ IMPLEMENTED Payment Functions:\n- **createNonce()** - Full implementation with:\n - CSRF protection validation\n - Honeypot bot detection (email_verify: \"🍯\")\n - Turnstile token validation\n - Nonce generation and storage in `app_payment_nonces` table\n - 60-second TTL\n \n- **exchangeNonce()** - Full implementation with:\n - X-Payment-Nonce header validation\n - Atomic nonce consumption (prevents race conditions)\n - Payment fingerprint generation using PaymentFingerprintService\n - Returns fingerprint for Zenpay integration\n\n- **handlePaymentCallback()** - Full implementation with:\n - Zenpay callback validation\n - ValidationCode verification (SHA3-512 hash)\n - Booking status update in `app_tp_booking_orders` table\n\n#### ✅ IMPLEMENTED Booking Functions:\n- **createBooking()** - Creates booking from tour ID\n- **createBookingForTour()** - Helper function with full booking creation logic\n- **getBookingDetails()** - GET /api/v1/booking/{token} with:\n - Pay token validation and single-use enforcement\n - Returns booking with tour details\n - Sets CSRF cookies\n\n#### ✅ IMPLEMENTED Admin Functions:\n- **generatePayToken()** - POST /api/v1/admin/generate-pay-token with:\n - Bearer token authentication (MASTER_KEY)\n - Creates shareable URL with 14-day expiry\n - Stores in `app_pay_tokens` table\n\n- **validatePayToken()** - Validates and consumes pay tokens atomically\n- **createPayToken()** - Helper for token generation\n- **generateBookingToken()** - Alternative token generation with nonce validation\n- **getBooking()** - Alternative booking retrieval using AuthService\n\n#### Key Features:\n- Uses `generateNonce()` and `generateUUID()` from crypto utils\n- Comprehensive logging and error handling\n- CORS and security headers on all responses\n- Database tables used: `app_payment_nonces`, `app_pay_tokens`, `app_tp_booking_orders`\n\n### 2. **src/handlers/OldFiles/old.apiHandlers.ts** (Alternative Implementation Style)\nThis file shows a different approach using typed handlers with automatic OpenAPI validation:\n\n#### Different Implementation Approach:\n- Uses `AppContext` type with pre-validated data\n- NO manual validation needed (OpenAPI middleware handles it)\n- Cleaner, more concise implementations\n- Returns plain objects instead of Response objects\n\n#### Implemented Functions:\n- **createNonce()** - Similar logic but cleaner implementation\n- **exchangeNonce()** - Simplified with type safety\n- **handlePaymentCallback()** - Returns 204 No Content\n- **listTours()** - With pagination support\n- **getTourDetails()** - With CSRF cookie seeding\n- **getBookingDetails()** - Using typed parameters\n\n### 3. **src/handlers/OldFiles/old.tourHandler.ts** (FULLY IMPLEMENTED)\nComplete tour endpoint implementations:\n\n#### ✅ IMPLEMENTED Functions:\n- **getTourDetails()** - GET /api/v1/tour/{id}:\n - Manual path parsing fallback for non-Hono contexts\n - Full tour data response with extended fields\n - CSRF session creation and cookie setting\n - Security headers from CSP middleware\n\n- **listTours()** - GET /api/v1/tours:\n - Query parameter parsing and validation\n - Pagination with max 10 items per page\n - Featured tour filtering\n - Detailed pagination metadata\n\n#### Extended Tour Interface:\n- Supports additional fields like `short_description`, `long_description`\n- Location fields: `start_location`, `end_location`, `pickup_points`\n- Structured availability with `AvailabilityEntry[]`\n- Detailed itinerary with `ItineraryEntry[]`\n- Business fields: `terms_and_conditions`, `tour_url`\n- Tour characteristics: `group_size`, `difficulty`, `age_restrictions`, `accessibility`\n\n### 4. **src/handlers/OldFiles/old.turnstileHandler.ts** (FULLY IMPLEMENTED)\nTurnstile verification implementations:\n\n#### ✅ IMPLEMENTED Functions:\n- **serveTurnstileTestPage()** - HTML page for testing Turnstile tokens:\n - Complete HTML/CSS/JS implementation\n - Turnstile widget integration\n - Token copy functionality\n - Site key: `0x4AAAAAABjPDL4GDo6BXFza`\n\n- **verifyTurnstile()** - POST endpoint for token verification:\n - Comprehensive input validation\n - IP format validation (IPv4 and IPv6)\n - Token length and format validation\n - Cloudflare API integration\n - Detailed error responses\n\n### 5. **src/handlers/OldFiles/old.webhookHandler.ts** (FULLY IMPLEMENTED)\nGeneric webhook and callback handling:\n\n#### ✅ IMPLEMENTED Functions:\n- **handleWebhook()** - Generic webhook endpoint:\n - JSON payload validation\n - Event type validation\n - API key authentication via AuthService\n - Webhook logging to database\n - Blob storage integration for audit trail\n\n- **handleCallback()** - OAuth/Payment callback handler:\n - State parameter validation (CSRF protection)\n - Provider validation\n - CSRF attack detection\n - Callback logging to database and blob storage\n\n#### Features:\n- Uses Val Town's blob storage for audit trails\n- Comprehensive request header logging\n- Time-based blob key generation\n\n## Current Handler Files Analysis\n\n### 1. **src/handlers/businessLogic.ts** (PARTIALLY IMPLEMENTED)\nCurrent implementation status:\n\n#### ✅ IMPLEMENTED:\n- **listTours()** - Returns TOURS data\n- **getTourDetails()** - Gets tour by ID\n- **createNonce()** - Basic implementation (less comprehensive than old version)\n- **exchangeNonce()** - Basic implementation\n- **handlePaymentCallback()** - Minimal implementation\n- All documentation endpoints (delegated to DocsHandler)\n- System endpoints (healthCheck, getRoutes, getOpenApiSpec)\n\n#### ❌ NOT IMPLEMENTED (throw errors):\n- **createBooking()**\n- **getBookingDetails()**\n- **getBookingBySlugAndId()**\n- **generateBookingToken()**\n- **generatePayToken()**\n- **validatePayToken()**\n- **verifyTurnstile()**\n\n### 2. **src/handlers/adminHandler.ts** (DUPLICATE OF OLD VERSION)\nThis appears to be a copy of old.adminHandler.ts with minor modifications:\n- Uses `crypto.randomUUID()` instead of `generateUUID()`\n- Some import path differences\n- Otherwise identical implementation\n\n### 3. **src/handlers/tourHandler.ts** (SIMILAR TO OLD VERSION)\nAppears to be based on old.tourHandler.ts with same structure\n\n### 4. **src/handlers/docsHandler.ts** (FULLY IMPLEMENTED)\nThis file is responsible for serving all user-facing API documentation and interactive playgrounds.\n\n#### Class: `DocsHandler`\n- **`serveSwaggerDocs(request: Request): Response`**:\n - Serves a modern, feature-rich Swagger UI page.\n - Dynamically loads the OpenAPI spec from `/api/v1/openapi.json`.\n - Includes custom styling for a branded look and feel.\n - Provides a request snippets plugin to generate code examples for cURL, Node.js (Native and Fetch), and Python (Requests).\n - Features robust client-side error handling, a loading indicator, and is configured for OAuth2.\n\n- **`serveOAuth2Redirect(): Response`**:\n - A simple helper that serves the HTML page required for the Swagger UI OAuth2 redirect flow to function correctly.\n\n- **`serveRedocDocs(request: Request): Response`**:\n - Serves API documentation using the clean, three-panel Redocly theme.\n - Also loads the `/api/v1/openapi.json` spec.\n - Includes custom theming and error handling.\n\n- **`serveFiberplanePlayground(request: Request): Promise`**:\n - Serves a custom-built, interactive API playground with a dark theme.\n - It fetches the OpenAPI spec and generates a UI to explore and test API endpoints.\n - Users can build and send requests directly from the browser.\n - Includes a fallback to read the local `openapi.json` file if the HTTP fetch fails.\n\n### 5. **src/handlers/errorHandler.ts** (FULLY IMPLEMENTED)\nThis file provides a global error handling middleware for the Hono application.\n\n#### Function: `globalErrorHandler(err: unknown, c: any)`\n- **Purpose**: To catch all unhandled errors that occur during request processing.\n- **Logging**:\n - It logs the error using the `logger` utility.\n - It attempts to get a `debugCorrelationId` from the request context (`c`) to correlate logs with specific requests.\n- **Response Handling**:\n - If the error thrown was already a `Response` object (a common pattern in Hono), it returns that response directly.\n - Otherwise, it returns a JSON response with a generic \"Internal server error\" message and a `500` status code.\n- **Developer Experience**:\n - It checks the `ENV` environment variable. If it's set to `\"dev\"`, it includes the error's `stack` and `message` in the JSON response to help with debugging. In production, these details are hidden for security.\n\n### 6. **src/handlers/fallbackHandler.ts** (FULLY IMPLEMENTED)\nThis file provides a critical fallback mechanism for when the server fails to initialize properly, specifically when the OpenAPI specification cannot be loaded.\n\n#### Function: `registerFallbackHandler(app: OpenAPIHono, loaderError: Error)`\n- **Purpose**: To register a \"catch-all\" route that takes over if the `OpenAPILoader` fails during startup. This prevents the server from being completely unresponsive and instead provides helpful diagnostic information.\n- **Behavior**:\n - It registers a `app.all(\"*\", ...)` handler that intercepts every incoming request.\n - **HTML Error Page**: If the request is for the root (`/`), `/api`, or `/api/v1`, it serves a detailed, user-friendly HTML error page. This page explains that the OpenAPI spec failed to load, lists common causes (like missing environment variables), and displays the current configuration to help with debugging.\n - **JSON Error Response**: For any other path, it returns a `500` JSON error response containing a clear error message, the specific error from the loader, the request path, and a timestamp.\n\n### 7. **src/handlers/turnstileHandler.ts** (FULLY IMPLEMENTED)\nThis file handles everything related to Cloudflare Turnstile, which is a service for preventing automated abuse (like bots). It contains a class `TurnstileHandler` with two main methods, and it exports a single instance of this class.\n\n#### Class: `TurnstileHandler`\n- **`serveTurnstileTestPage(_request: Request): Response`**:\n - **Purpose**: Provides a simple, self-contained HTML page for developers to test the Turnstile integration.\n - **Functionality**:\n - It renders a page with the Turnstile widget using a public site key.\n - When the user completes the challenge, the page displays the generated token.\n - It includes a \"Copy Token\" button for convenience.\n - It has callbacks to handle success, errors, and token expiration.\n\n- **`async verifyTurnstile(request: Request): Promise`**:\n - **Purpose**: This is the backend endpoint that verifies a Turnstile token submitted by a client.\n - **Input**: Expects a JSON body with a `token` and the user's `remoteip`.\n - **Validation**:\n - Performs extensive validation on the incoming request.\n - Checks for a valid JSON body.\n - Ensures `token` and `remoteip` are present.\n - Validates the IP address format (IPv4 and IPv6).\n - Checks the token length.\n - Uses `ValidationService.validateTurnstileToken` for a format check.\n - **Verification**:\n - It retrieves the `TURNSTILE_SECRET_KEY` from the environment variables.\n - It makes a `POST` request to the Cloudflare `siteverify` endpoint, sending the secret key, the token, and the user's IP.\n - **Response**:\n - If verification is successful, it returns a `200` JSON response with `{ success: true }`.\n - If verification fails, it logs the failure and returns a `400` JSON response with the error codes from Cloudflare.\n - It handles internal errors (e.g., missing secret key) by returning a `500` error.\n - **CORS**: It uses the `addCorsHeaders` function to ensure all responses have the correct CORS headers.\n\n### 8. **src/handlers/webhookHandler.ts** (FULLY IMPLEMENTED)\nThis file provides handlers for receiving and processing incoming webhooks and OAuth/payment callbacks. It defines a `WebhookHandler` class and exports a single instance of it.\n\n#### Class: `WebhookHandler`\n- **`async handleWebhook(request: Request, db: Database): Promise`**:\n - **Purpose**: A generic endpoint designed to receive webhooks from various services.\n - **Authentication**: It requires API key authentication, validated by `AuthService.validateApiKey`.\n - **Input Validation**:\n - Ensures the payload is valid JSON and not empty.\n - Checks for a correctly formatted `event` type in the payload (e.g., `payment.completed`).\n - **Logging and Auditing**:\n - It logs the receipt of the webhook with a unique ID.\n - It stores the full webhook payload, headers, and IP address in the `webhook_logs` database table for auditing.\n - It also saves the payload to Val Town's blob storage, organized by date and time, for a persistent audit trail.\n - **Response**: Returns a `200` JSON response with a unique ID and a \"received\" status.\n\n- **`async handleCallback(request: Request, db: Database): Promise`**:\n - **Purpose**: To handle callbacks from external services like OAuth providers or payment gateways.\n - **Security**:\n - It requires a `state` parameter in the JSON payload for CSRF (Cross-Site Request Forgery) protection.\n - It includes a hardcoded check for a suspicious origin (`evil-site.com`) as a simple CSRF detection mechanism.\n - It also uses `AuthService.validateApiKey` for authentication.\n - **Input Validation**:\n - Validates the JSON payload, checks for the `state` parameter, and validates its format.\n - Handles error callbacks gracefully.\n - Checks for a `provider` field and validates it against a list of known providers (e.g., `google`, `stripe`).\n - **Logging and Auditing**:\n - Similar to `handleWebhook`, it logs the callback receipt and stores the payload in both the `callback_logs` database table and Val Town's blob storage.\n - **Response**: Returns a `200` JSON response indicating the callback was processed successfully.\n\n## Key Findings and Duplications\n\n### 1. **Duplication Issues:**\n- `adminHandler.ts` is essentially a duplicate of `old.adminHandler.ts`\n- `tourHandler.ts` is very similar to `old.tourHandler.ts`\n- `businessLogic.ts` has minimal implementations compared to old handlers\n\n### 2. **Missing Implementations in businessLogic.ts:**\nThe current businessLogic.ts is missing the comprehensive implementations found in old files:\n- No honeypot validation in createNonce\n- No atomic nonce consumption in exchangeNonce\n- No ValidationCode verification in handlePaymentCallback\n- All booking-related functions throw \"not yet implemented\"\n- No turnstile verification implementation\n\n### 3. **Inconsistencies:**\n- Different approaches between old.apiHandlers.ts (typed) and old.adminHandler.ts (Response-based)\n- businessLogic.ts uses a different context structure than old handlers\n- Some handlers return Response objects, others return plain data\n\n### 4. **Database Tables Referenced:**\n- `app_payment_nonces` - For nonce storage\n- `app_pay_tokens` - For shareable payment tokens\n- `app_tp_booking_orders` - For booking information\n- `webhook_logs` - For webhook audit trail\n- `callback_logs` - For callback audit trail\n- `bookings` - Alternative booking table (referenced in some functions)\n\n### 5. **Reusable Code:**\nMost implementations in the old handlers are complete and can be reused:\n- Payment flow (createNonce, exchangeNonce, handlePaymentCallback)\n- Booking management (createBooking, getBookingDetails)\n- Token generation and validation\n- Turnstile verification\n- Webhook handling\n\n## Recommendations:\n1. **Use old.adminHandler.ts implementations** for all payment and booking functions\n2. **Adopt the typed approach** from old.apiHandlers.ts for cleaner code\n3. **Remove duplicates** - decide between adminHandler.ts and businessLogic.ts\n4. **Port missing implementations** from old files to businessLogic.ts\n5. **Standardize the approach** - either Response-based or data-based returns\n\n## Complete File Review Status\n\n### Old Handler Files:\n- [x] **src/handlers/OldFiles/old.adminHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/OldFiles/old.apiHandlers.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/OldFiles/old.tourHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/OldFiles/old.turnstileHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/OldFiles/old.webhookHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n### Current Handler Files:\n- [x] **src/handlers/adminHandler.ts** - ✅ REVIEWED (Duplicate of old.adminHandler.ts)\n- [x] **src/handlers/businessLogic.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/docsHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/dynamicHandler.ts** - ✅ PARTIALLY REVIEWED (in initial map)\n- [x] **src/handlers/errorHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/fallbackHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/tourHandler.ts** - ✅ REVIEWED (Similar to old.tourHandler.ts)\n- [x] **src/handlers/turnstileHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/handlers/webhookHandler.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n### Service Files:\n- [x] **src/services/authService.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/services/publicPayNonceService.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/services/turnstileService.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/services/validationService.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/services/zenpayFingerprintService.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n### Type Definition Files:\n- [x] **src/types/index.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/types/generated-types.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n### Utility Files:\n- [x] **src/utils/cookies.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/crypto.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/dateUtils.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/imageUtils.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/ipUtils.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/jwt.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/logger.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/openApiLoader.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/utils/proxy.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n### src/utils/proxy.ts (NOT IMPLEMENTED)\n- This file is a placeholder for future reverse proxy functionality using `hono/proxy`.\n- All code is currently commented out.\n- When implemented, it would provide helper functions to forward incoming requests to other origin servers, which is a common pattern for API gateways.\n\n### src/utils/logger.ts (FULLY IMPLEMENTED)\nThis file provides a highly detailed and configurable structured logging system for the application. It uses Deno's standard logging module and enhances it with features like correlation IDs, emojis, and specialized formatters.\n\n#### ✅ IMPLEMENTED Functions:\n- **`initializeLogging(...)`**:\n - Sets up the entire logging system based on the environment (`dev` vs. `prod`).\n - In development, it creates separate log files for general app logs, errors, and API traffic (`app.log`, `error.log`, `api.log`).\n - In production, it logs only to the console for serverless environment compatibility.\n - Can clear log files on startup in development mode.\n\n- **`logDebug`, `logInfo`, `logWarn`, `logError`**:\n - A suite of functions for logging at different severity levels.\n - They automatically enrich log entries with the source filename, a correlation ID, and an emoji representing the type of operation (e.g., 💾 for database, 📨 for HTTP request).\n\n- **`withCorrelationId(...)`**:\n - A wrapper function that ensures all operations within a given block (like an entire HTTP request) are tagged with the same unique ID, making it easy to trace a request's entire lifecycle through the logs.\n\n- **Specialized Loggers**:\n - **`logHttpRequest` / `logHttpResponse`**: Specifically for logging incoming requests and outgoing responses.\n - **`logSecurityEvent`**: For logging security-sensitive events like auth failures or honeypot triggers.\n - **`logPerformanceEvent`**: For tracking the performance of specific operations.\n - **`logDatabaseOperation`**: For logging database queries, including their duration.\n\n- **`measureAndLog(...)`**:\n - A performance monitoring utility that wraps a function, automatically logging its execution time and whether it succeeded or failed.\n\n#### Key Features:\n- **Structured Logging**: Outputs logs in JSON format for easy parsing by log management systems, while also providing a colorful, human-readable text format for development.\n- **Correlation IDs**: Crucial for debugging in a microservices or serverless architecture, allowing all logs related to a single request to be grouped together.\n- **Contextual Emojis**: Provides quick visual cues for different types of log events (e.g., 🔐 for security, 🚀 for startup).\n- **Environment-Specific Behavior**: Adapts its output for development (detailed files) and production (console stream), which is a best practice.\n- **Automatic Caller Detection**: Automatically includes the filename where the log was called from, which aids in debugging.\n- **Console Override**: Can take over `console.log` to ensure all output is channeled through the structured logger.\n\n\n### src/utils/openApiLoader.ts (FULLY IMPLEMENTED)\nThis file is the core of the dynamic routing and validation system. It is responsible for loading an OpenAPI specification, converting its schemas into Zod schemas for validation, and then dynamically generating and registering typed API routes in the Hono application.\n\n#### Class: `OpenAPILoader`\n- **`constructor(spec: OpenAPISpec, options: LoaderOptions)`**:\n - Initializes the loader with the OpenAPI specification.\n - It creates instances of `SchemaConverter` and `RouteGenerator` to handle the heavy lifting.\n\n- **`registerRoutes(app: OpenAPIHono, handlers: HandlerMap)`**:\n - This is the main method that orchestrates the route registration process.\n - It iterates through every path and HTTP method defined in the `openapi.json` file.\n - For each endpoint, it finds the corresponding handler function from the `handlers` map (based on the `operationId`).\n - It uses `RouteGenerator` to create a Hono-compatible route configuration, including request and response schemas.\n - It then registers the route and its handler with the Hono application using `app.openapi()`, which automatically applies validation middleware.\n\n#### Class: `SchemaConverter`\n- **Purpose**: To translate OpenAPI schema definitions into Zod schemas.\n- **Functionality**:\n - It handles various OpenAPI schema types (`string`, `number`, `object`, `array`, etc.).\n - It correctly interprets and converts validation rules like `minLength`, `maxLength`, `pattern`, `minimum`, and `maximum`.\n - It supports complex schema structures like `$ref` (references to other schemas), `oneOf`, and `allOf`.\n - This conversion is what enables automatic, type-safe request validation.\n\n#### Class: `RouteGenerator`\n- **Purpose**: To create the route configuration object that Hono's `createRoute` function needs.\n- **Functionality**:\n - It takes the OpenAPI definition for a single endpoint.\n - It builds the `request` object, defining Zod schemas for `path`, `query`, `header`, and `body` parameters.\n - It builds the `responses` object, defining the expected shape of the JSON response for different status codes (e.g., 200, 404, 500).\n\n#### Key Helper Functions:\n- **`createOpenAPILoader(...)`**:\n - The factory function that should be used to create an instance of the loader.\n - It intelligently loads the `openapi.json` spec from either the local filesystem (in development) or from Val Town's blob storage (in production), providing a robust, environment-aware loading mechanism. It even includes a fallback to a public URL if the blob is unavailable.\n\n#### Key Features:\n- **Dynamic and Declarative**: The entire API's routing is declared in the `openapi.json` file. To add, remove, or change a route, you only need to modify the spec and provide a corresponding handler function. The loader handles all the boilerplate.\n- **Automatic Validation**: Because the loader converts OpenAPI schemas to Zod schemas, all incoming requests are automatically validated. If a request has a missing parameter or an invalid body, the server will automatically return a `400 Bad Request` error without the handler code ever running.\n- **Type Safety**: The generated routes are fully type-safe, meaning that inside a handler, you can trust that `c.req.valid('query')` will have the exact shape you defined in your schema, with full autocompletion in your IDE.\n- **Environment-Aware Loading**: The loader knows whether it's in a production (Val Town) or development environment and fetches the OpenAPI spec from the appropriate source, which is a critical feature for deployment.\n\n\n### src/utils/imageUtils.ts (FULLY IMPLEMENTED)\nThis file provides helper functions for generating image URLs and managing tour-specific images.\n\n#### ✅ IMPLEMENTED Functions:\n- **`getImageUrl(filename: string): string`**:\n - Constructs a full, absolute image URL by combining the `IMAGES_BASE_URL` from the environment configuration with a given filename.\n - Example: `https://cdn.example.com/my-image.jpg`\n\n- **`getRelativeImageUrl(filename: string): string`**:\n - Creates a relative image URL, which is useful for local development or when the base path is handled by the client.\n - Example: `/images/my-image.jpg`\n\n- **`getTourImageUrls(imageName: keyof typeof TOUR_IMAGES)`**:\n - A specialized function that returns a structured object containing multiple image URLs for a specific tour.\n - It uses a predefined mapping (`TOUR_IMAGES`) of tour names to Unsplash URLs.\n - For a given tour name (e.g., `paris`), it returns an object with `heroImageUrl`, `gallery` (an array), `image_url`, and `images` (an array), currently using the same image for all for simplicity.\n\n#### Key Features:\n- **Centralized Image Management**: Consolidates image URL generation in one place, making it easy to update image paths across the application.\n- **Environment-Dependent Base URL**: Uses the `environment.IMAGES_BASE_URL` to allow for different image sources in development, staging, and production.\n- **Static Image Mapping**: The `TOUR_IMAGES` constant provides a clear, hardcoded map of tour identifiers to specific, high-quality images from Unsplash, suitable for a demo or initial version.\n\n### src/utils/ipUtils.ts (FULLY IMPLEMENTED)\nThis file provides a comprehensive set of utilities for handling, validating, and securing IP addresses.\n\n#### ✅ IMPLEMENTED Functions:\n- **`getClientIP(request: Request | Context): string`**:\n - Reliably determines the client's real IP address by checking a prioritized list of HTTP headers (e.g., `X-Forwarded-For`, `True-Client-IP`).\n - The list of headers is configurable via `environment.IP_HEADER_KEYS`.\n - It correctly handles comma-separated IP lists and falls back to connection properties if available.\n\n- **`isValidIP(ip: string): boolean`**:\n - A master validation function that checks if a string is a valid IPv4 or IPv6 address using robust regular expressions.\n\n- **`parseIPAddress(ip: string): IPAddress | null`**:\n - Analyzes a valid IP address and returns a detailed object containing its `version` (`IPv4`/`IPv6`), and boolean flags for `isPrivate` and `isLoopback`.\n\n- **`isIPInCIDR(ip: string, cidr: string): boolean`**:\n - Checks if a given IP address falls within a specified CIDR range (e.g., `192.168.1.0/24`), supporting both IPv4 and IPv6.\n\n- **`anonymizeIP(ip: string): string`**:\n - A privacy-enhancing function that removes the least significant parts of an IP address (the last octet for IPv4, the last 64 bits for IPv6) before logging or storage.\n\n- **`performIPSecurityCheck(...)`**:\n - A crucial security function that checks an IP against configurable allow/deny lists and rules for private/loopback addresses.\n - Returns whether the IP is allowed and the reason for denial.\n\n- **`getClientInfo(request: Request | Context)`**:\n - Gathers a complete profile of the client, returning the IP address, parsed IP info, `User-Agent`, `Referer`, and `Origin` headers.\n\n#### Key Features:\n- **Robust IP Detection**: Prioritizes trusted headers to prevent IP spoofing.\n- **Comprehensive Validation**: Includes strict regex for both IPv4 and IPv6 formats.\n- **Security-Focused**: Provides essential tools for IP-based access control (`isIPAllowed`, `isIPDenied`, `performIPSecurityCheck`).\n- **Privacy-Aware**: Includes an anonymization function for safe logging.\n- **CIDR Support**: Allows for flexible network-range-based rules.\n- **Environment-Aware**: Integrates with the `environment` configuration for dynamic settings.\n\n### Database Schema Files:\n- [x] **src/database/database.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/database/appTPCoreSchema.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/database/schema.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/database/sysInfraSchema.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/database/sysHookBacksSchema.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n\n### src/database/database.ts (FULLY IMPLEMENTED)\nThis file establishes the primary database service for the application, acting as a repository and service layer on top of Val Town's hosted SQLite interface. It handles schema initialization, query execution, and provides business-specific database operations.\n\n#### Class: `Database`\n- **`async initialize(): Promise`**:\n - A critical startup method that creates the database schema if it doesn't exist.\n - It executes the SQL from `schema.ts` to define all necessary tables.\n - For demonstration purposes, it also inserts sample booking data from `schema.ts`.\n - It creates indexes on tables to ensure query performance.\n - This method is designed to be idempotent, meaning it can be run safely multiple times.\n\n- **`async query(sql: string, params: any[]): Promise`**:\n - A generic method for executing `SELECT` queries.\n - It takes a SQL string and parameters to prevent SQL injection.\n - A key feature is that it automatically converts the array-based results from the underlying SQLite driver into more useful arrays of objects, where keys correspond to column names.\n\n- **`async execute(sql: string, params: any[]): Promise`**:\n - A generic method for executing `INSERT`, `UPDATE`, or `DELETE` statements.\n - It returns the raw result from the driver, which includes the number of rows affected.\n\n#### Nonce-Specific Operations:\nThis class contains a set of methods specifically for managing the lifecycle of payment nonces, which is a core part of the application's security and payment flow.\n- **`async storeNonce(...)`**:\n - Inserts a new nonce record into the `app_tp_payment_nonces` table.\n - It captures important security context, such as the client's IP address, User-Agent, and a 15-minute expiration time.\n\n- **`async getNonce(nonce: string): Promise`**:\n - Retrieves a single nonce record from the database.\n\n- **`async validateAndUseNonce(...)`**:\n - This is a crucial, security-sensitive method that performs several checks in a single transaction:\n 1. Verifies that the nonce exists.\n 2. Checks that the client's IP address matches the one that originally requested the nonce.\n 3. Ensures the nonce has not already been used.\n 4. Checks that the nonce has not expired.\n 5. If all checks pass, it marks the nonce as `used` to prevent replay attacks.\n\n- **`async getFingerprintStatus(...)`**:\n - Checks how many times a payment has been attempted for a given booking to enforce rate limiting (e.g., max 5 attempts).\n\n#### Key Features:\n- **Repository Pattern**: The `Database` class encapsulates all database logic, so the rest of the application doesn't need to know the specifics of SQL or the database schema.\n- **Schema Management**: Handles its own schema creation and initialization, making the application self-contained and easier to set up.\n- **Security-First Nonce Handling**: The nonce validation logic is robust, checking IP addresses and ensuring single-use, which is essential for preventing fraudulent transactions.\n- **Val Town Integration**: It correctly imports and uses the `std/sqlite` module and sets the required `valtown` environment variable.\n- **Custom Error Handling**: It defines a `DatabaseError` class to provide more context when database operations fail.\n\n\n### src/database/appTPCoreSchema.ts (FULLY IMPLEMENTED)\nThis file defines the SQL schema for the core business logic of the application. It contains the `CREATE TABLE` statements for the tables that manage the travel/tour booking and payment process.\n\n#### Schema Definitions:\n- **`app_payment_nonces`**:\n - **Purpose**: Stores single-use tokens (nonces) that are generated to authorize a payment attempt. This is a critical security table to prevent replay attacks.\n - **Key Columns**: `nonce` (the token itself), `booking_id` (links to an order), `used` (a flag to ensure it's only used once), `ip_address` (for security checks), and `expires_at` (nonces are short-lived).\n\n- **`app_tp_booking_orders`**:\n - **Purpose**: This is the main table for storing booking or order information.\n - **Key Columns**: `id` (the unique booking ID), `tour_code` (identifies the tour), `pax_count` (number of people), `amount`, `currency`, and `status` (`pending`, `paid`, `cancelled`).\n\n- **`app_tp_booking_access_tokens`**:\n - **Purpose**: Stores long-lived tokens that could be used to allow a customer to view their booking details after the fact.\n - **Key Columns**: `token`, `booking_id`, and `expires_at`.\n\n- **`app_pay_tokens`**:\n - **Purpose**: Stores one-time access tokens that grant the holder the ability to *initiate* a payment for a specific booking. This could be used for \"Pay Now\" links sent via email.\n - **Key Columns**: `token`, `booking_id`, `used`, and `expires_at`.\n\n#### Key Features:\n- **Clear Naming**: The table and column names are descriptive and follow a consistent convention (e.g., `app_tp_` prefix).\n- **Indexed for Performance**: The schema includes `CREATE INDEX` statements on foreign keys (`booking_id`) and frequently queried columns (`status`, `expires_at`, `used`). This is crucial for maintaining performance as the tables grow.\n- **Relational Integrity**: It uses `FOREIGN KEY` constraints to link the token tables back to the `app_tp_booking_orders` table, ensuring data consistency.\n- **Security-Minded Columns**: The inclusion of `ip_address`, `user_agent`, and `expires_at` in the token tables demonstrates a focus on security and auditing.\n\n\n### src/database/schema.ts (FULLY IMPLEMENTED)\nThis file acts as the central hub for the entire database schema. It doesn't define any tables itself; instead, it imports schema definitions from other, more specialized files and combines them into a single, comprehensive SQL script.\n\n#### ✅ IMPLEMENTED Logic:\n- **Schema Aggregation**:\n - It imports three separate schema strings:\n - `APP_TP_CORE_SCHEMA`: The core business logic tables (bookings, nonces, etc.).\n - `SYS_WEBHOOKS_SCHEMA`: Tables for logging and auditing incoming webhooks.\n - `SYS_INFRA_SCHEMA`: Tables for system-level infrastructure and security monitoring (rate limits, security events).\n - It then concatenates these strings into a single `SCHEMA_SQL` constant. This is the constant that the `Database` service uses to initialize the entire database in one go.\n\n- **Sample Data Seeding**:\n - It defines `SAMPLE_BOOKINGS_SQL`, which contains `INSERT` statements to populate the `app_tp_booking_orders` table with dummy data.\n - This is a common and useful pattern for development and testing, as it ensures that the database has predictable content to work with right after it's created.\n - The `INSERT OR IGNORE` command is used to prevent errors if the data already exists, making the script safe to run multiple times.\n\n#### Key Features:\n- **Modularity**: By splitting the schema into multiple files (`appTPCoreSchema.ts`, `sysHookBacksSchema.ts`, etc.), the database design is kept clean and organized. Each file has a clear responsibility.\n- **Centralized Entry Point**: This file provides a single, reliable source for the complete database schema, which simplifies the initialization logic in `database.ts`.\n- **Test Data Management**: Separating the schema definition (`SCHEMA_SQL`) from the test data (`SAMPLE_BOOKINGS_SQL`) is a good practice. It allows the application to create an empty database in production while still having sample data available for development environments.\n\n\n### src/database/sysInfraSchema.ts (FULLY IMPLEMENTED)\nThis file provides the SQL schema for tables related to the application's core infrastructure, security, and operational monitoring.\n\n#### Schema Definitions:\n- **`sys_rate_limits`**:\n - **Purpose**: To track the number of requests from a specific IP address to a specific endpoint within a given time window. This is the backing table for the rate-limiting middleware.\n - **Key Columns**: `ip_address`, `endpoint`, `request_count`, and `window_start`. The primary key is a composite of `ip_address` and `endpoint`.\n\n- **`sys_security_events`**:\n - **Purpose**: A critical audit log for recording any security-sensitive event that occurs in the application.\n - **Key Columns**: `event_type` (e.g., `auth_failure`, `honeypot_trigger`), `ip_address`, `user_agent`, and `details` (a JSON blob for extra context).\n\n- **`sys_blocked_ips` / `sys_whitelisted_ips`**:\n - **Purpose**: These tables provide a persistent mechanism for implementing an IP-based firewall. An administrator could add an IP address to `sys_blocked_ips` to immediately block it from accessing the application.\n - **Key Columns**: `ip_address`, `reason` for blocking, and an optional `expires_at` for temporary blocks.\n\n- **`sys_blocked_geos` / `sys_whitelisted_geos`**:\n - **Purpose**: Similar to the IP firewall tables, these allow for blocking or allowing traffic based on the country of origin, identified by a two-letter `country_code`.\n - **Key Columns**: `country_code`, `reason`, `blocked_at`.\n\n#### Key Features:\n- **Operational Health**: The `sys_rate_limits` table is fundamental to protecting the application from denial-of-service attacks and abuse.\n- **Security Auditing**: The `sys_security_events` table provides an essential, long-term record for security analysis and incident response.\n- **Dynamic Access Control**: The block/whitelist tables for IPs and geographic locations allow for dynamic, database-driven access control without requiring code changes or redeployments.\n- **Performance**: All tables are appropriately indexed on columns that would be used in `WHERE` clauses (e.g., `ip_address`, `timestamp`, `event_type`), which is critical for the performance of security checks.\n\n\n### src/database/sysHookBacksSchema.ts (FULLY IMPLEMENTED)\nThis file defines the SQL schema for tables related to system-level webhook management and auditing. \"HookBacks\" seems to be a project-specific term for webhooks.\n\n#### Schema Definitions:\n- **`sys_webhooks`**:\n - **Purpose**: This table would be used to configure outgoing webhooks that the system might send to external services. For example, you could register a URL to be notified whenever a new booking is paid.\n - **Key Columns**: `id`, `url` (the destination URL to send the webhook to), `event_type` (the event that triggers the webhook, e.g., `booking.paid`), and `is_active`.\n\n- **`sys_webhook_logs`**:\n - **Purpose**: This table is for logging *incoming* webhooks received from external services (like a payment gateway). It serves as a crucial audit trail.\n - **Key Columns**: `id`, `webhook_id` (linking to the configuration), `payload` (the full JSON body of the webhook), `headers`, `ip_address`, and `timestamp`.\n\n#### Key Features:\n- **Auditing**: The `sys_webhook_logs` table is essential for debugging and security. It provides a persistent record of every webhook the system receives, which is invaluable for troubleshooting issues with third-party integrations.\n- **Configurability**: The `sys_webhooks` table provides a flexible way to manage outgoing webhooks without changing application code.\n- **Performance**: Indexes are created on `webhook_id` and `timestamp` to ensure that querying and filtering the logs remains fast.\n\n\n\n### Configuration Files:\n- [x] **src/config/environment.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/config/securityConfig.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n### src/config/environment.ts (FULLY IMPLEMENTED)\nThis file is the central point of configuration for the entire application. It is responsible for reading environment variables, providing sensible defaults, and exporting a single, unified `environment` object that the rest ofthe application can use.\n\n#### ✅ IMPLEMENTED Logic:\n- **`.env` Loading**:\n - It uses `jsr:@std/dotenv` to load environment variables from a `.env` file.\n - This is configured to only run in a local development environment, and it gracefully handles the absence of the file when deployed to Val Town.\n\n- **Environment-Aware Defaults**:\n - It intelligently determines if the application is running in a local development environment (`isLocalDev`) or in production (Val Town).\n - It then uses this information to provide sensible defaults for key settings. For example:\n - `BASE_URL` defaults to `http://localhost:5000` in development and the public Val Town URL in production.\n - `LOG_DIR` defaults to a local `./logs` directory in development and `/tmp/logs` (a writable directory in many serverless environments) in production.\n\n- **Configuration Aggregation**:\n - It defines general application settings (like `PORT`, `LOG_LEVEL`, `BASE_URL`).\n - It imports all security-related settings from `securityConfig.ts`.\n - It then combines these into a single, flat `environment` object using the spread syntax (`...security`). This makes it incredibly easy for any other module to access any configuration variable from a single, consistent source (e.g., `environment.CORS_ALLOWED_ORIGINS`).\n\n- **Helper Function**:\n - It uses a `getEnv` helper function to safely retrieve values from `Deno.env`, providing a fallback to a default value if the environment variable is not set.\n\n#### Key Features:\n- **Single Source of Truth**: By consolidating all configuration into one object, it avoids scattering `Deno.env.get()` calls throughout the codebase, making the application easier to manage and understand.\n- **Separation of Concerns**: It keeps general app configuration separate from security-specific configuration (`securityConfig.ts`), which is a good practice.\n- **Robust Defaults**: The environment-aware defaults make it easy to run the application locally without extensive setup, while also ensuring it works correctly when deployed.\n- **Clear and Readable**: The file is well-structured and easy to read, making it clear where each configuration value comes from.\n\n### src/config/securityConfig.ts (FULLY IMPLEMENTED)\nThis file is dedicated exclusively to security-related configuration. It centralizes all secrets, access control lists, and middleware settings, which are then imported and merged by `environment.ts`. This separation is a critical security best practice.\n\n#### Configuration Sections:\n- **Secrets**:\n - It defines variables to hold all the application's secrets, which are loaded from environment variables. This includes API keys (`ZP_API_KEY`, `TURNSTILE_SECRET_KEY`), session secrets, and master keys.\n - Crucially, it includes a `validateProductionSecrets()` function that checks for the presence of these required secrets when the application starts in production mode, causing it to fail fast if any are missing.\n\n- **CORS (Cross-Origin Resource Sharing)**:\n - It defines `ALLOWED_ORIGINS` and `ALLOWED_HEADERS`, which control which external domains and HTTP headers are allowed to interact with the API. These are loaded from comma-separated strings in environment variables for easy configuration.\n\n- **Cookie Security**:\n - It provides detailed configuration for all cookies set by the application, including `Max-Age`, `Path`, `Domain`, and `SameSite` attributes. This is essential for preventing cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.\n\n- **Rate Limiting**:\n - It defines the specific rate limits for sensitive endpoints (e.g., 5 requests per minute for `create-nonce`). This is a key defense against denial-of-service and brute-force attacks.\n\n- **IP and User-Agent Rules**:\n - It defines lists of trusted admin IP addresses (`ADMIN_IPS`), suspicious User-Agent strings to be flagged, and a list of headers to check for the real client IP address.\n\n#### Key Features:\n- **Centralized Security Configuration**: Having all security settings in one place makes it easy to audit and manage the application's security posture.\n- **Secret Validation**: The `validateProductionSecrets` function is a vital safeguard that prevents the application from running in an insecure state in production.\n- **Environment-Driven**: All settings are derived from environment variables, allowing for different configurations in development, staging, and production without any code changes.\n- **Granular Control**: The file provides fine-grained control over many different security aspects, from individual cookie settings to per-endpoint rate limits.\n- **Best Practices**: The separation of security configuration from general configuration is a highly recommended security practice.\n\n### Gateway and Data Files:\n- [x] **src/data/tours.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n- [x] **src/gateway/apiGateway.ts** - ✅ FULLY REVIEWED & DOCUMENTED\n\n### src/gateway/apiGateway.ts (FULLY IMPLEMENTED)\nThis file serves as the main entry point and central nervous system for the Hono web server. It initializes the application, sets up the entire middleware pipeline in a specific order, and orchestrates the dynamic loading and registration of all API routes from the OpenAPI specification.\n\n#### ✅ IMPLEMENTED Logic:\n- **Application Initialization**:\n - It creates an `OpenAPIHono` application instance, which is an extension of the base Hono framework that adds OpenAPI-specific capabilities.\n - It initializes the `Database` service, ensuring a database connection is ready before any requests are handled.\n\n- **Middleware Pipeline**:\n - It registers a series of middleware functions that are executed in order on every incoming request. This pipeline is critical for handling cross-cutting concerns like security, logging, and error handling.\n - The order is important:\n 1. **`globalErrorHandler`**: A top-level try/catch for the entire application.\n 2. **`requestIdMiddleware`**: Assigns a unique ID to every request for logging and tracing.\n 3. **`createDebugMiddleware` / `requestLoggerMiddleware`**: Sets up debugging and logs the start of every request.\n 4. **Database Attachment**: Attaches the initialized `db` instance to the request context (`c.set(\"db\", db)`), making it available to all downstream handlers.\n 5. **Security Middleware**: It runs a chain of security-focused middleware in order:\n - `corsMiddleware`: Handles Cross-Origin Resource Sharing rules.\n - `securityMiddleware`: Applies various security headers (like CSP).\n - `rateLimitMiddleware`: Enforces rate limits to prevent abuse.\n - `getOriginBasedCSRFMiddleware`: Provides Cross-Site Request Forgery protection.\n\n- **Dynamic Route Registration**:\n - It uses the `createOpenAPILoader` utility to fetch and parse the `openapi.json` specification.\n - **Crucially, it uses `extractOperationIds` and `createDynamicHandlerMap` to automatically generate a mapping from every `operationId` in the spec to a generic handler function.** This is the core of its \"truly dynamic\" nature—it doesn't need a manually maintained list of routes.\n - It then calls `registerOpenApiRoutes` to create all the API endpoints, complete with automatic request and response validation based on the schemas in the spec.\n\n- **Robust Error Handling**:\n - It includes a `try...catch` block around the `OpenAPILoader`. If the spec fails to load (a critical startup failure), it calls `registerFallbackHandler`.\n - This fallback registers a special \"catch-all\" route that informs the user that the server failed to start and provides debugging information, preventing the server from being completely unresponsive.\n\n#### Key Features:\n- **Centralized Application Setup**: All core application setup (database, middleware, routing) happens in this one file, making it easy to understand the application's structure.\n- **Ordered Middleware Pipeline**: The middleware is carefully ordered to ensure that dependencies are met (e.g., the request logger runs before the route handler, and the error handler wraps everything).\n- **Truly Dynamic Routing**: The application is not tied to a specific set of routes. It can adapt to *any* OpenAPI specification provided to it, automatically creating handlers and validation for every defined endpoint. This makes the gateway incredibly flexible and scalable.\n- **Resilient Startup**: The fallback handler for a failed OpenAPI load is a key feature for production robustness, ensuring the server provides a helpful error message instead of just crashing or hanging.\n- **Context Enrichment**: It enriches the request context (`c`) with essential services like the database connection (`db`) and a `debugCorrelationId`, following Hono best practices.\n\n\n### src/data/tours.ts (FULLY IMPLEMENTED)\nThis file serves as a static data source or a mock database for the application's tour information. It defines the `Tour` interface and exports a constant array `TOURS` containing several detailed tour objects.\n\n#### Interface: `Tour`\n- **Purpose**: Defines the data structure for a single tour, ensuring that all tour objects in the `TOURS` array are consistent.\n- **Key Properties**:\n - Basic Info: `tourId`, `title`, `description`, `duration`, `price`, `currency`.\n - Media: It uses the `getTourImageUrls` utility to populate image-related fields like `heroImageUrl` and `gallery`.\n - Details: `inclusions`, `exclusions`, `itinerary`, `availability`.\n - Booking: `callToAction`, `payNowEnabled`.\n - Extended Fields: The interface is comprehensive, including fields for accessibility, age restrictions, group size, and detailed location info, making it suitable for a real-world travel application.\n\n#### Constant: `TOURS`\n- **Purpose**: An array of `Tour` objects that acts as the in-memory database for the application.\n- **Content**:\n - It contains several pre-defined tours with rich, detailed information (e.g., \"Paris Explorer,\" \"Tokyo Adventure,\" \"Sunset Sailing Adventure\").\n - The data is well-structured and includes everything needed to render a complete tour details page, from pricing and availability to a day-by-day itinerary.\n\n#### Key Features:\n- **Type-Safe Data**: By using the `Tour` interface, the file ensures that all tour data is strongly typed, which prevents common data-related bugs and improves developer experience with autocompletion.\n- **Centralized Data Source**: It provides a single, easy-to-manage source of truth for tour data. In a real application, this data would likely come from a database, but for a demo or prototype, this approach is very effective.\n- **Rich, Realistic Content**: The data is not just placeholder text; it's detailed and realistic, which is excellent for building and testing a feature-rich user interface.\n- **Integration with Utilities**: It correctly uses the `getTourImageUrls` function from `imageUtils.ts` to handle image URLs, demonstrating good code reuse.\n\n### Other Previously Reviewed Files:\n- [x] **main.ts** - ✅ FULLY REVIEWED & DOCUMENTED (Entry Point)\n- [x] **openapi.json** - ✅ FULLY REVIEWED & DOCUMENTED (API Specification)",[],[917],{"_104":925,"_96":926,"_156":927,"_158":-5,"_159":141,"_160":928,"_162":22,"_106":929,"_100":32,"_164":225,"_166":930,"_167":22,"_168":-5,"_169":931,"_99":932},"9eced2e6-5d75-11f0-8775-0224a6c84d84","Z1-Server.md","9eced39a-5d75-11f0-8775-0224a6c84d84",537,["D",1752142020533],"Based on the attached files, this is a **Zenith API Server (Z1)** - a microservices-based payment processing and webhook management system built on Val Town. Here's a comprehensive summary:\r\n\r\n## 🏗️ **Architecture Overview**\r\n\r\nThe system follows a **router-based microservices pattern** where a central router (`Router.ts`) distributes requests to specialized endpoint handlers. Each service communicates using internal JWT tokens for security.\r\n\r\n## 🛣️ **Endpoints & Capabilities**\r\n\r\n### **1. Router (`/`)**\r\n\r\n- **Health checks**: `/`, `/ping`, `/health` - System status monitoring\r\n- **Request routing**: Distributes traffic to specialized handlers\r\n- **ZID generation**: Creates unique request identifiers for tracking\r\n- **Internal token management**: Generates JWT tokens for inter-service communication\r\n\r\n### **2. Webhooks (`/hooks`)**\r\n\r\n- **POST `/hooks`**: Store incoming webhook data\r\n- **GET `/hooks`**: List webhooks with filtering (date range, payload mode)\r\n- **GET `/hooks/{id}`**: Retrieve specific webhook record\r\n- **DELETE `/hooks/{id}`**: Remove webhook record\r\n- **Metadata capture**: IP, country, user agent, headers, request body\r\n\r\n### **3. Hash Generation (`/hash`)**\r\n\r\n- **Payment fingerprint generation** using SHA-1, SHA-512, or SHA3-512\r\n- **Multiple payment modes**:\r\n - Mode 0: Payment amount > 0\r\n - Mode 1: Payment amount ≥ 0\r\n - Mode 2: Payment amount = 0\r\n - Mode 3: Payment amount ≥ 0\r\n- **Input validation**: Credentials, timestamps, payment amounts\r\n- **Version support**: v3, v4, v5 hash algorithms\r\n\r\n### **4. Enhanced Hash (`/zenhash`)**\r\n\r\n- **Environment-based credentials**: Pulls username/password from environment variables\r\n- **Payment schemes**: tp, rr, b2b, tbp, sep, ccep\r\n- **Same validation & hashing** as `/hash` but with scheme-based credential injection\r\n\r\n### **5. Proxy (`/proxy`)**\r\n\r\n- **HTTP proxy service**: Forward requests to external services\r\n- **Header preservation**: Maintains authentication headers (h-key, api-key, authorization)\r\n- **Universal method support**: GET, POST, PUT, DELETE, etc.\r\n\r\n### **6. SlicePay (`/create-link`)**\r\n\r\n- **Payment link creation** (delegated to external handler)\r\n- **Link generation** for payment processing\r\n\r\n## 🔒 **Security Architecture**\r\n\r\n### **Multi-Layer Security**\r\n\r\n1. **External Validation**: Rate limiting, IP restrictions, request sanitization\r\n2. **Internal JWT Authentication**: Service-to-service communication security\r\n3. **Request Correlation**: ZID tracking across all services\r\n\r\n### **JWT Security Features**\r\n\r\n- **HMAC SHA-512** token signing\r\n- **Context validation**: IP, User-Agent, host, path matching\r\n- **5-minute expiration** with clock skew tolerance\r\n- **Development mode** support for local testing\r\n\r\n### **Request Security**\r\n\r\n- **Header sanitization** and validation\r\n- **Input sanitization** for all user data\r\n- **Cloudflare integration**: IP geolocation, country detection\r\n- **CORS, CSP, and security headers**\r\n\r\n## 💾 **Data Storage (SQLite)**\r\n\r\n### **Tables**\r\n\r\n- **`webhooks`**: Webhook request records\r\n- **`hash`**: Basic hash generation logs\r\n- **`zenhash`**: Enhanced hash generation logs\r\n- **`logs`**: General application logs\r\n- **`rate_limits`**: Rate limiting data\r\n\r\n### **Metadata Tracking**\r\n\r\n- Request headers, body, timestamp\r\n- Client IP, country, user agent\r\n- ZID correlation across services\r\n- Hash generation parameters and results\r\n\r\n## 🌐 **Integration Features**\r\n\r\n### **Cloudflare Integration**\r\n\r\n- **IP detection**: `cf-connecting-ip`, `x-forwarded-for`\r\n- **Geolocation**: Country, city, region detection\r\n- **Security headers**: Automatic forwarding of CF security data\r\n\r\n### **Environment Configuration**\r\n\r\n- **Scheme-based credentials**: `U_TP`, `P_TP`, etc.\r\n- **JWT secrets**: Configurable signing keys\r\n- **Endpoint URLs**: Microservice endpoint configuration\r\n\r\n## 🔧 **Operational Capabilities**\r\n\r\n### **Monitoring & Debugging**\r\n\r\n- **Health checks**: System-wide status monitoring\r\n- **Request correlation**: ZID-based request tracking\r\n- **Comprehensive logging**: Full request/response capture\r\n- **Error handling**: Detailed error responses with stack traces\r\n\r\n### **Performance Features**\r\n\r\n- **Async processing**: Non-blocking request handling\r\n- **Connection pooling**: Efficient database connections\r\n- **Rate limiting**: Built-in request throttling\r\n\r\n## 📊 **Use Cases**\r\n\r\nThis system appears designed for:\r\n\r\n- **Payment processing**: Secure hash generation for payment gateways\r\n- **Webhook management**: Capture and process incoming webhooks\r\n- **API proxying**: Route requests to external services\r\n- **Request auditing**: Full request/response logging for compliance\r\n- **Multi-tenant support**: Scheme-based credential management\r\n\r\nThe architecture suggests it's a **production-grade payment infrastructure** with enterprise security features, comprehensive logging, and microservices scalability.\r\n",[],[926],{"_104":934,"_96":935,"_156":936,"_158":-5,"_159":141,"_160":937,"_162":22,"_106":938,"_100":32,"_164":225,"_166":939,"_167":22,"_168":-5,"_169":940,"_99":941},"49612db0-5e6d-11f0-b051-0224a6c84d84","ZenApp.md","49612e50-5e6d-11f0-b051-0224a6c84d84",586,["D",1752248392398],"\r\n\r\n# ZenServer: Full-Stack Payment Flow Architecture\r\n\r\n**Document Version:** 1.1 (Corrected)\r\n**Last Updated:** 2025-07-11\r\n\r\n## 1. Introduction & System Overview\r\n\r\nThis document provides a comprehensive, end-to-end architectural overview of the ZenServer payment platform. It merges the client-side implementation details of the React Single-Page Application (SPA) with the formal backend API specifications, creating a single source of truth for developers.\r\n\r\nThe architecture consists of two primary components:\r\n\r\n- **Frontend (React SPA)**: A client-side application built with React, TypeScript, and Tailwind CSS. It is responsible for rendering the user interface, managing the multi-step checkout flow, and interacting with the backend to fetch data and process payments. It is served as a static asset by a Hono server.\r\n- **Backend (ZenServer API)**: A secure, JSON-only API that handles business logic, data persistence, and all security operations. It is responsible for managing tours, generating security tokens (CSRF, Nonces), calculating payment fingerprints, and interfacing with the ZenPay gateway.\r\n\r\nThe system employs a **progressive security model** where security controls are layered on at each stage of the user's journey, culminating in a nonce-gated payment flow.\r\n\r\n## 2. User & Application Flow\r\n\r\nThe application supports two primary user journeys for booking a tour: the standard website flow and a direct booking link flow for emails or administrative use.\r\n\r\n### 2.1 Standard Website Booking Flow\r\n\r\nThis flow describes the journey for a typical user visiting the website. After filling out their details, a booking record is created to persist the information before proceeding to the secure payment stage.\r\n\r\n```mermaid\r\n graph TD\r\n A[User visits website] --> B[Landing Page - Step 0]\r\n B --> B1[Call: GET /api/v1/tour/tour-list]\r\n B1 --> C[Display 6 tour cards]\r\n C --> D[User selects tour]\r\n D --> E[Call: GET /api/v1/tour/{id}]\r\n E --> E1[Server sets SESSION + XSRF cookies]\r\n 1 --> F[Form Page - Step 1]\r\n F --> G[User fills traveler info]\r\n G --> G1[Call: POST /api/v1/booking]\r\n G1 --> H[User checks terms & clicks Continue]\r\n H --> I[Payment Page - Step 2]\r\n I --> J[Turnstile CAPTCHA loads]\r\n J --> K[User completes verification]\r\n K --> L[Call: POST /api/v1/payment/create-nonce]\r\n L --> M[Call: POST /api/v1/payment/exchange-nonce]\r\n M --> N[ZenPay.init() with fingerprint]\r\n N --> O[Payment form iframe/modal]\r\n```\r\n\r\n### 2.2 Email/Admin Booking Flow (Direct Link)\r\n\r\nThis flow is initiated from a secure, single-use link typically sent via email. The booking is pre-created by an admin.\r\n\r\n```mermaid\r\n graph TD\r\n A[Admin generates pay token] --> A1[Call: POST /api/v1/s/booking/generate-token]\r\n A1 --> B[Email sent with booking link]\r\n B --> C[User clicks email link]\r\n C --> D[Call: GET /api/v1/s/booking/{token}]\r\n D --> E[Pre-filled booking page loads]\r\n E --> F[Same payment flow as website]\r\n F --> G[Turnstile → Nonce → Fingerprint → Payment]\r\n```\r\n\r\n## 3. Security Implementation & Token Sequence\r\n\r\nThe core of the system's security is the two-step, nonce-gated fingerprint generation process. This ensures that a valid, human-verified, and time-limited token is required before the server will generate the credentials needed to initialize a payment.\r\n\r\n### 3.1 End-to-End Security Sequence\r\n\r\n```mermaid\r\nsequenceDiagram\r\n participant F as Frontend (React App)\r\n participant S as Server (Backend API)\r\n participant T as Turnstile (Cloudflare)\r\n participant Z as ZenPay (Payment Gateway)\r\n Note over F: Step 0: Landing Page\r\n F->>S: GET /api/v1/tour/tour-list\r\n S-->>F: 200 OK { tours[], pagination }\r\n Note over F: Step 0→1: Tour Selection\r\n F->>S: GET /api/v1/tour/{id}\r\n Note over S: Sets SESSION + XSRF-TOKEN cookies\r\n S-->>F: 200 OK { tourDetails } + cookies\r\n Note over F: Step 1: Form Page\r\n F->>S: POST /api/v1/booking
{ tourId, customer: {...} }\r\n S-->>F: 200 OK { bookingId, ... }\r\n Note over F: Step 2: Payment Page\r\n F->>T: Load Turnstile widget\r\n T-->>F: cfToken (CAPTCHA verification)\r\n F->>S: POST /api/v1/payment/create-nonce
{ bookingId, cfToken, email_verify: \"🍯\" }\r\n Note over S: Validate CSRF + Turnstile + Honeypot\r\n S-->>F: 200 OK { nonce, expiresIn: 60 }\r\n F->>S: POST /api/v1/payment/exchange-nonce
X-Payment-Nonce: {nonce}\r\n Note over S: Consume nonce, generate fingerprint\r\n S-->>F: 200 OK { fingerprint, paymentParams }\r\n F->>Z: ZenPay.init({ fingerprint, ...paymentParams })\r\n Z-->>F: Payment form (iframe/modal)\r\n```\r\n\r\n### 3.2 Server-Side Security Controls\r\n\r\n- **Database Interaction (Anti-Injection)**:\r\n\r\n 1. **Parameterized Queries**: To prevent SQL injection into the **Val Town SQLite database**, all database queries that include external input are executed using parameterized queries (also known as prepared statements). User-provided data is never directly formatted into SQL strings.\r\n\r\n- **/api/v1/payment/create-nonce Validations**:\r\n\r\n 1. **Session & CSRF Token**: Must match the user’s established session.\r\n 2. **Turnstile CAPTCHA**: Verifies human interaction via `cfToken`.\r\n 3. **Rate Limiting**: Max 3 requests per minute per IP.\r\n 4. **Honeypot Field**: The `email_verify` field must be present and contain the correct value (\"🍯\") to trap bots.\r\n 5. **Logging**: Records IP, user agent, and timestamp for auditing.\r\n\r\n- **/api/v1/payment/exchange-nonce Validations**:\r\n 1. **Nonce Check**: Verifies the nonce from the `X-Payment-Nonce` header is valid, unused, and unexpired (60s TTL). The server also ensures it was created by the same user session (by matching the `SESSION` cookie ID) and optionally the same IP address.\r\n 2. **Header Validation**: Checks `Origin`, `Referer`, and `X-Requested-With` headers for legitimacy.\r\n 3. **Audit Logging**: Records nonce consumption and associated details.\r\n\r\n### 3.3 Security Control Matrix\r\n\r\nThis matrix provides a detailed overview of the security controls applied to each API endpoint.\r\n\r\n| **Endpoint** | **Security Controls Applied** |\r\n| :-------------------------------------- | :------------------------------------------------------------------------------------------------------------------- |\r\n| `GET /api/v1/tour/tour-list` | Public access; optional rate limiting to mitigate scraping. |\r\n| `GET /api/v1/tour/{id}` | Session cookie seeding (SESSION + XSRF-TOKEN); CSRF protection setup. |\r\n| `POST /api/v1/booking` | Session validation; CSRF protection. |\r\n| `POST /api/v1/payment/create-nonce` | CSRF protection; session validation; CAPTCHA/Turnstile; honeypot detection; rate limiting (3 req/min/IP); logging. |\r\n| `POST /api/v1/payment/exchange-nonce` | Nonce validation (single-use, TTL); header checks (Origin, Referer, X-Requested-With); rate limiting; audit logging. |\r\n| `POST /api/v1/payment/callback` | ValidationCode verification (SHA3-512 hash); payload authentication. |\r\n| `GET /api/v1/s/booking/{token}` | Token validation (single-use, TTL); IP tracking; session establishment. |\r\n| `POST /api/v1/s/booking/generate-token` | API key authentication (Bearer token); booking validation. |\r\n\r\n## 4. Canonical API Endpoints & Data Contracts\r\n\r\nThe following table defines the official, implemented API endpoints that the frontend application consumes, aligned with the `openapi.json` specification.\r\n\r\n| **Endpoint** | **Method** | **Security Controls** | **Used By** | **Handler File** | **Purpose & Notes** |\r\n| :--------------------------------- | :--------- | :--------------------------------------------------------- | :---------- | :---------------- | :----------------------------------------------------------------------------------------- |\r\n| `/api/v1/tour/tour-list` | GET | Public access, optional rate limiting. | Frontend | `tourHandler.ts` | **Step 0:** Fetches the initial list of tours for the landing page. |\r\n| `/api/v1/tour/{id}` | GET | Sets `SESSION` + `XSRF-TOKEN` cookies, HSTS, CSP. | Frontend | `tourHandler.ts` | **Step 0→1:** Gets details for a selected tour and seeds the session for CSRF protection. |\r\n| `/api/v1/booking` | POST | Session, CSRF. | Frontend | `adminHandler.ts` | **Step 1→2:** Creates a booking record with traveler details before proceeding to payment. |\r\n| `/api/v1/payment/create-nonce` | POST | CSRF, Session, Turnstile, Honeypot, Rate limit (3/min/IP). | Frontend | `adminHandler.ts` | **Step 2a:** Generates a single-use payment nonce after human verification. |\r\n| `/api/v1/payment/exchange-nonce` | POST | CSRF, Nonce validation (single-use, TTL), Header checks. | Frontend | `adminHandler.ts` | **Step 2b:** Exchanges a valid nonce for a ZenPay payment `fingerprint`. |\r\n| `/api/v1/payment/callback` | POST | ValidationCode verification (SHA3-512). | Backend | `adminHandler.ts` | **Post-Payment:** Webhook handler for receiving payment status updates from ZenPay. |\r\n| `/api/v1/s/booking/{token}` | GET | Token validation (single-use, TTL). | Frontend | `adminHandler.ts` | **Email Flow:** Handles the initial click from a shareable booking link. |\r\n| `/api/v1/s/booking/generate-token` | POST | API key authentication (Bearer token). | Admin | `adminHandler.ts` | **Admin Flow:** Generates a secure, shareable booking link. |\r\n\r\n### 4.1 Data Flow Examples\r\n\r\n#### Nonce Request\r\n\r\n_Request from Frontend to Server:_\r\n\r\n```json\r\nPOST /api/v1/payment/create-nonce HTTP/1.1\r\nContent-Type: application/json\r\nCookie: SESSION=abc123; XSRF-TOKEN=xyz456\r\nX-XSRF-TOKEN: xyz456\r\n\r\n{\r\n \"bookingId\": \"b1234567\",\r\n \"cfToken\": \"turnstile-token-here\",\r\n \"email_verify\": \"🍯\"\r\n}\r\n```\r\n\r\n_Response from Server to Frontend:_\r\n\r\n```json\r\n{\r\n \"nonce\": \"e7b8f3a14c5d6789abcdef1234567890abcdef1234567890abcdef1234567890\",\r\n \"expiresIn\": 60\r\n}\r\n```\r\n\r\n#### Fingerprint Exchange Request\r\n\r\n_Request from Frontend to Server:_\r\n\r\n```json\r\nPOST /api/v1/payment/exchange-nonce HTTP/1.1\r\nContent-Type: application/json\r\nCookie: SESSION=abc123; XSRF-TOKEN=xyz456\r\nX-Payment-Nonce: e7b8f3a14c5d6789abcdef1234567890abcdef1234567890abcdef1234567890\r\n\r\n{\r\n \"bookingId\": \"b1234567\"\r\n}\r\n```\r\n\r\n_Response from Server to Frontend:_\r\n\r\n```json\r\n{\r\n \"fingerprint\": \"4fa501b4c7e123def456789abcdef1234567890abcdef1234567890abcdef1234\",\r\n \"paymentParams\": {\r\n \"url\": \"https://pay.travelpay.com.au/online/v5\",\r\n \"merchantCode\": \"MERCHANT123\",\r\n \"apiKey\": \"r1-ghKhwM0u8_at8ePhKtA\",\r\n \"redirectUrl\": \"https://myapp.com/payment/return\",\r\n \"customerName\": \"John Smith\",\r\n \"paymentAmount\": 25900,\r\n \"timestamp\": \"2025-01-18T14:31:55Z\"\r\n }\r\n}\r\n```\r\n\r\n## 5. Client-Side Architecture (React SPA)\r\n\r\nThe frontend is a React 18.2.0 SPA written in TypeScript with Tailwind CSS for styling.\r\n\r\n### 5.1 File Architecture\r\n\r\n| **File** | **Lines** | **Purpose** |\r\n| :----------------- | :-------- | :--------------------------------------------------------------------- |\r\n| `checkout-flow.ts` | 2,030 | **Main application logic** - 3-step wizard component. |\r\n| `api-client.ts` | 326 | API communication layer with error handling and data normalization. |\r\n| `app-core.ts` | 377 | React foundation, shared UI components, and core utilities. |\r\n| `utils.ts` | 290 | Helper functions for storage, validation, cookies, keyboard shortcuts. |\r\n| `config.ts` | 64 | Application configuration, endpoints, and environment variables. |\r\n| `app.tsx` | 25 | React entry point and component mounting. |\r\n| `index.ts` | 25 | Hono static file server for serving the `index.html` and assets. |\r\n| `types.ts` | 136 | Centralized TypeScript type definitions. |\r\n\r\n### 5.2 `CheckoutFlow` Component\r\n\r\nThis is the monolithic component that manages the entire user journey.\r\n\r\n- **State Management**: Uses over 15 `useState` hooks to manage the current step, tour data, form inputs, tokens, and processing states.\r\n- **Step Components**:\r\n - **Step 0 (`TourCard`)**: Renders tour cards with animations and handles tour selection.\r\n - **Step 1 (`TravelerFormStep`)**: Manages the traveler information form, including validation and the auto-fill system.\r\n - **Step 2 (`PaymentReviewStep`)**: Integrates the Turnstile widget and orchestrates the nonce/fingerprint flow before initializing ZenPay.\r\n\r\n### 5.3 Key Client-Side Features\r\n\r\n- **Auto-Fill System**: A demo-purposed feature that uses a predefined list of 24 names from Blizzard games to populate form fields, facilitating rapid testing.\r\n- **CSRF Protection**: The `getXSRFToken` utility reads the `XSRF-TOKEN` cookie and the `getDefaultHeaders` function automatically attaches it as an `X-XSRF-TOKEN` header to all state-changing API requests.\r\n- **Storage Management**: Uses Base64 encoded `sessionStorage` for transient data and `localStorage` for image caching (5-min TTL). A `CTRL+SHIFT+ALT+C` keyboard shortcut exists to clear all storage for debugging.\r\n- **Lazy Script Loading**: Third-party payment scripts (jQuery, Bootstrap, ZenPay) are loaded dynamically and only when the user reaches Step 2 of the checkout, optimizing initial page load.\r\n- **Error Handling**: The `api-client.ts` contains a comprehensive `handleApiError` function to gracefully manage non-200 responses from the API, preventing crashes and providing fallback data where appropriate.\r\n\r\n## 6. Performance & Deployment\r\n\r\n- **Performance**: Key optimizations include lazy script loading, image caching, staggered animations for UI elements, and robust error boundaries in React components.\r\n- **Deployment**: The application is deployed as a set of static files (`index.html`, JS/CSS bundles) served by a lightweight Hono server. The server's only role is to serve the frontend application; it does not perform any server-side rendering or API logic.\r\n\r\n# Frontend\r\n\r\n## File Architecture\r\n\r\n### **Core Application Files**\r\n\r\n| File | Lines | Purpose |\r\n| ------------------ | ----- | ---------------------------------------------------- |\r\n| `checkout-flow.ts` | 2,030 | **Main application logic** - 3-step wizard component |\r\n| `api-client.ts` | 326 | API communication layer with error handling |\r\n| `app-core.ts` | 377 | React foundation, UI components, utilities |\r\n| `utils.ts` | 290 | Storage, validation, cookies, keyboard shortcuts |\r\n| `config.ts` | 64 | Application configuration and endpoints |\r\n| `app.tsx` | 25 | React entry point and mounting |\r\n| `index.ts` | 25 | Hono static file server |\r\n| `types.ts` | 136 | TypeScript type definitions |\r\n\r\n### **CheckoutFlow Component Structure**\r\n\r\n**State Management** (in `checkout-flow.ts`):\r\n\r\n```typescript\r\nconst [step, setStep] = useState(0); // 0=tours, 1=form, 2=payment\r\nconst [tours, setTours] = useState([]);\r\nconst [selectedTour, setSelectedTour] = useState(null);\r\nconst [formData, setFormData] = useState({...});\r\nconst [turnstileToken, setTurnstileToken] = useState(null);\r\nconst [isProcessing, setIsProcessing] = useState(false);\r\n// ... 15+ state variables for complete flow management\r\n```\r\n\r\n**Step Components**:\r\n\r\n- **Step 0**: `TourCard` components with animation, hover effects\r\n- **Step 1**: `TravelerFormStep` with auto-fill system and validation\r\n- **Step 2**: `PaymentReviewStep` with Turnstile integration and ZenPay\r\n\r\n---\r\n\r\n## Key Features Implementation\r\n\r\n### **Auto-Fill System**\r\n\r\n```typescript\r\n// In checkout-flow.ts\r\nfunction generateSmartFormDefaults() {\r\n const fullName = generateRandomName();\r\n const [firstName, lastName] = fullName.split(\" \");\r\n return {\r\n firstName,\r\n lastName,\r\n email: `${firstName.toLowerCase()}@zenpay.com.au`,\r\n phone: \"0400000000\",\r\n emergencyContact: generateRandomName(),\r\n emergencyPhone: \"0400000000\",\r\n };\r\n}\r\n```\r\n\r\n**Character Names**: 24 character names from Blizzard games for demo auto-fill\r\n\r\n### **Security Features**\r\n\r\n**CSRF Protection** (in `utils.ts`):\r\n\r\n```typescript\r\nexport function getXSRFToken(): string | null {\r\n return getCookie(\"XSRF-TOKEN\");\r\n}\r\n\r\nexport function getDefaultHeaders(): Record {\r\n const headers = { \"Content-Type\": \"application/json\" };\r\n const xsrfToken = getXSRFToken();\r\n if (xsrfToken) headers[\"X-XSRF-TOKEN\"] = xsrfToken;\r\n return headers;\r\n}\r\n```\r\n\r\n**Honeypot Protection**:\r\n\r\n```typescript\r\n// email_verify field with emoji honeypot\r\nconst updatedData = { ...filledData, email_verify: \"🍯\" };\r\n```\r\n\r\n**Turnstile Integration**:\r\n\r\n```typescript\r\n// Cloudflare Turnstile widget in Step 2\r\nconst turnstileElement = document.querySelector(\".cf-turnstile\");\r\nwindow.turnstile.render(turnstileElement, {\r\n sitekey: config.turnstileSiteKey,\r\n callback: window.onTurnstileSuccess,\r\n});\r\n```\r\n\r\n### **Storage & Utilities**\r\n\r\n**Storage Management** (in `utils.ts`):\r\n\r\n- Base64 encoded sessionStorage\r\n- Image caching with TTL\r\n- **CTRL+SHIFT+ALT+C**: Clear all storage with modal notification\r\n\r\n**Script Loading** (in `checkout-flow.ts`):\r\n\r\n- Dynamic loading of payment scripts only in Step 2\r\n- jQuery, Bootstrap, ZenPay plugin loaded on-demand\r\n\r\n---\r\n\r\n## API Integration Patterns\r\n\r\n### **Error Handling**\r\n\r\n```typescript\r\n// Comprehensive error handling in api-client.ts\r\nexport async function getAllTours(): Promise<{ tours: TourData[]; pagination: any }> {\r\n try {\r\n const res = await fetch(url, { credentials: \"include\", mode: \"cors\" });\r\n if (!res.ok) throw await utils.handleApiError(res);\r\n // ... success handling\r\n } catch (err) {\r\n console.error(\"[api-client] Failed to load tours:\", err);\r\n return { tours: [], pagination: {...} }; // Graceful fallback\r\n }\r\n}\r\n```\r\n\r\n### **Data Normalization**\r\n\r\n```typescript\r\n// Handles API inconsistencies in tour data\r\nfunction normalizeApiTourData(tour: any): TourData {\r\n return {\r\n id: tour.tourId ?? tour.id,\r\n name: tour.name ?? tour.title,\r\n heroImageUrl: tour.heroImageUrl ?? tour.image_url,\r\n price: tour.price,\r\n currency: tour.currency ?? \"AUD\",\r\n // ... comprehensive field mapping\r\n };\r\n}\r\n```\r\n\r\n---\r\n\r\n## Configuration & Deployment\r\n\r\n### **Environment Configuration** (in `config.ts`)\r\n\r\n```typescript\r\nexport const config = {\r\n apiUrl: \"https://server.zenithpayments.support\",\r\n turnstileSiteKey: \"0x4AAAAAABjPDL4GDo6BXFza\",\r\n endpoints: {\r\n tours: \"/api/v1/tour/tour-list\",\r\n tourDetails: \"/api/v1/tour\",\r\n createNonce: \"/api/v1/payment/create-nonce\",\r\n exchangeNonce: \"/api/v1/payment/exchange-nonce\",\r\n },\r\n defaults: {\r\n currency: \"AUD\",\r\n nonceTimeout: 60000, // 60 seconds\r\n },\r\n};\r\n```\r\n\r\n### **Static File Serving** (in `index.ts`)\r\n\r\n```typescript\r\n// Hono server for static files only\r\nconst app = new Hono();\r\napp.get(\"/\", async (c) => {\r\n const html = await readFile(\"/index.html\", import.meta.url);\r\n return c.html(html);\r\n});\r\napp.get(\"/*\", (c) => serveFile(c.req.path, import.meta.url));\r\n```\r\n\r\n---\r\n\r\n## Performance Optimizations\r\n\r\n1. **Lazy Script Loading**: Payment scripts only loaded in Step 2\r\n2. **Image Caching**: 5-minute TTL with localStorage\r\n3. **Animation Staggering**: 0.1s delays for smooth card reveals\r\n4. **Error Boundaries**: Graceful fallbacks for API failures\r\n5. **Script Ordering**: Sequential loading to prevent race conditions\r\n\r\n---\r\n\r\n## Summary\r\n\r\n**Current Architecture**: Mature React SPA with comprehensive security, UX features, and error handling. The application successfully implements the nonce-gated payment flow with progressive security controls and excellent user experience features like auto-fill, animations, and graceful error handling.\r\n\r\n**Key Strengths**:\r\n\r\n- ✅ Comprehensive security implementation (CSRF, Turnstile, honeypots)\r\n- ✅ Excellent error handling with fallback mechanisms\r\n- ✅ Performance optimizations (lazy loading, caching)\r\n- ✅ Rich UX features (auto-fill, animations, keyboard shortcuts)\r\n- ✅ Type-safe implementation with comprehensive TypeScript coverage\r\n\r\n**Architecture Pattern**: The implementation follows a progressive enhancement model where security controls are applied at each step, scripts are loaded only when needed, and user experience is prioritized while maintaining robust security.\r\n",[],[935],{"_104":943,"_96":944,"_156":945,"_158":-5,"_159":141,"_160":946,"_162":22,"_106":947,"_100":376,"_164":225,"_166":948,"_167":22,"_168":-5,"_169":949,"_99":950},"4965e012-5e6d-11f0-a473-0224a6c84d84","deno.json","24befb56-5c0e-11f0-a976-0224a6c84d84",587,["D",1752248392426],"{\r\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\r\n \"lock\": false,\r\n \"exclude\": [\r\n \"frontend/\",\r\n \"frontend*\",\r\n \"tests/\",\r\n \"docs/\",\r\n \"scripts/\",\r\n \"tasks/\",\r\n \".client\",\r\n \"kill-port.ts\",\r\n \"*.md\",\r\n \"README.md\"\r\n ],\r\n \"compilerOptions\": {\r\n \"noImplicitAny\": false,\r\n \"strict\": false,\r\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\r\n \"lib\": [\r\n \"dom\",\r\n \"dom.iterable\",\r\n \"dom.asynciterable\",\r\n \"deno.ns\",\r\n \"deno.unstable\"\r\n ]\r\n },\r\n \"lint\": {\r\n \"files\": {\r\n \"include\": [\"deno:/https/esm.town/**/*\"]\r\n },\r\n \"rules\": {\r\n \"exclude\": [\"no-explicit-any\"]\r\n }\r\n },\r\n \"node_modules_dir\": false,\r\n \"experimental\": {\r\n \"unstable-node-globals\": true,\r\n \"unstable-temporal\": true,\r\n \"unstable-worker-options\": true,\r\n \"unstable-sloppy-imports\": true\r\n },\r\n \"imports\": {\r\n \"import_map.json\": \"./import_map.json\"\r\n }\r\n}\r\n",[],[944],{"_104":952,"_96":953,"_156":954,"_158":-5,"_159":141,"_160":955,"_162":118,"_106":956,"_100":271,"_164":225,"_166":957,"_167":22,"_168":-5,"_169":958,"_99":959},"49838b12-5e6d-11f0-abd7-0224a6c84d84","env.example","582b1fc6-5d42-11f0-979e-0224a6c84d84",589,["D",1752248392623],"# ZenServer Environment Variables\r\n# Copy this file to .env for local development\r\n# Run with: deno run -A --env-file=.env main.ts\r\n\r\n# =================================\r\n# SERVER CONFIGURATION\r\n# =================================\r\nPORT=5000\r\nAPP_ENV=dev\r\nLOG_LEVEL=debug\r\n\r\n# =================================\r\n# DEBUG CONFIGURATION\r\n# =================================\r\nDEBUG_LOG_LEVEL=DEBUG\r\nDEBUG_ENABLE_COLORS=true\r\nDEBUG_ENABLE_REQUEST_CAPTURE=true\r\nDEBUG_ENABLE_RESPONSE_CAPTURE=true\r\nDEBUG_ENABLE_SECURITY_CHECKS=true\r\nDEBUG_RESPONSE_BODY_SIZE_LIMIT=10240\r\n\r\n# =================================\r\n# SECURITY SECRETS (Required in Production)\r\n# Leave empty for local development - will use safe defaults\r\n# =================================\r\nZP_USERNAME=\r\nZP_PASSWORD=\r\nSESSION_SECRET=\r\nWEBHOOK_SECRET=\r\nMASTER_KEY=\r\nTURNSTILE_SECRET_KEY=\r\nVALTOWN_TOKEN=\r\n\r\n# =================================\r\n# CORS & ORIGINS\r\n# =================================\r\nALLOWED_ORIGINS=http://localhost:3000,http://localhost:5000,https://client.zenithpayments.support\r\nALLOWED_HEADERS=Content-Type,X-Payment-Nonce,Authorization,X-API-Key,X-XSRF-TOKEN\r\n\r\n# =================================\r\n# IP RESTRICTIONS & ADMIN ACCESS\r\n# =================================\r\nADMIN_IPS=127.0.0.1,::1\r\nALLOW_LOOPBACK_IPS=true\r\nALLOW_PRIVATE_IPS=true\r\nIP_HEADER_KEYS=cf-connecting-ip,x-real-ip,x-forwarded-for,true-client-ip,x-client-ip,x-original-forwarded-for\r\n\r\n# =================================\r\n# SECURITY MIDDLEWARE SETTINGS\r\n# =================================\r\nREQUEST_SIZE_LIMIT=1048576\r\nSECURITY_SUSPICIOUS_USER_AGENTS=bot,crawler,spider,scraper,hack,exploit\r\nSECURITY_SENSITIVE_ENDPOINTS=/api/v1/payment/create-nonce,/api/v1/payment/exchange-nonce\r\n\r\n# =================================\r\n# COOKIE SECURITY CONFIGURATION\r\n# =================================\r\n# Cookie TTL settings (in seconds)\r\nCOOKIE_DEFAULT_MAX_AGE=1800\r\nCOOKIE_SESSION_MAX_AGE=86400\r\nCOOKIE_CSRF_MAX_AGE=1800\r\nCOOKIE_TEMP_MAX_AGE=300\r\n\r\n# Cookie security settings\r\nCOOKIE_DEFAULT_PATH=/\r\nCOOKIE_DEFAULT_DOMAIN=\r\nCOOKIE_SAME_SITE=Lax\r\nCOOKIE_SESSION_NAME=SESSION\r\nCOOKIE_CSRF_TOKEN_NAME=XSRF-TOKEN\r\nCOOKIE_FORCE_SECURE=false\r\n\r\n# =================================\r\n# RATE LIMITING\r\n# =================================\r\nRATE_LIMIT_CREATE_NONCE_REQUESTS=5\r\nRATE_LIMIT_CREATE_NONCE_WINDOW_MS=60000\r\nRATE_LIMIT_EXCHANGE_NONCE_REQUESTS=10\r\nRATE_LIMIT_EXCHANGE_NONCE_WINDOW_MS=60000\r\nRATE_LIMIT_PAYMENT_REFRESH_REQUESTS=10\r\nRATE_LIMIT_PAYMENT_REFRESH_WINDOW_MS=60000\r\nRATE_LIMIT_TURNSTILE_VERIFY_REQUESTS=20\r\nRATE_LIMIT_TURNSTILE_VERIFY_WINDOW_MS=60000\r\nRATE_LIMIT_CLEANUP_PROBABILITY=0.01\r\nRATE_LIMIT_CLEANUP_CUTOFF_AGE_MS=3600000\r\n\r\n# =================================\r\n# EXTERNAL SERVICES\r\n# =================================\r\nBASE_URL=http://localhost:5000\r\nIMAGES_BASE_URL=http://localhost:5000/images\r\n\r\n# =================================\r\n# OPENAPI CONFIGURATION\r\n# =================================\r\nOPENAPI_LOCAL_PATH=./openapi.json\r\nOPENAPI_BLOB_KEY=openapi-spec\r\nOPENAPI_PUBLIC_URL=http://localhost:5000/openapi.json",[],[953],{"_104":961,"_96":962,"_156":116,"_158":-5,"_159":141,"_160":963,"_162":118,"_106":964,"_100":965,"_164":966,"_166":967,"_167":22,"_168":-5,"_169":968,"_99":969},"58318de8-5d42-11f0-8c84-0224a6c84d84","main.ts",515,["D",1752119997689],14,"http","// Step 1: Import environment config (handles .env loading and validation automatically)\nimport {\n environment,\n validateProductionSecrets,\n} from \"./src/config/environment.ts\";\n\n// Step 2: In production, validate all required secrets are present\nif (environment.APP_ENV === \"prod\") {\n validateProductionSecrets();\n}\n\n// Step 3: Initialize debugger (uses direct console.log, no dependencies)\nimport { initializeDebugger } from \"./src/middleware/debugger.ts\";\ninitializeDebugger();\n\n// Step 4: Initialize logging system\nimport { initializeLogging, logInfo } from \"./src/utils/logger.ts\";\nawait initializeLogging();\n\n// Step 5: Import the app after everything is initialized\nimport app from \"./src/gateway/apiGateway.ts\";\n\n// Step 6: Start the server\nDeno.serve({ port: environment.PORT }, app);\nlogInfo(`Server listening on port ${environment.PORT}`, \"startup\", {\n port: environment.PORT,\n});\n\n// For Val Town compatibility\nexport default app;\n",[],[962],{"_104":971,"_96":972,"_156":973,"_158":-5,"_159":141,"_160":974,"_162":22,"_106":975,"_100":32,"_164":225,"_166":976,"_167":22,"_168":-5,"_169":977,"_99":978},"822d2f10-5f4c-11f0-a1fe-0224a6c84d84","map.md","822d2fe2-5f4c-11f0-a1fe-0224a6c84d84",629,["D",1752344265453],"# ZenServer Project Map\r\n\r\nThis document provides a concise and complete map of all files, classes, and functions within the ZenServer project.\r\n\r\n## 📂 Root Directory\r\n\r\n### 📄 `main.ts`\r\nThe main entry point for the application. It initializes the environment, database, and logging, and starts the API gateway.\r\n\r\n### 📄 `openapi.json`\r\nThe OpenAPI 3.0 specification that defines the entire API contract, including all endpoints, request/response schemas, and security requirements. It is the single source of truth for the API structure.\r\n\r\n---\r\n\r\n## 📂 `src/config`\r\n\r\n### 📄 `environment.ts`\r\nLoads and consolidates all application configuration from environment variables and the `securityConfig.ts` file.\r\n- **`environment`**: A single, exported object containing all configuration variables for the application.\r\n- **`validateProductionSecrets()`**: Re-exported from `securityConfig` to be called at startup.\r\n\r\n### 📄 `securityConfig.ts`\r\nDefines and loads all security-sensitive configuration from environment variables.\r\n- **`ADMIN_IPS`**: A list of trusted IP addresses for admin access.\r\n- **`ALLOWED_ORIGINS`**: A list of domains allowed for CORS.\r\n- **`ALLOWED_HEADERS`**: A list of HTTP headers allowed for CORS.\r\n- **`COOKIE_*`**: A comprehensive set of constants for configuring secure cookie behavior (e.g., `COOKIE_SESSION_MAX_AGE`, `COOKIE_SAME_SITE`).\r\n- **`RATE_LIMIT_*`**: Per-endpoint rate limiting settings (requests per window).\r\n- **`ZP_USERNAME`, `ZP_PASSWORD`, `TURNSTILE_SECRET_KEY`, etc.**: Variables holding all application secrets.\r\n- **`validateProductionSecrets()`**: A crucial function that throws an error if required secrets are missing in a production environment.\r\n\r\n---\r\n\r\n## 📂 `src/data`\r\n\r\n### 📄 `tours.ts`\r\nActs as a static, in-memory database for the application's tour data.\r\n- **`Tour` (interface)**: Defines the detailed data structure for a single tour.\r\n- **`TOURS` (constant)**: An array of `Tour` objects containing rich, realistic data for several tours.\r\n\r\n---\r\n\r\n## 📂 `src/database`\r\n\r\n### 📄 `database.ts`\r\nThe primary database service layer (repository pattern) that abstracts all interaction with the Val Town SQLite database.\r\n- **`Database` (class)**:\r\n - `initialize()`: Creates all tables from the schema files and inserts sample data.\r\n - `query()`: Executes a `SELECT` query and returns an array of objects.\r\n - `execute()`: Runs `INSERT`, `UPDATE`, or `DELETE` statements.\r\n - `storeNonce()`, `getNonce()`, `validateAndUseNonce()`: A suite of methods for securely managing the lifecycle of payment nonces.\r\n - `getFingerprintStatus()`: Checks payment attempt counts for a booking.\r\n\r\n### 📄 `schema.ts`\r\nAggregates all schema definition files into a single export.\r\n- **`SCHEMA_SQL`**: A template string combining all `CREATE TABLE` statements from the other schema files.\r\n- **`SAMPLE_BOOKINGS_SQL`**: `INSERT` statements to seed the database with sample tour booking data for development.\r\n\r\n### 📄 `appTPCoreSchema.ts`\r\nContains the SQL schema for the application's core business logic.\r\n- **`APP_TP_CORE_SCHEMA`**: A template string with `CREATE TABLE` statements for `app_payment_nonces`, `app_tp_booking_orders`, and `app_pay_tokens`.\r\n\r\n### 📄 `sysHookBacksSchema.ts`\r\nContains the SQL schema for managing and logging webhooks.\r\n- **`SYS_WEBHOOKS_SCHEMA`**: A template string with `CREATE TABLE` statements for `sys_webhooks` (configuration) and `sys_webhook_logs` (audit trail).\r\n\r\n### 📄 `sysInfraSchema.ts`\r\nContains the SQL schema for system-level security and infrastructure monitoring.\r\n- **`SYS_INFRA_SCHEMA`**: A template string with `CREATE TABLE` statements for `sys_rate_limits`, `sys_security_events`, `sys_blocked_ips`, and `sys_whitelisted_ips`.\r\n\r\n---\r\n\r\n## 📂 `src/gateway`\r\n\r\n### 📄 `apiGateway.ts`\r\nThe main Hono application file. It sets up the middleware pipeline and orchestrates dynamic route registration.\r\n- **`app`**: The `OpenAPIHono` application instance.\r\n- **Middleware Pipeline**: A series of `app.use()` calls that register middleware in a specific order for logging, security (CORS, CSRF, Rate Limiting), and database context attachment.\r\n- **Dynamic Route Loading**: Contains the logic to use `createOpenAPILoader` to parse the `openapi.json` spec, automatically create a handler map with `createDynamicHandlerMap`, and register all routes.\r\n- **Fallback Handler**: Registers a fallback route to handle critical server startup errors (e.g., if `openapi.json` cannot be loaded).\r\n\r\n---\r\n\r\n## 📂 `src/handlers`\r\n\r\n### 📄 `adminHandler.ts`\r\nA complete implementation of the admin, payment, and booking logic. (Note: This is a duplicate of older logic).\r\n- **`createNonce()`**: Generates and stores a payment nonce.\r\n- **`exchangeNonce()`**: Validates a nonce and returns a payment fingerprint.\r\n- **`handlePaymentCallback()`**: Processes a webhook from the payment gateway.\r\n- **`createBooking()`**: Creates a new booking record.\r\n- **`getBookingDetails()`**: Retrieves booking information.\r\n- **`generatePayToken()`**: Creates a one-time payment link token.\r\n\r\n### 📄 `businessLogic.ts`\r\nThe target for the dynamic handler system. It maps `operationId`s from the OpenAPI spec to functions.\r\n- **`listTours()`, `getTourDetails()`, `createNonce()`, etc.**: Implementations for the API's business logic. Many functions in the current version are placeholders that throw a \"not yet implemented\" error.\r\n\r\n### 📄 `docsHandler.ts`\r\nA class-based handler responsible for serving all user-facing API documentation.\r\n- **`DocsHandler` (class)**:\r\n - `serveSwaggerDocs()`: Serves a modern Swagger UI.\r\n - `serveRedocDocs()`: Serves a three-panel ReDoc documentation page.\r\n - `serveFiberplanePlayground()`: Serves a custom, interactive API playground.\r\n\r\n### 📄 `dynamicHandler.ts`\r\nThe core of the dynamic routing system.\r\n- **`extractOperationIds()`**: Scans the OpenAPI spec and returns a list of all `operationId`s.\r\n- **`createDynamicHandlerMap()`**: Creates a map where each `operationId` is a key and its value is a generic handler function that delegates to the corresponding function in `businessLogic.ts`.\r\n\r\n### 📄 `errorHandler.ts`\r\nProvides the global error handling middleware for the application.\r\n- **`globalErrorHandler()`**: A function that catches all unhandled errors, logs them, and returns a standardized `500` JSON response.\r\n\r\n### 📄 `fallbackHandler.ts`\r\nProvides a \"safe mode\" for the server if it fails to start correctly.\r\n- **`registerFallbackHandler()`**: Registers a catch-all route that is activated if the OpenAPI spec fails to load. It serves a helpful HTML error page explaining the problem.\r\n\r\n### 📄 `tourHandler.ts`\r\nImplements the logic for tour-related API endpoints.\r\n- **`getTourDetails()`**: Fetches and returns data for a specific tour.\r\n- **`listTours()`**: Fetches and returns a list of all available tours, with support for pagination.\r\n\r\n### 📄 `turnstileHandler.ts`\r\nHandles all interactions with Cloudflare Turnstile for bot protection.\r\n- **`TurnstileHandler` (class)**:\r\n - `serveTurnstileTestPage()`: Serves a self-contained HTML page for testing the Turnstile integration.\r\n - `verifyTurnstile()`: The backend endpoint that takes a Turnstile token from a client and verifies it with Cloudflare's API.\r\n\r\n### 📄 `webhookHandler.ts`\r\nProvides handlers for receiving incoming webhooks and callbacks.\r\n- **`WebhookHandler` (class)**:\r\n - `handleWebhook()`: A generic endpoint for receiving webhooks, validating them, and logging them to the database and blob storage for auditing.\r\n - `handleCallback()`: A generic endpoint for handling callbacks from services like OAuth or payment gateways, with CSRF protection.\r\n\r\n---\r\n\r\n## 📂 `src/middleware`\r\n\r\n### 📄 `basicAuth.ts`\r\n- **`createBasicAuthMiddleware()`**: Creates Hono middleware for HTTP Basic Authentication using credentials from the environment.\r\n\r\n### 📄 `bearerAuth.ts`\r\n- **`createBearerAuthMiddleware()`**: Creates Hono middleware for Bearer Token authentication using a static API key from the environment.\r\n\r\n### 📄 `cors.ts`\r\n- **`corsMiddleware()`**: Handles CORS preflight (`OPTIONS`) requests and validates the `Origin` header on all incoming requests.\r\n\r\n### 📄 `csp.ts`\r\n- **`getCSPHeader()`**: Builds the `Content-Security-Policy` header string based on the environment (dev vs. prod).\r\n- **`cspMiddleware()`**: A Hono middleware that applies the CSP header to responses.\r\n\r\n### 📄 `csrf.ts`\r\n- **`getOriginBasedCSRFMiddleware()`**: The main export, which provides origin-based CSRF protection using Hono's built-in library.\r\n- **`createTokenBasedCSRFSession()`, `validateTokenBasedCSRFToken()`**: Functions for managing token-based CSRF protection (double-submit cookies) for more sensitive actions.\r\n\r\n### 📄 `debugger.ts`\r\n- **`createDebugMiddleware()`**: A Hono middleware that captures detailed information about requests and responses for debugging purposes in a development environment.\r\n- **`initializeDebugSession()`, `finalizeDebugSession()`**: Functions to trace a logical flow across multiple requests.\r\n- **`logSecurityCheck()`**: A helper to log the success or failure of individual security checks within a request's lifecycle.\r\n\r\n### 📄 `ipRestriction.ts`\r\n- **`ipRestrictionMiddleware()`**: A Hono middleware that provides IP-based access control, checking requests against configurable allow/deny lists.\r\n- **`adminIPRestrictionMiddleware()`**: A pre-configured version that restricts access to the admin IPs defined in the environment.\r\n\r\n### 📄 `rateLimit.ts`\r\n- **`rateLimitMiddleware()`**: A middleware that provides per-endpoint rate limiting based on the client's IP address, using an in-memory cache.\r\n\r\n### 📄 `requestLogger.ts`\r\n- **`requestIdMiddleware`**: Assigns a unique `X-Request-Id` to every incoming request.\r\n- **`requestLoggerMiddleware`**: Logs the details of every request and its corresponding response, including the request ID, status, and duration.\r\n\r\n### 📄 `secureHeaders.ts`\r\n- **`createSecureHeadersMiddleware()`**: A Hono middleware that applies a suite of important security-related HTTP headers (like HSTS, X-Frame-Options, etc.) to every response.\r\n\r\n### 📄 `security.ts`\r\n- **`securityMiddleware()`**: A middleware that performs a series of basic, heuristic security checks on every request, such as scanning for suspicious User-Agent strings and validating the request body size.\r\n\r\n---\r\n\r\n## 📂 `src/services`\r\n\r\n### 📄 `authService.ts`\r\n- **`AuthService` (class)**: Provides static methods for handling various authentication and authorization tasks, such as validating API keys and different types of tokens.\r\n\r\n### 📄 `publicPayNonceService.ts`\r\n- **`PublicPayNonceService` (class)**: A service dedicated to managing the lifecycle of public payment nonces, including creation, validation, and status checking.\r\n\r\n### 📄 `turnstileService.ts`\r\n- **`TurnstileService` (class)**: A service that abstracts the interaction with the Cloudflare Turnstile API for verifying tokens.\r\n\r\n### 📄 `validationService.ts`\r\n- **`ValidationService` (class)**: A central place for complex, reusable validation logic, such as validating the format of a Turnstile token.\r\n\r\n### 📄 `zenpayFingerprintService.ts`\r\n- **`PaymentFingerprintService` (class)**: A service responsible for generating the unique payment \"fingerprint\" required by the Zenpay payment gateway.\r\n\r\n---\r\n\r\n## 📂 `src/types`\r\n\r\n### 📄 `index.ts`\r\nDefines and exports the core TypeScript types and interfaces used throughout the application, such as `AppContext`, `Booking`, and `PaymentNonce`.\r\n\r\n### 📄 `generated-types.ts`\r\nA placeholder file intended to hold types that are automatically generated from the OpenAPI specification in the future.\r\n\r\n---\r\n\r\n## 📂 `src/utils`\r\n\r\n### 📄 `cookies.ts`\r\n- **`setCookie()`, `getCookie()`**: Low-level utility functions for setting and parsing HTTP cookies.\r\n- **`setCSRFCookies()`, `validateTokenBasedCSRFToken()`**: Higher-level functions specifically for managing the double-submit CSRF cookies.\r\n\r\n### 📄 `crypto.ts`\r\n- **`generateNonce()`, `generateUUID()`, `generateSecureToken()`**: A suite of functions for generating various cryptographic tokens and identifiers.\r\n- **`hashString()`**: A function for securely hashing strings using SHA-512.\r\n\r\n### 📄 `dateUtils.ts`\r\n- **`getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS()`**: A utility function that returns the current date and time formatted for the Sydney timezone, used for consistent timestamps in logging.\r\n\r\n### 📄 `imageUtils.ts`\r\n- **`getImageUrl()`**: A function that constructs the full URL for an image based on the environment's base URL.\r\n- **`getTourImageUrls()`**: A helper that returns a set of image URLs for a specific tour, using a predefined map.\r\n\r\n### 📄 `ipUtils.ts`\r\n- **`getClientIP()`**: A crucial utility that reliably determines a client's real IP address by checking a prioritized list of headers.\r\n- **`isValidIP()`, `isPrivateIP()`, `isIPInCIDR()`**: A suite of functions for validating and classifying IP addresses.\r\n- **`performIPSecurityCheck()`**: A function that checks an IP against allow/deny lists.\r\n\r\n### 📄 `jwt.ts`\r\nA placeholder file containing commented-out code for future JWT (JSON Web Token) functionality.\r\n\r\n### 📄 `logger.ts`\r\nA comprehensive, structured logging system built on top of Deno's standard `log` module.\r\n- **`initializeLogging()`**: Sets up the logger with different handlers for development (console + files) and production (console only).\r\n- **`logDebug()`, `logInfo()`, `logWarn()`, `logError()`**: The core logging functions.\r\n- **`withCorrelationId()`**: A wrapper to ensure all logs within a specific context share the same unique ID.\r\n- **`measureAndLog()`**: A utility for logging the performance of a given function.\r\n\r\n### 📄 `openApiLoader.ts`\r\nThe core of the dynamic routing system.\r\n- **`OpenAPILoader` (class)**: Manages loading the spec, converting schemas, and registering routes.\r\n- **`createOpenAPILoader()`**: The main factory function that intelligently loads the spec from the local filesystem or Val Town blob storage based on the environment.\r\n- **`SchemaConverter` (class)**: Translates OpenAPI schemas to Zod schemas for validation.\r\n- **`RouteGenerator` (class)**: Creates Hono-compatible route configurations from the OpenAPI spec.\r\n\r\n### 📄 `proxy.ts`\r\nA placeholder file containing commented-out code for future reverse proxy functionality.\r\n",[],[972],"files",[153,172,180,188,196,204,212,219,229,239,248,257,267,274,281,291,301,308,319,326,335,344,353,362,372,379,386,396,407,413,420,429,438,447,456,466,476,485,495,504,513,522,532,542,552,558,567,576,586,595,604,613,622,632,641,650,660,668,674,683,692,701,710,719,728,738,745,754,763,773,779,788,797,806,815,824,833,843,852,863,871,880,889,898,906,915,924,933,942,951,960,970],"counts",{"_983":32,"_984":271,"_985":32,"_986":987},"pulls","branches","forks","envVars",{"_988":989,"_990":32},"count",22,"emptyCount","contents",[993,996,999,1002,1005,1008,1011,1014,1017,1020,1023,1026,1029,1032,1035,1038,1041,1044,1047,1050,1053],{"_104":154,"_96":155,"_156":157,"_158":-5,"_159":141,"_160":161,"_162":22,"_106":994,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":995},["D",1752140384391],[155],{"_104":173,"_96":174,"_156":175,"_158":-5,"_159":141,"_160":176,"_162":22,"_106":997,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":998},["D",1752140384657],[174],{"_104":181,"_96":182,"_156":183,"_158":-5,"_159":141,"_160":184,"_162":22,"_106":1000,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1001},["D",1751825018627],[182],{"_104":189,"_96":190,"_156":191,"_158":-5,"_159":141,"_160":192,"_162":22,"_106":1003,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1004},["D",1752140384979],[190],{"_104":197,"_96":198,"_156":199,"_158":-5,"_159":141,"_160":200,"_162":22,"_106":1006,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1007},["D",1752140385245],[198],{"_104":205,"_96":206,"_156":207,"_158":-5,"_159":141,"_160":208,"_162":118,"_106":1009,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1010},["D",1752140385636],[206],{"_104":213,"_96":214,"_156":215,"_158":-5,"_159":141,"_160":216,"_162":22,"_106":1012,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1013},["D",1752033266640],[214],{"_104":268,"_96":269,"_156":270,"_158":-5,"_159":141,"_160":271,"_162":118,"_106":1015,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1016},["D",1751614596799],[269],{"_104":864,"_96":865,"_156":866,"_158":-5,"_159":141,"_160":867,"_162":22,"_106":1018,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1019},["D",1752344264882],[865],{"_104":872,"_96":873,"_156":874,"_158":-5,"_159":141,"_160":875,"_162":22,"_106":1021,"_100":528,"_164":225,"_166":877,"_167":22,"_168":-5,"_99":1022},["D",1752344266165],[873],{"_104":881,"_96":882,"_156":883,"_158":-5,"_159":141,"_160":884,"_162":22,"_106":1024,"_100":528,"_164":225,"_166":886,"_167":22,"_168":-5,"_99":1025},["D",1752344266303],[882],{"_104":890,"_96":891,"_156":892,"_158":-5,"_159":141,"_160":893,"_162":22,"_106":1027,"_100":32,"_164":225,"_166":895,"_167":22,"_168":-5,"_99":1028},["D",1752344265409],[891],{"_104":899,"_96":900,"_156":901,"_158":-5,"_159":141,"_160":902,"_162":22,"_106":1030,"_100":32,"_164":225,"_166":895,"_167":22,"_168":-5,"_99":1031},["D",1752018477318],[900],{"_104":907,"_96":908,"_156":909,"_158":-5,"_159":141,"_160":910,"_162":22,"_106":1033,"_100":32,"_164":225,"_166":912,"_167":22,"_168":-5,"_99":1034},["D",1752344265463],[908],{"_104":916,"_96":917,"_156":918,"_158":-5,"_159":141,"_160":919,"_162":22,"_106":1036,"_100":32,"_164":225,"_166":921,"_167":22,"_168":-5,"_99":1037},["D",1752344265673],[917],{"_104":925,"_96":926,"_156":927,"_158":-5,"_159":141,"_160":928,"_162":22,"_106":1039,"_100":32,"_164":225,"_166":930,"_167":22,"_168":-5,"_99":1040},["D",1752142020533],[926],{"_104":934,"_96":935,"_156":936,"_158":-5,"_159":141,"_160":937,"_162":22,"_106":1042,"_100":32,"_164":225,"_166":939,"_167":22,"_168":-5,"_99":1043},["D",1752248392398],[935],{"_104":943,"_96":944,"_156":945,"_158":-5,"_159":141,"_160":946,"_162":22,"_106":1045,"_100":376,"_164":225,"_166":948,"_167":22,"_168":-5,"_99":1046},["D",1752248392426],[944],{"_104":952,"_96":953,"_156":954,"_158":-5,"_159":141,"_160":955,"_162":118,"_106":1048,"_100":271,"_164":225,"_166":957,"_167":22,"_168":-5,"_99":1049},["D",1752248392623],[953],{"_104":961,"_96":962,"_156":116,"_158":-5,"_159":141,"_160":963,"_162":118,"_106":1051,"_100":965,"_164":966,"_166":967,"_167":22,"_168":-5,"_99":1052},["D",1752119997689],[962],{"_104":971,"_96":972,"_156":973,"_158":-5,"_159":141,"_160":974,"_162":22,"_106":1054,"_100":32,"_164":225,"_166":976,"_167":22,"_168":-5,"_99":1055},["D",1752344265453],[972],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.version.$version.code.$",{"_94":95,"_96":97,"_98":44,"_100":101,"_99":73,"_102":1064,"_151":1069,"_979":1346,"_225":-7,"_991":1347,"_1390":-5,"_1391":-5,"_1392":-5,"_1393":-5,"_1394":1395,"_986":-5},{"_104":105,"_96":97,"_106":1065,"_108":-5,"_109":22,"_110":111,"_112":73,"_113":-5,"_14":114,"_115":116,"_117":118,"_119":118,"_120":-5,"_121":32,"_16":122,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_23":1066,"_135":1067,"_138":1068,"_150":22},["D",1751614495896],{"_94":95,"_133":134},{"_94":95,"_137":134,"_14":114},{"_100":140,"_96":44,"_104":141,"_142":105,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":97,"_149":95},[1070,1073,1076,1079,1082,1085,1088,1106,1307,1310,1313,1316,1319,1322,1325,1328,1331,1334,1337,1340,1343],{"_104":154,"_96":155,"_156":157,"_158":-5,"_159":141,"_160":161,"_162":22,"_106":163,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1071,"_99":1072},[],[155],{"_104":173,"_96":174,"_156":175,"_158":-5,"_159":141,"_160":176,"_162":22,"_106":177,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1074,"_99":1075},[],[174],{"_104":181,"_96":182,"_156":183,"_158":-5,"_159":141,"_160":184,"_162":22,"_106":185,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1077,"_99":1078},[],[182],{"_104":189,"_96":190,"_156":191,"_158":-5,"_159":141,"_160":192,"_162":22,"_106":193,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1080,"_99":1081},[],[190],{"_104":197,"_96":198,"_156":199,"_158":-5,"_159":141,"_160":200,"_162":22,"_106":201,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1083,"_99":1084},[],[198],{"_104":205,"_96":206,"_156":207,"_158":-5,"_159":141,"_160":208,"_162":118,"_106":209,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1086,"_99":1087},[],[206],{"_104":213,"_96":214,"_156":215,"_158":-5,"_159":141,"_160":216,"_162":22,"_106":217,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1089,"_99":1105},[1090,1093,1096,1099,1102],{"_104":220,"_96":221,"_156":222,"_158":215,"_159":141,"_160":223,"_162":22,"_106":224,"_100":32,"_164":225,"_166":226,"_167":22,"_168":-5,"_169":1091,"_99":1092},[],[214,221],{"_104":230,"_96":231,"_156":232,"_158":215,"_159":141,"_160":233,"_162":22,"_106":234,"_100":32,"_164":235,"_166":236,"_167":22,"_168":-5,"_169":1094,"_99":1095},[],[214,231],{"_104":240,"_96":241,"_156":242,"_158":215,"_159":141,"_160":243,"_162":22,"_106":244,"_100":32,"_164":225,"_166":245,"_167":22,"_168":-5,"_169":1097,"_99":1098},[],[214,241],{"_104":249,"_96":250,"_156":251,"_158":215,"_159":141,"_160":252,"_162":22,"_106":253,"_100":32,"_164":235,"_166":254,"_167":22,"_168":-5,"_169":1100,"_99":1101},[],[214,250],{"_104":258,"_96":259,"_156":260,"_158":215,"_159":141,"_160":261,"_162":22,"_106":262,"_100":32,"_164":225,"_166":263,"_167":22,"_168":-5,"_169":1103,"_99":1104},[],[214,259],[214],{"_104":268,"_96":269,"_156":270,"_158":-5,"_159":141,"_160":271,"_162":118,"_106":272,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1107,"_99":1306},[1108,1117,1123,1141,1153,1201,1237,1240,1264,1276],{"_104":275,"_96":276,"_156":277,"_158":270,"_159":141,"_160":278,"_162":118,"_106":279,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1109,"_99":1116},[1110,1113],{"_104":282,"_96":283,"_156":284,"_158":277,"_159":141,"_160":285,"_162":22,"_106":286,"_100":287,"_164":235,"_166":288,"_167":22,"_168":-5,"_169":1111,"_99":1112},[],[269,276,283],{"_104":292,"_96":293,"_156":294,"_158":277,"_159":141,"_160":295,"_162":22,"_106":296,"_100":32,"_164":235,"_166":297,"_167":22,"_168":-5,"_169":1114,"_99":1115},[],[269,276,293],[269,276],{"_104":302,"_96":303,"_156":304,"_158":270,"_159":141,"_160":305,"_162":22,"_106":306,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1118,"_99":1122},[1119],{"_104":309,"_96":310,"_156":311,"_158":304,"_159":141,"_160":312,"_162":22,"_106":313,"_100":314,"_164":235,"_166":315,"_167":22,"_168":-5,"_169":1120,"_99":1121},[],[269,303,310],[269,303],{"_104":320,"_96":321,"_156":322,"_158":270,"_159":141,"_160":323,"_162":118,"_106":324,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1124,"_99":1140},[1125,1128,1131,1134,1137],{"_104":327,"_96":328,"_156":329,"_158":322,"_159":141,"_160":330,"_162":22,"_106":331,"_100":271,"_164":235,"_166":332,"_167":22,"_168":-5,"_169":1126,"_99":1127},[],[269,321,328],{"_104":336,"_96":337,"_156":338,"_158":322,"_159":141,"_160":101,"_162":22,"_106":339,"_100":340,"_164":235,"_166":341,"_167":22,"_168":-5,"_169":1129,"_99":1130},[],[269,321,337],{"_104":345,"_96":346,"_156":347,"_158":322,"_159":141,"_160":348,"_162":118,"_106":349,"_100":271,"_164":235,"_166":350,"_167":22,"_168":-5,"_169":1132,"_99":1133},[],[269,321,346],{"_104":354,"_96":355,"_156":356,"_158":322,"_159":141,"_160":357,"_162":118,"_106":358,"_100":271,"_164":235,"_166":359,"_167":22,"_168":-5,"_169":1135,"_99":1136},[],[269,321,355],{"_104":363,"_96":364,"_156":365,"_158":322,"_159":141,"_160":366,"_162":22,"_106":367,"_100":323,"_164":235,"_166":368,"_167":22,"_168":-5,"_169":1138,"_99":1139},[],[269,321,364],[269,321],{"_104":373,"_96":374,"_156":375,"_158":270,"_159":141,"_160":376,"_162":118,"_106":377,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1142,"_99":1152},[1143,1149],{"_104":380,"_96":381,"_156":382,"_158":375,"_159":141,"_160":383,"_162":22,"_106":384,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1144,"_99":1148},[1145],{"_104":387,"_96":388,"_156":389,"_158":382,"_159":141,"_160":390,"_162":22,"_106":391,"_100":32,"_164":235,"_166":392,"_167":22,"_168":-5,"_169":1146,"_99":1147},[],[269,374,381,388],[269,374,381],{"_104":397,"_96":398,"_156":399,"_158":375,"_159":141,"_160":400,"_162":22,"_106":401,"_100":402,"_164":235,"_166":403,"_167":22,"_168":-5,"_169":1150,"_99":1151},[],[269,374,398],[269,374],{"_104":408,"_96":409,"_156":410,"_158":270,"_159":141,"_160":314,"_162":118,"_106":411,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1154,"_99":1200},[1155,1173,1176,1179,1182,1185,1188,1191,1194,1197],{"_104":414,"_96":415,"_156":416,"_158":410,"_159":141,"_160":417,"_162":22,"_106":418,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1156,"_99":1172},[1157,1160,1163,1166,1169],{"_104":421,"_96":422,"_156":423,"_158":416,"_159":141,"_160":424,"_162":22,"_106":425,"_100":32,"_164":235,"_166":426,"_167":22,"_168":-5,"_169":1158,"_99":1159},[],[269,409,415,422],{"_104":430,"_96":431,"_156":432,"_158":416,"_159":141,"_160":433,"_162":22,"_106":434,"_100":32,"_164":235,"_166":435,"_167":22,"_168":-5,"_169":1161,"_99":1162},[],[269,409,415,431],{"_104":439,"_96":440,"_156":441,"_158":416,"_159":141,"_160":442,"_162":22,"_106":443,"_100":32,"_164":235,"_166":444,"_167":22,"_168":-5,"_169":1164,"_99":1165},[],[269,409,415,440],{"_104":448,"_96":449,"_156":450,"_158":416,"_159":141,"_160":451,"_162":22,"_106":452,"_100":32,"_164":235,"_166":453,"_167":22,"_168":-5,"_169":1167,"_99":1168},[],[269,409,415,449],{"_104":457,"_96":458,"_156":459,"_158":416,"_159":141,"_160":460,"_162":22,"_106":461,"_100":32,"_164":235,"_166":462,"_167":22,"_168":-5,"_169":1170,"_99":1171},[],[269,409,415,458],[269,409,415],{"_104":467,"_96":468,"_156":469,"_158":410,"_159":141,"_160":470,"_162":22,"_106":471,"_100":472,"_164":235,"_166":473,"_167":22,"_168":-5,"_169":1174,"_99":1175},[],[269,409,468],{"_104":477,"_96":478,"_156":479,"_158":410,"_159":141,"_160":480,"_162":22,"_106":481,"_100":32,"_164":235,"_166":482,"_167":22,"_168":-5,"_169":1177,"_99":1178},[],[269,409,478],{"_104":486,"_96":487,"_156":488,"_158":410,"_159":141,"_160":489,"_162":22,"_106":490,"_100":491,"_164":235,"_166":492,"_167":22,"_168":-5,"_169":1180,"_99":1181},[],[269,409,487],{"_104":496,"_96":497,"_156":498,"_158":410,"_159":141,"_160":499,"_162":22,"_106":500,"_100":32,"_164":235,"_166":501,"_167":22,"_168":-5,"_169":1183,"_99":1184},[],[269,409,497],{"_104":505,"_96":506,"_156":507,"_158":410,"_159":141,"_160":508,"_162":22,"_106":509,"_100":32,"_164":235,"_166":510,"_167":22,"_168":-5,"_169":1186,"_99":1187},[],[269,409,506],{"_104":514,"_96":515,"_156":516,"_158":410,"_159":141,"_160":517,"_162":22,"_106":518,"_100":32,"_164":235,"_166":519,"_167":22,"_168":-5,"_169":1189,"_99":1190},[],[269,409,515],{"_104":523,"_96":524,"_156":525,"_158":410,"_159":141,"_160":526,"_162":22,"_106":527,"_100":528,"_164":235,"_166":529,"_167":22,"_168":-5,"_169":1192,"_99":1193},[],[269,409,524],{"_104":533,"_96":534,"_156":535,"_158":410,"_159":141,"_160":536,"_162":22,"_106":537,"_100":538,"_164":235,"_166":539,"_167":22,"_168":-5,"_169":1195,"_99":1196},[],[269,409,534],{"_104":543,"_96":544,"_156":545,"_158":410,"_159":141,"_160":546,"_162":22,"_106":547,"_100":340,"_164":235,"_166":548,"_167":22,"_168":-5,"_169":1198,"_99":1199},[],[269,409,544],[269,409],{"_104":553,"_96":554,"_156":555,"_158":270,"_159":141,"_160":340,"_162":118,"_106":556,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1202,"_99":1236},[1203,1206,1209,1212,1215,1218,1221,1224,1227,1230,1233],{"_104":559,"_96":560,"_156":561,"_158":555,"_159":141,"_160":562,"_162":118,"_106":563,"_100":323,"_164":235,"_166":564,"_167":22,"_168":-5,"_169":1204,"_99":1205},[],[269,554,560],{"_104":568,"_96":569,"_156":570,"_158":555,"_159":141,"_160":571,"_162":118,"_106":572,"_100":278,"_164":235,"_166":573,"_167":22,"_168":-5,"_169":1207,"_99":1208},[],[269,554,569],{"_104":577,"_96":578,"_156":579,"_158":555,"_159":141,"_160":580,"_162":22,"_106":581,"_100":582,"_164":235,"_166":583,"_167":22,"_168":-5,"_169":1210,"_99":1211},[],[269,554,578],{"_104":587,"_96":588,"_156":589,"_158":555,"_159":141,"_160":590,"_162":118,"_106":591,"_100":32,"_164":235,"_166":592,"_167":22,"_168":-5,"_169":1213,"_99":1214},[],[269,554,588],{"_104":596,"_96":597,"_156":598,"_158":555,"_159":141,"_160":599,"_162":22,"_106":600,"_100":528,"_164":235,"_166":601,"_167":22,"_168":-5,"_169":1216,"_99":1217},[],[269,554,597],{"_104":605,"_96":606,"_156":607,"_158":555,"_159":141,"_160":608,"_162":22,"_106":609,"_100":528,"_164":235,"_166":610,"_167":22,"_168":-5,"_169":1219,"_99":1220},[],[269,554,606],{"_104":614,"_96":615,"_156":616,"_158":555,"_159":141,"_160":617,"_162":118,"_106":618,"_100":376,"_164":235,"_166":619,"_167":22,"_168":-5,"_169":1222,"_99":1223},[],[269,554,615],{"_104":623,"_96":624,"_156":625,"_158":555,"_159":141,"_160":626,"_162":22,"_106":627,"_100":628,"_164":235,"_166":629,"_167":22,"_168":-5,"_169":1225,"_99":1226},[],[269,554,624],{"_104":633,"_96":634,"_156":635,"_158":555,"_159":141,"_160":636,"_162":22,"_106":637,"_100":376,"_164":235,"_166":638,"_167":22,"_168":-5,"_169":1228,"_99":1229},[],[269,554,634],{"_104":642,"_96":643,"_156":644,"_158":555,"_159":141,"_160":645,"_162":118,"_106":646,"_100":340,"_164":235,"_166":647,"_167":22,"_168":-5,"_169":1231,"_99":1232},[],[269,554,643],{"_104":651,"_96":652,"_156":653,"_158":555,"_159":141,"_160":654,"_162":118,"_106":655,"_100":271,"_164":235,"_166":656,"_167":22,"_168":-5,"_169":1234,"_99":1235},[],[269,554,652],[269,554],{"_104":661,"_96":662,"_156":663,"_158":270,"_159":141,"_160":664,"_162":22,"_106":665,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1238,"_99":1239},[],[269,662],{"_104":669,"_96":670,"_156":671,"_158":270,"_159":141,"_160":491,"_162":118,"_106":672,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1241,"_99":1263},[1242,1245,1248,1251,1254,1257,1260],{"_104":675,"_96":676,"_156":677,"_158":671,"_159":141,"_160":678,"_162":22,"_106":679,"_100":323,"_164":235,"_166":680,"_167":22,"_168":-5,"_169":1243,"_99":1244},[],[269,670,676],{"_104":684,"_96":685,"_156":686,"_158":671,"_159":141,"_160":687,"_162":118,"_106":688,"_100":32,"_164":235,"_166":689,"_167":22,"_168":-5,"_169":1246,"_99":1247},[],[269,670,685],{"_104":693,"_96":694,"_156":695,"_158":671,"_159":141,"_160":696,"_162":118,"_106":697,"_100":32,"_164":235,"_166":698,"_167":22,"_168":-5,"_169":1249,"_99":1250},[],[269,670,694],{"_104":702,"_96":703,"_156":704,"_158":671,"_159":141,"_160":705,"_162":22,"_106":706,"_100":278,"_164":235,"_166":707,"_167":22,"_168":-5,"_169":1252,"_99":1253},[],[269,670,703],{"_104":711,"_96":712,"_156":713,"_158":671,"_159":141,"_160":714,"_162":22,"_106":715,"_100":271,"_164":235,"_166":716,"_167":22,"_168":-5,"_169":1255,"_99":1256},[],[269,670,712],{"_104":720,"_96":721,"_156":722,"_158":671,"_159":141,"_160":723,"_162":22,"_106":724,"_100":314,"_164":235,"_166":725,"_167":22,"_168":-5,"_169":1258,"_99":1259},[],[269,670,721],{"_104":729,"_96":730,"_156":731,"_158":671,"_159":141,"_160":732,"_162":22,"_106":733,"_100":376,"_164":235,"_166":734,"_167":22,"_168":-5,"_169":1261,"_99":1262},[],[269,670,730],[269,670],{"_104":739,"_96":740,"_156":741,"_158":270,"_159":141,"_160":742,"_162":118,"_106":743,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1265,"_99":1275},[1266,1269,1272],{"_104":746,"_96":747,"_156":748,"_158":741,"_159":141,"_160":749,"_162":118,"_106":750,"_100":32,"_164":235,"_166":751,"_167":22,"_168":-5,"_169":1267,"_99":1268},[],[269,740,747],{"_104":755,"_96":756,"_156":757,"_158":741,"_159":141,"_160":758,"_162":118,"_106":759,"_100":32,"_164":235,"_166":760,"_167":22,"_168":-5,"_169":1270,"_99":1271},[],[269,740,756],{"_104":764,"_96":765,"_156":766,"_158":741,"_159":141,"_160":767,"_162":22,"_106":768,"_100":323,"_164":235,"_166":769,"_167":22,"_168":-5,"_169":1273,"_99":1274},[],[269,740,765],[269,740],{"_104":774,"_96":775,"_156":776,"_158":270,"_159":141,"_160":528,"_162":118,"_106":777,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1277,"_99":1305},[1278,1281,1284,1287,1290,1293,1296,1299,1302],{"_104":780,"_96":781,"_156":782,"_158":776,"_159":141,"_160":783,"_162":22,"_106":784,"_100":278,"_164":235,"_166":785,"_167":22,"_168":-5,"_169":1279,"_99":1280},[],[269,775,781],{"_104":789,"_96":790,"_156":791,"_158":776,"_159":141,"_160":792,"_162":118,"_106":793,"_100":271,"_164":235,"_166":794,"_167":22,"_168":-5,"_169":1282,"_99":1283},[],[269,775,790],{"_104":798,"_96":799,"_156":800,"_158":776,"_159":141,"_160":801,"_162":118,"_106":802,"_100":271,"_164":235,"_166":803,"_167":22,"_168":-5,"_169":1285,"_99":1286},[],[269,775,799],{"_104":807,"_96":808,"_156":809,"_158":776,"_159":141,"_160":810,"_162":118,"_106":811,"_100":323,"_164":235,"_166":812,"_167":22,"_168":-5,"_169":1288,"_99":1289},[],[269,775,808],{"_104":816,"_96":817,"_156":818,"_158":776,"_159":141,"_160":819,"_162":118,"_106":820,"_100":323,"_164":235,"_166":821,"_167":22,"_168":-5,"_169":1291,"_99":1292},[],[269,775,817],{"_104":825,"_96":826,"_156":827,"_158":776,"_159":141,"_160":828,"_162":118,"_106":829,"_100":32,"_164":235,"_166":830,"_167":22,"_168":-5,"_169":1294,"_99":1295},[],[269,775,826],{"_104":834,"_96":835,"_156":836,"_158":776,"_159":141,"_160":837,"_162":22,"_106":838,"_100":839,"_164":235,"_166":840,"_167":22,"_168":-5,"_169":1297,"_99":1298},[],[269,775,835],{"_104":844,"_96":845,"_156":846,"_158":776,"_159":141,"_160":847,"_162":22,"_106":848,"_100":538,"_164":235,"_166":849,"_167":22,"_168":-5,"_169":1300,"_99":1301},[],[269,775,845],{"_104":853,"_96":854,"_156":855,"_158":776,"_159":141,"_160":856,"_162":118,"_106":857,"_100":32,"_164":235,"_166":858,"_167":22,"_168":-5,"_169":1303,"_99":1304},[],[269,775,854],[269,775],[269],{"_104":864,"_96":865,"_156":866,"_158":-5,"_159":141,"_160":867,"_162":22,"_106":868,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":1308,"_99":1309},[],[865],{"_104":872,"_96":873,"_156":874,"_158":-5,"_159":141,"_160":875,"_162":22,"_106":876,"_100":528,"_164":225,"_166":877,"_167":22,"_168":-5,"_169":1311,"_99":1312},[],[873],{"_104":881,"_96":882,"_156":883,"_158":-5,"_159":141,"_160":884,"_162":22,"_106":885,"_100":528,"_164":225,"_166":886,"_167":22,"_168":-5,"_169":1314,"_99":1315},[],[882],{"_104":890,"_96":891,"_156":892,"_158":-5,"_159":141,"_160":893,"_162":22,"_106":894,"_100":32,"_164":225,"_166":895,"_167":22,"_168":-5,"_169":1317,"_99":1318},[],[891],{"_104":899,"_96":900,"_156":901,"_158":-5,"_159":141,"_160":902,"_162":22,"_106":903,"_100":32,"_164":225,"_166":895,"_167":22,"_168":-5,"_169":1320,"_99":1321},[],[900],{"_104":907,"_96":908,"_156":909,"_158":-5,"_159":141,"_160":910,"_162":22,"_106":911,"_100":32,"_164":225,"_166":912,"_167":22,"_168":-5,"_169":1323,"_99":1324},[],[908],{"_104":916,"_96":917,"_156":918,"_158":-5,"_159":141,"_160":919,"_162":22,"_106":920,"_100":32,"_164":225,"_166":921,"_167":22,"_168":-5,"_169":1326,"_99":1327},[],[917],{"_104":925,"_96":926,"_156":927,"_158":-5,"_159":141,"_160":928,"_162":22,"_106":929,"_100":32,"_164":225,"_166":930,"_167":22,"_168":-5,"_169":1329,"_99":1330},[],[926],{"_104":934,"_96":935,"_156":936,"_158":-5,"_159":141,"_160":937,"_162":22,"_106":938,"_100":32,"_164":225,"_166":939,"_167":22,"_168":-5,"_169":1332,"_99":1333},[],[935],{"_104":943,"_96":944,"_156":945,"_158":-5,"_159":141,"_160":946,"_162":22,"_106":947,"_100":376,"_164":225,"_166":948,"_167":22,"_168":-5,"_169":1335,"_99":1336},[],[944],{"_104":952,"_96":953,"_156":954,"_158":-5,"_159":141,"_160":955,"_162":118,"_106":956,"_100":271,"_164":225,"_166":957,"_167":22,"_168":-5,"_169":1338,"_99":1339},[],[953],{"_104":961,"_96":962,"_156":116,"_158":-5,"_159":141,"_160":963,"_162":118,"_106":964,"_100":965,"_164":966,"_166":967,"_167":22,"_168":-5,"_169":1341,"_99":1342},[],[962],{"_104":971,"_96":972,"_156":973,"_158":-5,"_159":141,"_160":974,"_162":22,"_106":975,"_100":32,"_164":225,"_166":976,"_167":22,"_168":-5,"_169":1344,"_99":1345},[],[972],[1070,1073,1076,1079,1082,1085,1088,1090,1093,1096,1099,1102,1106,1108,1110,1113,1117,1119,1123,1125,1128,1131,1134,1137,1141,1143,1145,1149,1153,1155,1157,1160,1163,1166,1169,1173,1176,1179,1182,1185,1188,1191,1194,1197,1201,1203,1206,1209,1212,1215,1218,1221,1224,1227,1230,1233,1237,1240,1242,1245,1248,1251,1254,1257,1260,1264,1266,1269,1272,1276,1278,1281,1284,1287,1290,1293,1296,1299,1302,1307,1310,1313,1316,1319,1322,1325,1328,1331,1334,1337,1340,1343],[1348,1350,1352,1354,1356,1358,1360,1362,1364,1366,1368,1370,1372,1374,1376,1378,1380,1382,1384,1386,1388],{"_104":154,"_96":155,"_156":157,"_158":-5,"_159":141,"_160":161,"_162":22,"_106":994,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1349},[155],{"_104":173,"_96":174,"_156":175,"_158":-5,"_159":141,"_160":176,"_162":22,"_106":997,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1351},[174],{"_104":181,"_96":182,"_156":183,"_158":-5,"_159":141,"_160":184,"_162":22,"_106":1000,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1353},[182],{"_104":189,"_96":190,"_156":191,"_158":-5,"_159":141,"_160":192,"_162":22,"_106":1003,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1355},[190],{"_104":197,"_96":198,"_156":199,"_158":-5,"_159":141,"_160":200,"_162":22,"_106":1006,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1357},[198],{"_104":205,"_96":206,"_156":207,"_158":-5,"_159":141,"_160":208,"_162":118,"_106":1009,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1359},[206],{"_104":213,"_96":214,"_156":215,"_158":-5,"_159":141,"_160":216,"_162":22,"_106":1012,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1361},[214],{"_104":268,"_96":269,"_156":270,"_158":-5,"_159":141,"_160":271,"_162":118,"_106":1015,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1363},[269],{"_104":864,"_96":865,"_156":866,"_158":-5,"_159":141,"_160":867,"_162":22,"_106":1018,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_99":1365},[865],{"_104":872,"_96":873,"_156":874,"_158":-5,"_159":141,"_160":875,"_162":22,"_106":1021,"_100":528,"_164":225,"_166":877,"_167":22,"_168":-5,"_99":1367},[873],{"_104":881,"_96":882,"_156":883,"_158":-5,"_159":141,"_160":884,"_162":22,"_106":1024,"_100":528,"_164":225,"_166":886,"_167":22,"_168":-5,"_99":1369},[882],{"_104":890,"_96":891,"_156":892,"_158":-5,"_159":141,"_160":893,"_162":22,"_106":1027,"_100":32,"_164":225,"_166":895,"_167":22,"_168":-5,"_99":1371},[891],{"_104":899,"_96":900,"_156":901,"_158":-5,"_159":141,"_160":902,"_162":22,"_106":1030,"_100":32,"_164":225,"_166":895,"_167":22,"_168":-5,"_99":1373},[900],{"_104":907,"_96":908,"_156":909,"_158":-5,"_159":141,"_160":910,"_162":22,"_106":1033,"_100":32,"_164":225,"_166":912,"_167":22,"_168":-5,"_99":1375},[908],{"_104":916,"_96":917,"_156":918,"_158":-5,"_159":141,"_160":919,"_162":22,"_106":1036,"_100":32,"_164":225,"_166":921,"_167":22,"_168":-5,"_99":1377},[917],{"_104":925,"_96":926,"_156":927,"_158":-5,"_159":141,"_160":928,"_162":22,"_106":1039,"_100":32,"_164":225,"_166":930,"_167":22,"_168":-5,"_99":1379},[926],{"_104":934,"_96":935,"_156":936,"_158":-5,"_159":141,"_160":937,"_162":22,"_106":1042,"_100":32,"_164":225,"_166":939,"_167":22,"_168":-5,"_99":1381},[935],{"_104":943,"_96":944,"_156":945,"_158":-5,"_159":141,"_160":946,"_162":22,"_106":1045,"_100":376,"_164":225,"_166":948,"_167":22,"_168":-5,"_99":1383},[944],{"_104":952,"_96":953,"_156":954,"_158":-5,"_159":141,"_160":955,"_162":118,"_106":1048,"_100":271,"_164":225,"_166":957,"_167":22,"_168":-5,"_99":1385},[953],{"_104":961,"_96":962,"_156":116,"_158":-5,"_159":141,"_160":963,"_162":118,"_106":1051,"_100":965,"_164":966,"_166":967,"_167":22,"_168":-5,"_99":1387},[962],{"_104":971,"_96":972,"_156":973,"_158":-5,"_159":141,"_160":974,"_162":22,"_106":1054,"_100":32,"_164":225,"_166":976,"_167":22,"_168":-5,"_99":1389},[972],"upstream","pull","ahead","behind","templates",[],"actionData","errors"]

ianmenethil

ZenServer