[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_202":203,"_204":205},"routes/_app.x.$handle.$name",{"_106":105,"_38":51,"_115":96,"_33":116,"_13":14,"_117":-5,"_11":118,"_119":120,"_121":122,"_123":124,"_125":126,"_26":-5,"_127":-5,"_128":-5,"_129":31,"_130":131,"_132":65,"_133":-5,"_134":-5,"_135":136},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_49":50,"_38":51,"_44":52,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":89,"_90":91,"_92":93,"_94":31},"version",7,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","6b70a551-eb4d-4f48-b645-46cc317fda1a","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",false,"deletedHere","path","inbox.ts","latestPath","fileId","5ac33d00-5fa2-11f1-842a-1607ee4eb77e","name","fileType","email","content","// Email val: receives forwarded emails, extracts a 6-digit OTP, stores it.\n// Anything that isn't an OTP (e.g. Google's forwarding confirmation link) is\n// forwarded to your real inbox so you can act on it.\n// Learn more: https://docs.val.town/vals/email/\nimport { email } from \"https://esm.town/v/std/email\";\nimport { extractOtp, saveOtp } from \"./db.ts\";\n\ninterface Email {\n from: string;\n to: string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments: File[];\n headers: Record;\n}\n\n/** Strip HTML tags to plain text as a fallback when no text body is present. */\nfunction htmlToText(html: string): string {\n return html\n .replace(//gi, \" \")\n .replace(//gi, \" \")\n .replace(/<[^>]+>/g, \" \")\n .replace(/ /gi, \" \")\n .replace(/\\s+/g, \" \");\n}\n\nexport default async function (e: Email) {\n const body = e.text?.trim() || (e.html ? htmlToText(e.html) : \"\");\n const haystack = `${e.subject ?? \"\"}\\n${body}`;\n\n const code = extractOtp(haystack);\n\n if (!code) {\n console.log(`No 6-digit OTP found in email from ${e.from} (\"${e.subject ?? \"\"}\")`);\n return;\n }\n\n await saveOtp(code, e.from, e.subject ?? null);\n console.log(`Stored OTP ${code} from ${e.from} (\"${e.subject ?? \"\"}\")`);\n}\n","// Email val: receives forwarded emails, extracts a 6-digit OTP, stores it.\n// Anything that isn't an OTP (e.g. Google's forwarding confirmation link) is\n// forwarded to your real inbox so you can act on it.\n// Learn more: https://docs.val.town/vals/email/\nimport { email } from \"https://esm.town/v/std/email\";\nimport { extractOtp, saveOtp } from \"./db.ts\";\n\ninterface Email {\n from: string;\n to: string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments: File[];\n headers: Record;\n}\n\n/** Strip HTML tags to plain text as a fallback when no text body is present. */\nfunction htmlToText(html: string): string {\n return html\n .replace(//gi, \" \")\n .replace(//gi, \" \")\n .replace(/<[^>]+>/g, \" \")\n .replace(/ /gi, \" \")\n .replace(/\\s+/g, \" \");\n}\n\nexport default async function (e: Email) {\n const body = e.text?.trim() || (e.html ? htmlToText(e.html) : \"\");\n const haystack = `${e.subject ?? \"\"}\\n${body}`;\n\n const code = extractOtp(haystack);\n\n if (!code) {\n // Not an OTP — forward the whole message to your real inbox (no `to` field\n // means std/email delivers to the val owner's account email). This is how\n // you receive Google's forwarding-confirmation link during setup.\n console.log(`No OTP in email from ${e.from} (\"${e.subject ?? \"\"}\") — forwarding to owner`);\n await email({\n subject: `[OTP relay] Fwd: ${e.subject ?? \"(no subject)\"}`,\n text: `Forwarded from: ${e.from}\\n\\n${body}`,\n html: e.html,\n });\n return;\n }\n\n await saveOtp(code, e.from, e.subject ?? null);\n console.log(`Stored OTP ${code} from ${e.from} (\"${e.subject ?? \"\"}\")`);\n}\n","createdAt",["D",1780529053637],"branchVersion","branchId","d0ba382a-b9ae-4892-ac97-b2e7d367fda4","id","f91cdf72-9cdc-414c-838d-17edd2984586","email-val",["D",1780528612421],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Relay 6-digit OTPs from forwarded emails to a browser extension","imageUrl","3d9c1e5f-c245-4993-94bd-8561053c03ab","pinnedFileId","5f73cb62-5fa2-11f1-842a-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019e8fc0-9a70-73b8-a383-7d13f37931fb","tursoName","f91cdf729cdc414c838d17edd2984586","tursoHostname","f91cdf729cdc414c838d17edd2984586-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509672838],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_106":105,"_114":110},"org",{"_106":105,"_107":108,"_109":110,"_19":61,"_111":112,"_113":31},"branch",{"_13":95,"_38":96,"_49":48,"_97":50,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":51,"_104":105},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","indenigrate","handle","displayName","Devansh Soni","avatar","https://lh3.googleusercontent.com/a/ACg8ocJwD0RUE37HSMwrSwLEcHlgx6sHh2qmNBrvwUFvZmymKRTjQW8=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_49":50,"_38":51,"_44":197,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":198,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":199,"_90":200,"_92":201,"_94":31},"tree",[180,181,182,183],"files",[180,181,182,183],"counts",{"_170":69,"_171":152,"_172":145,"_173":174,"_175":176},"contents",[137,138,139,140],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_49":163,"_38":164,"_36":165,"_142":-5,"_47":48,"_46":166,"_143":65,"_44":167,"_13":69,"_39":26,"_41":168,"_30":31,"_146":-5,"_33":169},{"_49":156,"_38":157,"_36":63,"_142":-5,"_47":48,"_46":158,"_143":65,"_44":159,"_13":69,"_39":160,"_41":161,"_30":31,"_146":-5,"_33":162},{"_49":148,"_38":149,"_36":150,"_142":-5,"_47":48,"_46":145,"_143":65,"_44":151,"_13":152,"_39":153,"_41":154,"_30":31,"_146":-5,"_33":155},{"_49":141,"_38":34,"_36":37,"_142":-5,"_47":48,"_46":14,"_143":31,"_44":144,"_13":145,"_39":40,"_41":43,"_30":31,"_146":-5,"_33":147},"99b6b9f8-a7c4-4141-a3a4-172ffbc59304","parentId","latest",["D",1780529053637],2,"label",[34],"aa44848b-74da-466d-8d23-98471ef4b73d","db.ts","4e151966-5fa2-11f1-89b0-1607ee4eb77e",["D",1780528624562],1,"script","// Shared SQLite schema + helpers for the OTP relay.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport const TTL_MS = 5 * 60 * 1000; // codes expire after 5 minutes\n\nexport interface OtpRecord {\n code: string;\n sender: string | null;\n subject: string | null;\n created_at: number;\n}\n\nexport async function initDb() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS otp_codes (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n code TEXT NOT NULL,\n sender TEXT,\n subject TEXT,\n created_at INTEGER NOT NULL\n )`);\n}\n\n/** Delete any codes older than the TTL. Keeps the table small and enforces expiry. */\nexport async function purgeExpired() {\n await sqlite.execute({\n sql: \"DELETE FROM otp_codes WHERE created_at < ?\",\n args: [Date.now() - TTL_MS],\n });\n}\n\n/** Extract the first plausible 6-digit OTP from a block of text. */\nexport function extractOtp(text: string): string | null {\n if (!text) return null;\n // Match a standalone run of exactly 6 digits (not embedded in a longer number).\n // Allows an optional separator in the middle (e.g. \"123 456\" or \"123-456\").\n const match = text.match(/(? {\n await initDb();\n await purgeExpired();\n const cutoff = Date.now() - TTL_MS;\n const result = await sqlite.execute({\n sql:\n \"SELECT code, sender, subject, created_at FROM otp_codes WHERE created_at >= ? ORDER BY created_at DESC LIMIT 1\",\n args: [cutoff],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0] as unknown as OtpRecord;\n const age = Date.now() - row.created_at;\n return { ...row, age_ms: age, expires_in_ms: TTL_MS - age };\n}\n",[149],"a98d86b3-e120-40d4-86a4-e9187144679c","api.ts",4,["D",1780528641564],"http","// HTTP val: returns the latest non-expired OTP to the browser extension.\n// Learn more: https://docs.val.town/vals/http/\nimport { getLatestOtp } from \"./db.ts\";\n\n// When ANY CORS header is set, Val Town stops adding its defaults — so we set\n// the full set ourselves here.\nconst CORS_HEADERS: Record = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization, X-Auth-Token\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\nfunction json(body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n });\n}\n\nexport default async function (req: Request): Promise {\n // Preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS_HEADERS });\n }\n\n if (req.method !== \"GET\") {\n return json({ error: \"Method not allowed\" }, 405);\n }\n\n // Optional shared-secret gate. If OTP_API_TOKEN is set, callers must supply it\n // via the `X-Auth-Token` header or `?token=` query param. This keeps the\n // public endpoint from leaking codes to anyone who guesses the URL.\n const requiredToken = Deno.env.get(\"OTP_API_TOKEN\");\n if (requiredToken) {\n const url = new URL(req.url);\n const provided = req.headers.get(\"X-Auth-Token\") ??\n req.headers.get(\"Authorization\")?.replace(/^Bearer\\s+/i, \"\") ??\n url.searchParams.get(\"token\");\n if (provided !== requiredToken) {\n return json({ error: \"Unauthorized\" }, 401);\n }\n }\n\n const latest = await getLatestOtp();\n if (!latest) {\n return json({ code: null, message: \"No active OTP\" }, 404);\n }\n\n return json({\n code: latest.code,\n sender: latest.sender,\n subject: latest.subject,\n createdAt: latest.created_at,\n expiresInMs: latest.expires_in_ms,\n });\n}\n",[157],"d9aa20d9-0824-4a29-af6e-87030d67da79","README.md","7b2a6564-5fa2-11f1-842a-1607ee4eb77e",5,["D",1780528688081],"# OTP Email → Browser Extension Relay\n\nSecurely relays 6-digit OTP codes from forwarded emails to a browser extension.\n\n## How it works\n\n```mermaid\nflowchart LR\n A[OTP email] -->|forward to val address| B[inbox.ts
Email Val]\n B -->|extract 6-digit code| C[(SQLite
otp_codes)]\n D[Browser extension] -->|GET /| E[api.ts
HTTP Val]\n E -->|read latest non-expired| C\n E -->|JSON code + CORS| D\n```\n\n## Files\n\n| File | Type | Role |\n|------|------|------|\n| `inbox.ts` | email | Receives forwarded emails, extracts the first 6-digit code, stores it with a timestamp. |\n| `api.ts` | http | Returns the most recent **non-expired** OTP as JSON, with full CORS headers. |\n| `db.ts` | script | Shared SQLite schema + helpers (`extractOtp`, `saveOtp`, `getLatestOtp`, `purgeExpired`). |\n\n## Setup\n\n1. **Forward OTP emails** to the email val's address (find it in the Val Town UI for `inbox.ts`, or in the `links.email` field). You can set up an auto-forward rule in Gmail/Outlook so codes arrive automatically.\n\n2. **(Recommended) Protect the endpoint.** The HTTP endpoint is public, so anyone with the URL could read your codes. Set an `OTP_API_TOKEN` env var and have your extension send it. When set, callers must provide it via:\n - `X-Auth-Token: ` header, **or**\n - `Authorization: Bearer ` header, **or**\n - `?token=` query param.\n\n 👉 Add OTP_API_TOKEN here: https://www.val.town/x/indenigrate/email-val/environment-variables?key=OTP_API_TOKEN\n\n## Expiry\n\nCodes expire **5 minutes** after they arrive (`TTL_MS` in `db.ts`). Expired rows are purged lazily on every read and write, so the store never serves a stale code.\n\n## API response\n\n`GET /` returns:\n\n```json\n{\n \"code\": \"614209\",\n \"sender\": \"no-reply@bank.example\",\n \"subject\": \"Your verification code\",\n \"createdAt\": 1780528667360,\n \"expiresInMs\": 297315\n}\n```\n\n- `404 { \"code\": null }` — no active OTP.\n- `401 { \"error\": \"Unauthorized\" }` — `OTP_API_TOKEN` is set and the caller didn't supply it.\n\n## Example: fetching from an extension\n\n```js\nconst res = await fetch(\"https://YOUR-ENDPOINT.web.val.run\", {\n headers: { \"X-Auth-Token\": \"your-secret-token\" },\n});\nconst { code } = await res.json();\n```\n",[164],"pulls","branches","forks","envVars",{"_177":152,"_179":69},"connections",{"_177":69,"_178":69},"count","unfilledCount","emptyCount",{"_49":163,"_38":164,"_36":165,"_142":-5,"_47":48,"_46":166,"_143":65,"_44":194,"_13":69,"_39":26,"_41":168,"_30":31,"_146":-5,"_185":195,"_33":196},{"_49":156,"_38":157,"_36":63,"_142":-5,"_47":48,"_46":158,"_143":65,"_44":191,"_13":69,"_39":160,"_41":161,"_30":31,"_146":-5,"_185":192,"_33":193},{"_49":148,"_38":149,"_36":150,"_142":-5,"_47":48,"_46":145,"_143":65,"_44":188,"_13":152,"_39":153,"_41":154,"_30":31,"_146":-5,"_185":189,"_33":190},{"_49":141,"_38":34,"_36":37,"_142":-5,"_47":48,"_46":14,"_143":31,"_44":184,"_13":145,"_39":40,"_41":43,"_30":31,"_146":-5,"_185":186,"_33":187},["D",1780529053637],"children",[],[34],["D",1780528624562],[],[149],["D",1780528641564],[],[157],["D",1780528688081],[],[164],["D",1780528612421],["D",1789509672838],{"_106":105,"_114":110},{"_106":105,"_107":108,"_109":110,"_19":61,"_111":112,"_113":31},{"_13":95,"_38":96,"_49":48,"_97":50,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":51,"_104":105},"ctx",{"_88":-5,"_134":235,"_236":237,"_238":239,"_240":31,"_241":31,"_242":31,"_243":65,"_244":-5,"_245":-7,"_246":-7,"_247":69,"_248":31,"_249":31,"_250":-5,"_251":31,"_252":31,"_253":31,"_254":-5},"ENV",{"_206":207,"_208":209,"_210":96,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7