[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_175":176,"_177":178},"routes/_app.x.$handle.$name",{"_101":100,"_32":49,"_109":88,"_27":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_21":-5,"_121":122,"_123":124,"_125":25,"_126":127,"_128":25,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_47":48,"_32":49,"_36":50,"_51":-5,"_52":53,"_54":55,"_56":55,"_57":-5,"_58":-5,"_18":59,"_60":-5,"_61":53,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",1,"changes",[19,20],"aiChatInfo","userId",{"_21":41,"_23":-7,"_24":25,"_26":25,"_27":42,"_29":42},{"_21":22,"_23":-7,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":21,"_34":35,"_36":37,"_38":14,"_39":40,"_24":25},"previous","deleted",false,"deletedHere","path","README.md","latestPath","fileId","43b3472c-2772-11f0-b46e-569c3dd06744","name","fileType","content","# Password Auth Middleware\n\nProtect your vals behind a password. Use session cookies to persist authentication.\n\n![6ed0648ae8813e958dbe79468572cb52f578239c0fae55857a13660beebdc5fd.png](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/36c1dc4f-4e19-457b-ad89-0bf139754e00/public)\n\n## Demo\n\nSee @pomdtr/password_auth_test\n\n## Usage\n\nIf you want to use an [api token](https://www.val.town/settings/api) to authenticate: \n\n```ts\nimport { passwordAuth } from \"https://esm.town/v/pomdtr/password_auth\";\n\nexport default passwordAuth(() => {\n return new Response(\"OK\");\n});\n```\n\nOr if you prefer to use a string:\n\n```ts\nimport { passwordAuth } from \"https://esm.town/v/pomdtr/password_auth\";\n\nexport default passwordAuth(() => {\n return new Response(\"OK\");\n}, { password: Deno.env.get(\"VAL_PASSWORD\") });\n```\n\nYou can also set multiple ones\n\n```ts\nimport { passwordAuth } from \"https://esm.town/v/pomdtr/password_auth\";\n\nexport default passwordAuth(() => {\n return new Response(\"OK\");\n}, { password: [Deno.env.get(\"VAL_PASSWORD\"), Deno.env.get(\"STEVE_PASSWORD\")] });\n```\n\nNote that authenticating using your api token remain an option even after setting a password.\n\n## TODO\n\n- [x] allow to authenticate using a val town token\n- [ ] add a way to send an email to ask a password from the val owner\n- [ ] automatically extend the session\n- [ ] automatically remove expired sessions\n\n## FAQ\n\n> How to sign out ?\n\nNavigate to `/signout`.","createdAt",["D",1718223962001],"branchVersion","branchId","43b00d64-2772-11f0-b46e-569c3dd06744",{"_30":43,"_32":42,"_33":44,"_34":45,"_36":46,"_38":14,"_39":40,"_24":25},"main.tsx","43b33b9c-2772-11f0-b46e-569c3dd06744","script","import { deleteCookie, getCookies, setCookie } from \"https://deno.land/std/http/cookie.ts\";\nimport { inferRequestVal } from \"https://esm.town/v/andreterron/inferRequestVal\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite?v=4\";\nimport { html } from \"https://esm.town/v/stevekrouse/html?v=5\";\nimport { zip } from \"npm:lodash-es\";\nimport { nanoid } from \"npm:nanoid\";\n\ntype Session = {\n id: string;\n expiresAt: number;\n};\n\nasync function createSessionTable(tableName: string) {\n await sqlite.execute(`CREATE TABLE ${tableName} (\n id TEXT NOT NULL PRIMARY KEY,\n expires_at INTEGER NOT NULL,\n val_slug STRING NOT NULL\n );`);\n}\n\nasync function createSession(tableName: string, valSlug: string): Promise {\n try {\n const expires_at = new Date();\n expires_at.setDate(expires_at.getDate() + 7);\n const session: Session = { id: nanoid(), expiresAt: expires_at.getTime() };\n await sqlite.execute({\n sql: `INSERT INTO ${tableName} (id, val_slug, expires_at) VALUES (?, ?, ?)`,\n args: [session.id, valSlug, session.expiresAt],\n });\n return session;\n } catch (e) {\n if (e.message.includes(\"no such table\")) {\n await createSessionTable(tableName);\n return createSession(tableName, valSlug);\n }\n\n throw e;\n }\n}\n\nasync function getSession(tableName: string, sessionID: string, valSlug: string): Promise {\n try {\n const { rows, columns } = await sqlite.execute({\n sql: `SELECT * FROM ${tableName} WHERE id = ? AND val_slug = ?`,\n args: [sessionID, valSlug],\n });\n\n if (rows.length == 0) {\n return null;\n }\n\n return Object.fromEntries(zip(columns, rows.at(0))) as Session;\n } catch (e) {\n if (e.message.includes(\"no such table\")) {\n return null;\n }\n\n throw e;\n }\n}\n\nasync function fetchUser(token: string): Promise<{ id: string }> {\n const resp = await fetch(\"https://api.val.town/v1/me\", {\n headers: {\n Authorization: `Bearer ${token}`,\n },\n });\n\n if (resp.status !== 200) {\n throw new Error(\"Could not fetch user\");\n }\n\n return resp.json();\n}\n\nasync function verifyApiToken(token: string) {\n try {\n const [currentUser, requestUser] = await Promise.all([fetchUser(Deno.env.get(\"valtown\")), fetchUser(token)]);\n return currentUser.id == requestUser.id;\n } catch (_) {\n return false;\n }\n}\n\nconst loginPage = (handle) =>\n `\n \n \n \n \n \n

This val website is protected by a password.

If you are @${handle}, you can access it using an API token.

If not, you'll need to contact the author for access.

\n \n

\n \n`;\n\nexport function redirect(location: string): Response {\n return new Response(null, {\n headers: {\n location,\n },\n status: 302,\n });\n}\n\ntype Handler = (req?: Request) => Response | Promise;\n\ntype PasswordAuthOptions = {\n password: string | string[];\n sessionTable?: string;\n};\n\nconst cookieName = \"auth_session\";\n\nexport function passwordAuth(next, options?: PasswordAuthOptions) {\n let passwords: string[];\n if (!options?.password) {\n passwords = [];\n } else if (typeof options?.password == \"string\") {\n passwords = [options.password];\n } else {\n passwords = options.password;\n }\n\n const sessionTable = options?.sessionTable || \"password_auth_session\";\n return async (req: Request) => {\n const val = inferRequestVal(req);\n const valSlug = `${val.handle}/${val.name}`;\n\n const url = new URL(req.url);\n if (url.pathname == \"/signin\" && req.method == \"GET\") {\n return html(loginPage(val.handle));\n }\n\n if (url.pathname == \"/signin\" && req.method == \"POST\") {\n const formData = await req.formData();\n const password = formData.get(\"password\") as string;\n if (!passwords.includes(password) && !(await verifyApiToken(password))) {\n return new Response(\"Unauthorized\", {\n status: 403,\n });\n }\n const session = await createSession(sessionTable, valSlug);\n const res = redirect(url.searchParams.get(\"redirect\") || \"/\");\n setCookie(res.headers, {\n name: cookieName,\n value: session.id,\n maxAge: session.expiresAt,\n httpOnly: true,\n secure: true,\n // to work in val.town iframes\n sameSite: \"None\",\n });\n\n return res;\n }\n\n if (url.pathname == \"/signout\") {\n const res = redirect(\"/signin\");\n deleteCookie(res.headers, cookieName);\n return res;\n }\n\n if (req.headers.has(\"Authorization\")) {\n const requestToken = req.headers.get(\"Authorization\").replace(\"Bearer \", \"\").trim();\n if (!passwords.includes(requestToken)) {\n return new Response(null, {\n status: 403,\n });\n }\n return next(req);\n }\n\n const sessionID = getCookies(req.headers)[cookieName];\n if (!sessionID) {\n return redirect(\"/signin\");\n }\n\n const session = await getSession(sessionTable, sessionID, valSlug);\n if (!session) {\n const res = redirect(`/signin`);\n deleteCookie(res.headers, cookieName);\n return res;\n }\n\n if (session.expiresAt < Date.now()) {\n const res = redirect(`/signin`);\n deleteCookie(res.headers, cookieName);\n return res;\n }\n\n return next(req);\n };\n}",["D",1718223962001],"id","43afbfb2-2772-11f0-b46e-569c3dd06744","password_auth",["D",1746203216381],"deletedAt","legacyEnvVars",true,"privacy","public","httpPrivacy","description","imageUrl","688bef39-1b83-4dc0-bac0-94b1e1415f40","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","e82a8879-27af-47d7-9cf2-b562704127ed","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_108":104},"org",{"_101":100,"_102":-5,"_103":104,"_18":59,"_105":106,"_107":25},"branch",{"_13":14,"_32":88,"_47":40,"_89":48,"_90":91,"_92":65,"_93":55,"_94":95,"_96":97,"_98":49,"_99":100},"isOwned","main","projectId","forkedBranchId","e85571b2-277f-11f0-b46e-569c3dd06744","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","e8551e38-277f-11f0-b46e-569c3dd06744","forkedProjectOrgId","4b933fb9-e150-4558-9d0a-845e595c8c78","projectName","userHandle","kamek","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yVXFxd2VBR0h0anBPenJHOEJIMjRiUHBxalcucG5nIn0","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_47":48,"_32":49,"_36":171,"_51":-5,"_52":53,"_54":55,"_56":55,"_57":-5,"_58":-5,"_18":59,"_60":-5,"_61":53,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":172,"_83":173,"_85":174,"_87":25},"tree",[162,163],"files",[162,163],"counts",{"_152":65,"_153":14,"_154":65,"_155":156,"_157":158},"contents",[141,142],"upstreamProject",{"_47":95,"_32":49,"_57":-5,"_58":-5,"_54":55,"_81":139},"upstreamBranch",{"_47":91,"_36":133,"_134":135,"_32":88,"_89":95,"_13":136,"_90":-5,"_92":-5,"_137":-5,"_51":-5,"_87":25,"_54":55,"_99":138,"_66":97,"_98":49},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1746209076068],"updatedAt",["D",1755789148862],90,"lockfileKey","pomdtr",{"_101":138,"_108":140},"https://images.clerk.dev/oauth_github/img_2RCoAITJZH1QencEgtVjh4Qirj4.jpeg",{"_47":149,"_32":28,"_30":31,"_144":-5,"_39":40,"_38":14,"_145":53,"_36":150,"_13":65,"_33":21,"_34":35,"_24":25,"_147":-5,"_27":151},{"_47":143,"_32":42,"_30":43,"_144":-5,"_39":40,"_38":14,"_145":53,"_36":146,"_13":65,"_33":44,"_34":45,"_24":25,"_147":-5,"_27":148},"43b33ae8-2772-11f0-b46e-569c3dd06744","parentId","latest",["D",1718223962001],"label",[42],"43b346aa-2772-11f0-b46e-569c3dd06744",["D",1718223962001],[28],"pulls","branches","forks","envVars",{"_159":65,"_161":65},"connections",{"_159":65,"_160":65},"count","unfilledCount","emptyCount",{"_47":149,"_32":28,"_30":31,"_144":-5,"_39":40,"_38":14,"_145":53,"_36":168,"_13":65,"_33":21,"_34":35,"_24":25,"_147":-5,"_165":169,"_27":170},{"_47":143,"_32":42,"_30":43,"_144":-5,"_39":40,"_38":14,"_145":53,"_36":164,"_13":65,"_33":44,"_34":45,"_24":25,"_147":-5,"_165":166,"_27":167},["D",1718223962001],"children",[],[42],["D",1718223962001],[],[28],["D",1746203216381],{"_101":100,"_108":104},{"_101":100,"_102":-5,"_103":104,"_18":59,"_105":106,"_107":25},{"_13":14,"_32":88,"_47":40,"_89":48,"_90":91,"_92":65,"_93":55,"_94":95,"_96":97,"_98":49,"_99":100},"ctx",{"_81":-5,"_130":208,"_209":210,"_211":212,"_213":25,"_214":25,"_215":25,"_216":53,"_217":-5,"_218":-7,"_219":-7,"_220":65,"_221":25,"_222":25,"_223":-5,"_224":25,"_225":25,"_226":25,"_227":-5},"ENV",{"_179":180,"_181":182,"_183":88,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v1