Welcome

`);\n});\n```\n\n---\n\nTownie, stop here! Ask for permission to proceed.\n\n---\n\n## Architecture Validation\n\nBefore proceeding, verify your implementation follows the architecture:\n\n- Services only make direct API calls (no environment variables, no orchestration)\n- Controllers handle business logic and coordinate services\n- Routes only handle HTTP concerns and call controllers\n- No service calls directly from routes\n- Environment variables handled in controllers, not services\n- Consistent response patterns across all layers\n\n### Expected Behavior\n\nThe health endpoint should return:\n\n```\n{\n \"status\": \"ok\",\n \"timestamp\": \"2025-07-14T18:26:28.270Z\",\n \"service\": \"glance-demos\",\n \"databases\": {\n \"configured\": true,\n \"demos\": \"connected\",\n \"content\": \"connected\",\n \"interactions\": \"connected\"\n }\n}\n```\n\nThis architecture is intended to create clear separation of concerns and should make the codebase maintainable and testable.\n\n---\n\n**Townie, stop here! Before proceeding to additional steps, confirm that this step is working correctly.**\n\nIf everything is working as intended, tell the user that they can proceed to the next step: auth. Don't write any code.\n\n---\n",[],[156,175],{"_108":185,"_100":186,"_157":187,"_159":158,"_160":139,"_161":188,"_163":164,"_110":189,"_105":190,"_166":180,"_168":191,"_169":27,"_170":-5,"_171":192,"_103":193},"8e5e406e-618e-11f0-a1d3-0224a6c84d84","2-AUTH.md","debc7ee4-6112-11f0-8636-0224a6c84d84",561,["D",1752592535005],15,"# Complete Authentication Implementation Instructions\n\n## Townie instructions (Townie should follow these)\n\nRead through all of these instructions in order to understand the architecture of this Val, and implementation details important to this Val, and then once you have it all in your memory you should get to work.\n\nIf anything is unclear, you should stop and ask me for clarification before proceeding. Do not write code if you are unsure of what is expected.\n\n**Important:** there are checkpoints in these instructions where you are directed to stop and ask permission before proceeding. Follow those instructions and do not proceed without permission.\n\n## LastLogin Built-in Features\n\n**Important:** LastLogin automatically handles certain routes and authentication flows:\n\n- **`/auth/logout`** - LastLogin intercepts this route and handles logout automatically\n- **No custom logout route needed** in your Hono app\n- **Simply link to `/auth/logout`** and LastLogin will clear the session and redirect\n- **Authentication headers** - LastLogin adds `X-LastLogin-Email` header for authenticated requests\n\n**Authentication Flow:**\n\n1. **Unauthenticated requests** → LastLogin checks for session\n2. **No session** → Returns 401 or redirects to login\n3. **Valid session** → Adds `X-LastLogin-Email` header and passes to your app\n4. **`/auth/logout` requests** → LastLogin clears session automatically (never reaches your app)\n\n## Step 1. Core Architecture Setup\n\n### Main Application (main.tsx)\n\n**Add global authentication middleware to `main.tsx`:**\n\n```typescript\nimport { lastlogin } from \"https://esm.town/v/stevekrouse/lastlogin_safe\";\n\n// Import route modules\nimport authCheck from \"./backend/routes/authCheck.ts\";\n// other route modules\n\nconst app = new Hono();\n\n// Apply global authentication middleware to ALL routes\napp.use(\"*\", authCheck);\n\n// other routes\n\n// Export with LastLogin wrapper\nasync function handler(request: Request): Promise {\n return app.fetch(request);\n}\n\n// Wrap and export the main HTTP handler with lastlogin\nexport default lastlogin(handler);\n```\n\n### Dashboard Route Organization\n\n**Best Practice: Separate the root dashboard route from main.tsx**\n\nInstead of defining the root route directly in `main.tsx`, create a dedicated dashboard route file:\n\n- **Create**: `/backend/routes/dashboard.tsx`\n- **Purpose**: Handle the authenticated user's main dashboard/landing page\n- `import dashboardRoute from \"./backend/routes/dashboard.tsx\";`\n- **Mount in main.tsx**: `app.get(\"/\", dashboardRoute)`\n\nThis approach:\n\n- Keeps `main.tsx` focused on app setup and middleware\n- Makes the dashboard logic easier to maintain and test\n- Follows the modular architecture pattern used throughout the app\n- Allows for easier dashboard enhancements without touching core routing\n\nThe dashboard route should:\n\n- Display user information (email from `c.get(\"userEmail\")`)\n- Show as HTML the results of the `/api/health` endpoint, and provide a link to that endpoint under the results\n- Include logout functionality via `/auth/logout`\n- Show a simple and professional welcome interface with minimal styling\n\n### Create `/backend/routes/authCheck.ts`\n\n**Authentication Middleware:**\n\n- Retrieve the user's email: `const email = c.req.header(\"X-LastLogin-Email\")`\n- If email exists, the user is authenticated - store in context and continue to your app\n- If no email, show login page with LoginWithGoogleButton\n- **Note:** You don't need to handle `/auth/logout` - LastLogin does this automatically\n\n**Login Page Requirements:**\n\n- `import { LoginWithGoogleButton } from \"https://esm.town/v/stevekrouse/LoginWithGoogleButton\"`\n- Use the `` React Component, optionally supplying the `text` attribute\n- Add \"via LastLogin\" underneath LoginWithGoogleButton, centered, secondary text, linking to https://lastlogin.io/\n- Pass the email from the server to the client-side code if using React hydration or similar techniques\n\n**For authenticated users:**\n\n- Store email in context: `c.set('userEmail', email)`\n- In your authenticated views, add logout functionality: `Logout`\n\n**Public Routes Whitelist:**\n\n- Add a `PUBLIC_ROUTES` array at the top for routes that should be accessible without authentication\n- **Don't include `/auth/logout`** in the whitelist (LastLogin handles it before your middleware runs)\n- Use for truly public routes like: `/demo/:id`, `/api/health`, static assets, etc.\n\nIf you encounter problems loading the React button, try this simple approach for authCheck.ts:\n\n```typescript\n// Public routes that don't require authentication\nconst PUBLIC_ROUTES = [\n // Add public routes here as needed\n // '/demo/:id', // Example: public demo viewing\n // '/api/public', // Example: public API endpoints\n];\n\n// Helper function to check if a route is public\nfunction isPublicRoute(path: string): boolean {\n return PUBLIC_ROUTES.some((route) => {\n // Handle exact matches\n if (route === path) return true;\n\n // Handle wildcard patterns (basic implementation)\n if (route.includes(\"*\")) {\n const pattern = route.replace(\"*\", \".*\");\n return new RegExp(`^${pattern}$`).test(path);\n }\n\n // Handle route parameters (basic implementation)\n if (route.includes(\":\")) {\n const pattern = route.replace(/:[^/]+/g, \"[^/]+\");\n return new RegExp(`^${pattern}$`).test(path);\n }\n\n return false;\n });\n}\n\nexport default async (c, next) => {\n // Allow public routes to bypass authentication\n if (isPublicRoute(c.req.path)) {\n await next();\n return;\n }\n\n const email = c.req.header(\"X-LastLogin-Email\");\n\n if (!email) {\n // Show login page if not authenticated\n return c.html(`\n \n \n \n Your App - Login Required\n \n \n

Sign in

\n \n

\n via LastLogin\n

\n\n \n \n \n `);\n }\n\n // If authenticated, store email in context for use by routes\n c.set(\"userEmail\", email);\n\n // Continue to the next middleware/route\n await next();\n};\n```\n\n## Common Gotchas\n\n**Logout Route:**\n\n- ❌ Don't create a custom `/auth/logout` route in your Hono app\n- ✅ Just link to `/auth/logout` - LastLogin handles it automatically\n- The logout link will work for authenticated users without any custom code\n- LastLogin intercepts `/auth/logout` at the wrapper level before it reaches your middleware\n\n**Public Routes:**\n\n- Use the whitelist in authCheck.ts for routes that should be accessible without authentication\n- `/auth/logout` doesn't need to be whitelisted (LastLogin handles it before your middleware runs)\n- Examples of routes that should be whitelisted: public demos, health checks, static assets\n\n**Authentication Headers:**\n\n- Authenticated requests will have `X-LastLogin-Email` header\n- Unauthenticated requests will not have this header\n- LastLogin wrapper handles session validation before your code runs\n\n**Error Handling:**\n\n- If LastLogin can't validate a session, it returns 401 before reaching your app\n- Your authCheck middleware only runs for requests that pass LastLogin's validation\n- No need to handle session expiration - LastLogin manages this\n\n---\n\n**Townie, stop here! Before proceeding to additional steps, confirm that this step is working correctly.**\n\nIf everything is working as intended, tell the user that they can merge this branch into main, and then they can proceed to the next step: webhook authentication. Don't write any code.\n\n---\n",[],[156,186],{"_108":195,"_100":196,"_157":197,"_159":158,"_160":139,"_161":198,"_163":164,"_110":199,"_105":200,"_166":180,"_168":201,"_169":27,"_170":-5,"_171":202,"_103":203},"8e5975d4-618e-11f0-839b-0224a6c84d84","3-WEBHOOKS.md","92a39042-6135-11f0-8e20-0224a6c84d84",560,["D",1752592534985],6,"# Webhook Authentication Architecture Instructions\n\n## Townie instructions (Townie should follow these)\n\n## Middleware Order\n\nPlace authentication middleware in the following order:\n\n1. **Notion webhook auth middleware** (X-API-KEY for `/tasks/*`)\n2. **Global user auth middleware** (for other protected routes)\n3. **Route handlers**\n\n## Webhook Authentication\n\n### Scope\n\n- Apply only to routes under /tasks/\\*\n- All /tasks endpoints expect POSTs from Notion webhooks\n\n### Implementation\n\n- Create `/backend/routes/webhookAuthCheck.ts`\n- Extract X-API-KEY header from incoming requests\n- Compare against NOTION_WEBHOOK_SECRET environment variable\n- Use constant-time comparison to prevent timing attacks\n- Return 401/403 for authentication failures with generic error messages\n- Log failed authentication attempts for monitoring\n\n### Route Implementation Requirements\n\n**CRITICAL:** All webhook routes MUST use POST method:\n\n```\n// ✅ CORRECT - Webhooks are POST requests\napp.post(\"/webhook-endpoint\", async (c) => {\n // Handle webhook\n});\n\n// ❌ WRONG - This won't work with webhooks\napp.get(\"/webhook-endpoint\", async (c) => {\n // Webhooks can't reach this\n});\n```\n\nWhy: Notion (and most webhook providers) send POST requests, never GET.\n\n### Middleware Application (EXACT CODE)\n\nApply middleware in this EXACT order in main.tsx:\n\n```\n// 1. Webhook auth - ONLY for /tasks/* routes\napp.use(\"/tasks/*\", webhookAuth);\n\n// 2. User auth - for ALL routes EXCEPT /tasks/*\napp.use(\"/api/*\", authCheck);\napp.use(\"/views/*\", authCheck);\napp.use(\"/\", authCheck);\n\n// Add root route - now serves the authenticated dashboard\napp.get(\"/\", dashboardRoute);\n\n// 3. Mount routes AFTER middleware\napp.route(\"/tasks\", taskRoutes);\n```\n\n**Important:** We've changed the global authentication from app.use(\"\\*\") to more specific auth route handling.\n\n**Before:**\n\n```\napp.use(\"*\", authCheck); // Applied to ALL routes including /tasks/*\n```\n\n**After:**\n\n```\napp.use(\"/api/*\", authCheck); // Applied to API routes\napp.use(\"/views/*\", authCheck); // Applied to view routes\napp.use(\"/\", authCheck); // Applied to root route\n```\n\n**This ensures:**\n\n✅ `/` (root) still requires user authentication\n✅ `/api/*` routes still require user authentication\n✅ `/views/*` routes still require user authentication\n✅ `/tasks/*` routes only use webhook authentication (no user auth)\n\n**Common mistake:** Using app.use(\"\\*\", webhookAuth) - this applies to all routes incorrectly.\n\n### Flow Logic\n\n- Request to /tasks/\\* → Check X-API-KEY → If valid, proceed to route handler (skip global auth)\n- Request to /tasks/\\* → Check X-API-KEY → If invalid, return 401 (never reaches global auth)\n- Request to other routes → Skip webhook auth → Go to global auth → Then route handler\n\n### Testing Webhook Authentication\n\nTest in this exact order:\n\n1. **Test without header** (should fail):\n\nPOST /tasks/test\nExpected: 401 \"Authentication required\"\n\n1. **Test with wrong key** (should fail):\n\nPOST /tasks/test\nHeaders: {\"X-API-KEY\": \"wrong-key\"}\nExpected: 403 \"Authentication failed\"\n\n1. Test with correct key (should succeed):\n\nPOST /tasks/test \n Headers: {\"X-API-KEY\": \"your-configured-secret-value\"}\nExpected: 200 (reaches your route handler)\n\n**If step 3 returns 404:** Your route is probably defined as GET instead of POST.\n\n### Debugging Webhook Auth Issues\n\nAdd this temporary debug endpoint:\n\n```\napp.get(\"/debug-webhook\", (c) => {\n const secret = Deno.env.get(\"NOTION_WEBHOOK_SECRET\");\n return c.json({\n hasSecret: !!secret,\n secretLength: secret?.length || 0,\n });\n});\n```\n\n**Expected response:** {\"hasSecret\":true,\"secretLength\":>0}\n\nAdd this catch all endpoint:\n\n```\n// Catch-all handler for undefined webhook endpoints\n// This must be the LAST route defined to catch unmatched paths\napp.post(\"*\", (c) => {\n const path = c.req.path;\n const method = c.req.method;\n const returnObj = {\n error: \"Endpoint not found\",\n path: path,\n method: method,\n availableEndpoints: [\n \"GET /tasks/debug-webhook\",\n \"POST /tasks/test\",\n \"POST /tasks/notion-webhook\",\n ],\n };\n console.log(returnObj);\n\n return c.json(returnObj, 404);\n});\n```\n\n### Complete Working Example\n\nHere's a complete working webhook endpoint:\n\n```\n// backend/routes/tasks/_tasks.routes.ts\nimport { Hono } from \"npm:hono@3.12.12\";\n\nconst app = new Hono();\n\napp.post(\"/notion-webhook\", async (c) => {\n // At this point, webhook auth has already passed\n const body = await c.req.json();\n console.log(\"Notion webhook received:\", body);\n\n // Process the webhook...\n\n return c.json({ success: true });\n});\n\nexport default app;\n```\n\nTest with:\n\nPOST /tasks/notion-webhook\nHeaders: {\"X-API-KEY\": \"your-configured-secret-value\"}\nBody: {\"test\": \"data\"}\nExpected: 200 {\"success\": true}\n\n## Security Considerations\n\n- Webhook middleware should return early (success or failure) without calling next()\n- Never pass webhook requests to the global auth middleware\n- Maintain complete separation between webhook auth and user auth mechanisms\n- Consider rate limiting on /tasks endpoints\n- Use generic error messages that don't reveal authentication mechanism details\n\n## Route Structure\n\n- /tasks/\\* → Webhook auth required (Notion POSTs)\n- /api/\\* → User auth required (if applicable)\n- /\\* → Public routes (static files, etc.)\n\n## Key Changes Made:\n\n1. Added Environment Setup section with clear instructions for setting real values (without revealing actual values)\n1. Added Route Implementation Requirements emphasizing POST method requirement\n1. Added exact middleware application code to prevent ordering mistakes\n1. Added comprehensive testing steps with expected responses (using generic placeholders)\n1. Added debugging section with tools to troubleshoot issues\n1. Added complete working example to verify implementation against\n1. Emphasized critical points with bold text and warning boxes\n1. Added common mistakes and how to avoid them\n\nThese revisions address all the issues we encountered while keeping sensitive values generic and secure.\n",[],[156,196],[156],{"_108":206,"_100":207,"_157":208,"_159":-5,"_160":139,"_161":209,"_163":164,"_110":210,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":211,"_103":425},"da3b4072-618e-11f0-b6ae-0224a6c84d84","backend","fa558dab-08c8-4844-a27d-c8fb0f1669c4",584,["D",1752592662297],[212,238,253,364,388,403,418],{"_108":213,"_100":214,"_157":215,"_159":208,"_160":139,"_161":216,"_163":164,"_110":217,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":218,"_103":237},"f2b01d1c-618e-11f0-ac87-0224a6c84d84","controllers","22d59dd5-0f19-4864-a1e4-0f467d818090",590,["D",1752592703329],[219,227],{"_108":220,"_100":221,"_157":222,"_159":215,"_160":139,"_161":216,"_163":164,"_110":223,"_105":31,"_166":180,"_168":224,"_169":27,"_170":-5,"_171":225,"_103":226},"f2b01452-618e-11f0-ac87-0224a6c84d84","README.md","f2b01506-618e-11f0-ac87-0224a6c84d84",["D",1752592703329],"# Controllers\n\nBusiness logic coordination between routes and services.\n\n## Responsibilities\n\n- Business logic and orchestration between services\n- Handle environment variables and configuration\n- Coordinate multiple service calls\n- Implement business rules and validation\n- Handle service business logic layer (result.success)\n\n## Examples\n\n- `getHealthStatus()` - generate formatted health response for API\n- `validateConfiguredDatabases()` - check all configured databases",[],[207,214,221],{"_108":228,"_100":229,"_157":230,"_159":215,"_160":139,"_161":231,"_163":164,"_110":232,"_105":31,"_166":233,"_168":234,"_169":27,"_170":-5,"_171":235,"_103":236},"98057366-618f-11f0-8c3d-0224a6c84d84","health.controller.ts","9805741a-618f-11f0-8c3d-0224a6c84d84",601,["D",1752592980713],"script","import { getDatabaseById } from \"../services/notion.service.ts\";\n\nexport async function getConfiguredDatabases() {\n const demosDbId = Deno.env.get(\"GLANCE_DEMOS_DB_ID\");\n const contentDbId = Deno.env.get(\"GLANCE_CONTENT_DB_ID\");\n const interactionsDbId = Deno.env.get(\"GLANCE_INTERACTIONS_DB_ID\");\n\n const databases = { demos: null, content: null, interactions: null };\n const errors: string[] = [];\n\n // Check demos database\n if (demosDbId) {\n const result = await getDatabaseById(demosDbId);\n if (result.success) {\n databases.demos = result.data;\n } else {\n errors.push(`Demos DB: ${result.error}`);\n }\n } else {\n errors.push(\"GLANCE_DEMOS_DB_ID not configured\");\n }\n\n // Check content database\n if (contentDbId) {\n const result = await getDatabaseById(contentDbId);\n if (result.success) {\n databases.content = result.data;\n } else {\n errors.push(`Content DB: ${result.error}`);\n }\n } else {\n errors.push(\"GLANCE_CONTENT_DB_ID not configured\");\n }\n\n // Check interactions database\n if (interactionsDbId) {\n const result = await getDatabaseById(interactionsDbId);\n if (result.success) {\n databases.interactions = result.data;\n } else {\n errors.push(`Interactions DB: ${result.error}`);\n }\n } else {\n errors.push(\"GLANCE_INTERACTIONS_DB_ID not configured\");\n }\n\n return {\n success: errors.length === 0,\n data: databases,\n errors: errors.length > 0 ? errors : undefined,\n timestamp: new Date().toISOString(),\n };\n}\n\nexport async function getHealthStatus() {\n const configuredDatabases = await getConfiguredDatabases();\n \n const healthStatus = {\n status: configuredDatabases.success ? \"ok\" : \"error\",\n timestamp: new Date().toISOString(),\n service: \"glance-demos\",\n databases: {\n configured: configuredDatabases.success,\n demos: configuredDatabases.data.demos ? \"connected\" : \"error\",\n content: configuredDatabases.data.content ? \"connected\" : \"error\",\n interactions: configuredDatabases.data.interactions ? \"connected\" : \"error\"\n }\n };\n\n // Include errors if any exist\n if (configuredDatabases.errors) {\n healthStatus.errors = configuredDatabases.errors;\n }\n\n return healthStatus;\n}",[],[207,214,229],[207,214],{"_108":239,"_100":240,"_157":241,"_159":208,"_160":139,"_161":242,"_163":164,"_110":243,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":244,"_103":252},"f4f56c58-618e-11f0-ac87-0224a6c84d84","crons","7490f541-7db8-4101-bd14-c4957ea6eae9",591,["D",1752592707135],[245],{"_108":246,"_100":221,"_157":247,"_159":241,"_160":139,"_161":242,"_163":164,"_110":248,"_105":31,"_166":180,"_168":249,"_169":27,"_170":-5,"_171":250,"_103":251},"f4f55eca-618e-11f0-ac87-0224a6c84d84","f4f55fba-618e-11f0-ac87-0224a6c84d84",["D",1752592707135],"# Crons\n\nScheduled task handlers.\n\nContains functions that run on scheduled intervals to perform maintenance tasks, data synchronization, or other periodic operations.",[],[207,240,221],[207,240],{"_108":254,"_100":255,"_157":256,"_159":208,"_160":139,"_161":257,"_163":164,"_110":258,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":259,"_103":363},"dd7894e2-618e-11f0-839b-0224a6c84d84","routes","266c393e-a71a-45a4-add7-51cc5e29abaf",585,["D",1752592667732],[260,284,307,331,338,347,355],{"_108":261,"_100":262,"_157":263,"_159":256,"_160":139,"_161":264,"_163":164,"_110":265,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":266,"_103":283},"e08995a0-618e-11f0-8765-0224a6c84d84","api","a4010278-e64d-4b2a-a8f3-9469cb4d355b",586,["D",1752592672878],[267,274],{"_108":268,"_100":221,"_157":269,"_159":263,"_160":139,"_161":264,"_163":164,"_110":270,"_105":31,"_166":180,"_168":271,"_169":27,"_170":-5,"_171":272,"_103":273},"e0898eac-618e-11f0-8765-0224a6c84d84","e0898f6a-618e-11f0-8765-0224a6c84d84",["D",1752592672878],"# API Routes\n\nJSON API endpoints for frontend/backend communication.\n\nContains the `_api.routes.ts` file that mounts all API routes.",[],[207,255,262,221],{"_108":275,"_100":276,"_157":277,"_159":263,"_160":139,"_161":278,"_163":164,"_110":279,"_105":144,"_166":233,"_168":280,"_169":27,"_170":-5,"_171":281,"_103":282},"a2e22a90-618f-11f0-9c22-0224a6c84d84","_api.routes.ts","02c27538-618f-11f0-bd13-0224a6c84d84",602,["D",1752592998918],"import { Hono } from \"npm:hono@3.12.12\";\nimport { getHealthStatus } from \"../../controllers/health.controller.ts\";\n\nconst app = new Hono();\n\napp.get(\"/health\", async (c) => {\n const healthStatus = await getHealthStatus();\n return c.json(healthStatus);\n});\n\nexport default app;",[],[207,255,262,276],[207,255,262],{"_108":285,"_100":286,"_157":287,"_159":256,"_160":139,"_161":288,"_163":164,"_110":289,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":290,"_103":306},"e4a8ec44-618e-11f0-a768-0224a6c84d84","tasks","6ee80119-fbd4-4381-a575-1fcc478510d3",587,["D",1752592679794],[291,298],{"_108":292,"_100":221,"_157":293,"_159":287,"_160":139,"_161":288,"_163":164,"_110":294,"_105":31,"_166":180,"_168":295,"_169":27,"_170":-5,"_171":296,"_103":297},"e4a8e5c8-618e-11f0-a768-0224a6c84d84","e4a8e672-618e-11f0-a768-0224a6c84d84",["D",1752592679794],"# Task Routes\n\nWebhook handlers for Notion integrations.\n\nContains the `_tasks.routes.ts` file that mounts all webhook handlers.",[],[207,255,286,221],{"_108":299,"_100":300,"_157":301,"_159":287,"_160":139,"_161":138,"_163":164,"_110":302,"_105":144,"_166":233,"_168":303,"_169":27,"_170":-5,"_171":304,"_103":305},"0e064638-6192-11f0-b56a-0224a6c84d84","_tasks.routes.ts","0778b718-618f-11f0-8577-0224a6c84d84",["D",1752594037674],"import { Hono } from \"npm:hono@3.12.12\";\n\nconst app = new Hono();\n\n// Test endpoint for webhook authentication\napp.post(\"/test\", async (c) => {\n console.log(\"Test webhook endpoint reached successfully\");\n return c.json({ \n success: true, \n message: \"Webhook authentication successful\",\n timestamp: new Date().toISOString()\n });\n});\n\n// Main Notion webhook endpoint\napp.post(\"/notion-webhook\", async (c) => {\n // At this point, webhook auth has already passed\n const body = await c.req.json();\n console.log(\"Notion webhook received:\", body);\n\n // Process the webhook data here\n // Add your Notion webhook processing logic\n\n return c.json({ success: true });\n});\n\n// Debug endpoint to check webhook secret configuration\napp.get(\"/debug-webhook\", (c) => {\n const secret = Deno.env.get(\"NOTION_WEBHOOK_SECRET\");\n return c.json({\n hasSecret: !!secret,\n secretLength: secret?.length || 0,\n });\n});\n\n// Catch-all handler for undefined webhook endpoints\n// This must be the LAST route defined to catch unmatched paths\napp.post(\"*\", (c) => {\n const path = c.req.path;\n const method = c.req.method;\n const returnObj = {\n error: \"Endpoint not found\",\n path: path,\n method: method,\n availableEndpoints: [\n \"GET /tasks/debug-webhook\",\n \"POST /tasks/test\",\n \"POST /tasks/notion-webhook\",\n ],\n };\n console.log(returnObj);\n\n return c.json(returnObj, 404);\n});\n\nexport default app;",[],[207,255,286,300],[207,255,286],{"_108":308,"_100":309,"_157":310,"_159":256,"_160":139,"_161":311,"_163":164,"_110":312,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":313,"_103":330},"e7037bee-618e-11f0-8a6a-0224a6c84d84","views","76df6f9a-15fd-4b48-bda7-0d736d9f9c78",588,["D",1752592683743],[314,321],{"_108":315,"_100":221,"_157":316,"_159":310,"_160":139,"_161":311,"_163":164,"_110":317,"_105":31,"_166":180,"_168":318,"_169":27,"_170":-5,"_171":319,"_103":320},"e7037540-618e-11f0-8a6a-0224a6c84d84","e70375f4-618e-11f0-8a6a-0224a6c84d84",["D",1752592683743],"# View Routes\n\nServer-side rendered views for frontend.\n\nContains the `_views.routes.ts` file that mounts all view routes.",[],[207,255,309,221],{"_108":322,"_100":323,"_157":324,"_159":310,"_160":139,"_161":325,"_163":164,"_110":326,"_105":31,"_166":233,"_168":327,"_169":27,"_170":-5,"_171":328,"_103":329},"09e5930e-618f-11f0-b6ae-0224a6c84d84","_views.routes.ts","09e593d6-618f-11f0-b6ae-0224a6c84d84",598,["D",1752592742270],"import { Hono } from \"npm:hono@3.12.12\";\n\nconst app = new Hono();\n\n// TODO: Add routes here\n\nexport default app;",[],[207,255,309,323],[207,255,309],{"_108":332,"_100":221,"_157":333,"_159":256,"_160":139,"_161":257,"_163":164,"_110":334,"_105":31,"_166":180,"_168":335,"_169":27,"_170":-5,"_171":336,"_103":337},"dd78906e-618e-11f0-839b-0224a6c84d84","dd789118-618e-11f0-839b-0224a6c84d84",["D",1752592667732],"# Routes\n\nHTTP route handlers organized by functionality.\n\nEach route subdirectory should have a `_[directory_name].routes.ts` file that mounts routes for that section.\n\n## Responsibilities\n\n- HTTP request/response handling only\n- Call controllers, never services directly\n- Minimal logic - just HTTP concerns (parsing, validation, response formatting)\n- Example: parsing request params, calling controller, returning JSON",[],[207,255,221],{"_108":339,"_100":340,"_157":341,"_159":256,"_160":139,"_161":342,"_163":164,"_110":343,"_105":31,"_166":233,"_168":344,"_169":27,"_170":-5,"_171":345,"_103":346},"5bf0e6ca-6190-11f0-bb5d-0224a6c84d84","authCheck.ts","5bf0e76a-6190-11f0-bb5d-0224a6c84d84",604,["D",1752593309381],"// Public routes that don't require authentication\nconst PUBLIC_ROUTES = [\n \"/api/health\", // Health check endpoint\n // Add other public routes here as needed\n // '/demo/:id', // Example: public demo viewing\n // '/api/public', // Example: public API endpoints\n];\n\n// Helper function to check if a route is public\nfunction isPublicRoute(path: string): boolean {\n return PUBLIC_ROUTES.some((route) => {\n // Handle exact matches\n if (route === path) return true;\n\n // Handle wildcard patterns (basic implementation)\n if (route.includes(\"*\")) {\n const pattern = route.replace(\"*\", \".*\");\n return new RegExp(`^${pattern}$`).test(path);\n }\n\n // Handle route parameters (basic implementation)\n if (route.includes(\":\")) {\n const pattern = route.replace(/:[^/]+/g, \"[^/]+\");\n return new RegExp(`^${pattern}$`).test(path);\n }\n\n return false;\n });\n}\n\nexport default async (c, next) => {\n // Allow public routes to bypass authentication\n if (isPublicRoute(c.req.path)) {\n await next();\n return;\n }\n\n const email = c.req.header(\"X-LastLogin-Email\");\n\n if (!email) {\n // Show login page if not authenticated\n return c.html(`\n \n \n \n Glance Demo Platform - Login Required\n \n \n \n \n \n\n \n \n \n `);\n }\n\n // If authenticated, store email in context for use by routes\n c.set(\"userEmail\", email);\n\n // Continue to the next middleware/route\n await next();\n};",[],[207,255,340],{"_108":348,"_100":349,"_157":350,"_159":256,"_160":139,"_161":342,"_163":164,"_110":351,"_105":31,"_166":233,"_168":352,"_169":27,"_170":-5,"_171":353,"_103":354},"5bf0f944-6190-11f0-bb5d-0224a6c84d84","dashboard.tsx","5bf0f9d0-6190-11f0-bb5d-0224a6c84d84",["D",1752593309381],"export default async (c) => {\n const userEmail = c.get(\"userEmail\");\n \n // Fetch health endpoint data to display on dashboard\n let healthData = null;\n let healthError = null;\n \n try {\n const healthResponse = await fetch(`${c.req.url.split('/')[0]}//${c.req.url.split('/')[2]}/api/health`);\n if (healthResponse.ok) {\n healthData = await healthResponse.json();\n } else {\n healthError = `Health check failed with status: ${healthResponse.status}`;\n }\n } catch (error) {\n healthError = `Health check error: ${error.message}`;\n }\n\n return c.html(`\n \n \n \n Glance Demo Platform - Dashboard\n \n \n \n \n

\n \n \n

Welcome back!

${userEmail}

\n \n

\n Your personalized demo platform is ready. Manage your demos, track interactions, and analyze performance all in one place.\n

\n \n

System Health

\n ${healthError ? \n `Error: ${healthError}` : \n `

${JSON.stringify(healthData, null, 2)}

`\n }\n

\n View Health Endpoint →\n

\n \n \n `);\n};",[],[207,255,349],{"_108":356,"_100":357,"_157":358,"_159":256,"_160":139,"_161":138,"_163":164,"_110":359,"_105":31,"_166":233,"_168":360,"_169":27,"_170":-5,"_171":361,"_103":362},"0e063328-6192-11f0-b56a-0224a6c84d84","webhookAuthCheck.ts","0e0633be-6192-11f0-b56a-0224a6c84d84",["D",1752594037674],"/**\n * Webhook Authentication Middleware\n * \n * Validates X-API-KEY header against NOTION_WEBHOOK_SECRET environment variable\n * for all /tasks/* routes (Notion webhook endpoints)\n */\n\n// Constant-time comparison to prevent timing attacks\nfunction constantTimeCompare(a: string, b: string): boolean {\n if (a.length !== b.length) {\n return false;\n }\n \n let result = 0;\n for (let i = 0; i < a.length; i++) {\n result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n \n return result === 0;\n}\n\nexport default async (c, next) => {\n const apiKey = c.req.header(\"X-API-KEY\");\n const webhookSecret = Deno.env.get(\"NOTION_WEBHOOK_SECRET\");\n\n // Log the authentication attempt for monitoring\n console.log(`Webhook auth attempt for ${c.req.path} - Key provided: ${!!apiKey}`);\n\n // Check if API key is provided\n if (!apiKey) {\n console.log(\"Webhook auth failed: No X-API-KEY header provided\");\n return c.json({ error: \"Authentication required\" }, 401);\n }\n\n // Check if webhook secret is configured\n if (!webhookSecret) {\n console.error(\"NOTION_WEBHOOK_SECRET environment variable not configured\");\n return c.json({ error: \"Authentication failed\" }, 403);\n }\n\n // Perform constant-time comparison to prevent timing attacks\n if (!constantTimeCompare(apiKey, webhookSecret)) {\n console.log(\"Webhook auth failed: Invalid X-API-KEY\");\n return c.json({ error: \"Authentication failed\" }, 403);\n }\n\n console.log(\"Webhook auth successful\");\n \n // Authentication successful, continue to route handler\n await next();\n};",[],[207,255,357],[207,255],{"_108":365,"_100":366,"_157":367,"_159":208,"_160":139,"_161":368,"_163":164,"_110":369,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":370,"_103":387},"ef5de7de-618e-11f0-8e78-0224a6c84d84","services","c4ad05a7-294e-44ba-9135-3eabff4ab8cd",589,["D",1752592697751],[371,378],{"_108":372,"_100":221,"_157":373,"_159":367,"_160":139,"_161":368,"_163":164,"_110":374,"_105":31,"_166":180,"_168":375,"_169":27,"_170":-5,"_171":376,"_103":377},"ef5dde7e-618e-11f0-8e78-0224a6c84d84","ef5ddf1e-618e-11f0-8e78-0224a6c84d84",["D",1752592697751],"# Services\n\nExternal API integrations (pure API calls only).\n\n## Responsibilities\n\n- Single-purpose functions that make direct API calls to external systems\n- Pure functions that handle HTTP transport layer (response.ok)\n- Should NOT handle environment variables, business logic, or orchestrate multiple calls\n- Return consistent `{ success: boolean, data?: any, error?: string }` format\n\n## Examples\n\n- `getDatabaseById(id)` - retrieve specific database from Notion\n- `searchNotionDatabases()` - search for all databases",[],[207,366,221],{"_108":379,"_100":380,"_157":381,"_159":367,"_160":139,"_161":382,"_163":164,"_110":383,"_105":31,"_166":233,"_168":384,"_169":27,"_170":-5,"_171":385,"_103":386},"809d2796-618f-11f0-b48d-0224a6c84d84","notion.service.ts","809d2890-618f-11f0-b48d-0224a6c84d84",600,["D",1752592941441],"import { Client } from \"npm:@notionhq/client\";\n\nconst notion = new Client({ auth: Deno.env.get(\"NOTION_API_KEY\") });\n\nexport async function getDatabases() {\n try {\n const response = await notion.search({\n filter: {\n property: \"object\",\n value: \"database\"\n }\n });\n return {\n success: true,\n data: response,\n timestamp: new Date().toISOString(),\n };\n } catch (error) {\n return {\n success: false,\n error: error.message,\n timestamp: new Date().toISOString(),\n };\n }\n}\n\nexport async function getDatabaseById(databaseId: string) {\n try {\n const response = await notion.databases.retrieve({\n database_id: databaseId,\n });\n return {\n success: true,\n data: response,\n timestamp: new Date().toISOString(),\n };\n } catch (error) {\n return {\n success: false,\n error: error.message,\n timestamp: new Date().toISOString(),\n };\n }\n}",[],[207,366,380],[207,366],{"_108":389,"_100":390,"_157":391,"_159":208,"_160":139,"_161":392,"_163":164,"_110":393,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":394,"_103":402},"f6f3358a-618e-11f0-90c2-0224a6c84d84","types","5b9f69d1-befe-424f-87a7-48dde30d5608",592,["D",1752592710480],[395],{"_108":396,"_100":221,"_157":397,"_159":391,"_160":139,"_161":392,"_163":164,"_110":398,"_105":31,"_166":180,"_168":399,"_169":27,"_170":-5,"_171":400,"_103":401},"f6f32ed2-618e-11f0-90c2-0224a6c84d84","f6f32f5e-618e-11f0-90c2-0224a6c84d84",["D",1752592710480],"# Types\n\nShared TypeScript type definitions.\n\nContains interfaces, types, and type definitions used across the backend application.",[],[207,390,221],[207,390],{"_108":404,"_100":405,"_157":406,"_159":208,"_160":139,"_161":407,"_163":164,"_110":408,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":409,"_103":417},"f8f2eed4-618e-11f0-90c2-0224a6c84d84","utils","d18f0a88-3891-4880-b556-360682e95b93",593,["D",1752592713833],[410],{"_108":411,"_100":221,"_157":412,"_159":406,"_160":139,"_161":407,"_163":164,"_110":413,"_105":31,"_166":180,"_168":414,"_169":27,"_170":-5,"_171":415,"_103":416},"f8f2e8b2-618e-11f0-90c2-0224a6c84d84","f8f2e970-618e-11f0-90c2-0224a6c84d84",["D",1752592713833],"# Utils\n\nCommon utility functions.\n\nContains helper functions and utilities used across the backend application.",[],[207,405,221],[207,405],{"_108":419,"_100":221,"_157":420,"_159":208,"_160":139,"_161":209,"_163":164,"_110":421,"_105":31,"_166":180,"_168":422,"_169":27,"_170":-5,"_171":423,"_103":424},"da3b35fa-618e-11f0-b6ae-0224a6c84d84","da3b36d6-618e-11f0-b6ae-0224a6c84d84",["D",1752592662297],"# Backend\n\nThis directory contains all backend code organized by functionality.\n\n## Directory Structure\n\n- `/routes` - HTTP route handlers organized by functionality\n- `/api` - JSON API endpoints for frontend/backend communication \n- `/tasks` - Webhook handlers for Notion integrations\n- `/views` - Server-side rendered views for frontend\n- `/services` - External API integrations (pure API calls only)\n- `/controllers` - Business logic coordination between routes and services\n- `/crons` - Scheduled task handlers\n- `/types` - Shared TypeScript type definitions\n- `/utils` - Common utility functions\n\n## Architecture\n\nThis follows a strict layered architecture:\n- **Routes**: HTTP request/response handling only\n- **Controllers**: Business logic and orchestration between services\n- **Services**: Single-purpose functions that make direct API calls to external systems",[],[207,221],[207],{"_108":427,"_100":428,"_157":429,"_159":-5,"_160":139,"_161":430,"_163":164,"_110":431,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":432,"_103":440},"fd9d97c2-618e-11f0-9be1-0224a6c84d84","frontend","84df6377-2865-4f5e-b66c-f64c8ad2ad6f",594,["D",1752592721658],[433],{"_108":434,"_100":221,"_157":435,"_159":429,"_160":139,"_161":430,"_163":164,"_110":436,"_105":31,"_166":180,"_168":437,"_169":27,"_170":-5,"_171":438,"_103":439},"fd9d8fde-618e-11f0-9be1-0224a6c84d84","fd9d9092-618e-11f0-9be1-0224a6c84d84",["D",1752592721658],"# Frontend\n\nClient-side files that render in the browser.\n\nContains all frontend assets, components, and client-side logic.",[],[428,221],[428],{"_108":442,"_100":443,"_157":444,"_159":-5,"_160":139,"_161":445,"_163":164,"_110":446,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":447,"_103":455},"ffd4f5b2-618e-11f0-bf4f-0224a6c84d84","shared","73dc3647-05e9-49f3-9561-846c06936131",595,["D",1752592725380],[448],{"_108":449,"_100":221,"_157":450,"_159":444,"_160":139,"_161":445,"_163":164,"_110":451,"_105":31,"_166":180,"_168":452,"_169":27,"_170":-5,"_171":453,"_103":454},"ffd4ebee-618e-11f0-bf4f-0224a6c84d84","ffd4ecc0-618e-11f0-bf4f-0224a6c84d84",["D",1752592725380],"# Shared\n\nFiles used by both backend and frontend.\n\nContains utilities, types, and functions that are shared between the client and server environments.",[],[443,221],[443],{"_108":457,"_100":458,"_157":459,"_159":-5,"_160":139,"_161":460,"_163":164,"_110":461,"_105":31,"_166":180,"_168":462,"_169":27,"_170":-5,"_171":463,"_103":464},"42924f46-60c5-11f0-94c6-0224a6c84d84",".vtignore","4292500e-60c5-11f0-94c6-0224a6c84d84",4,["D",1752506078934],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor\nvars.env\n",[],[458],{"_108":466,"_100":221,"_157":467,"_159":-5,"_160":139,"_161":138,"_163":164,"_110":468,"_105":469,"_166":180,"_168":470,"_169":27,"_170":-5,"_171":471,"_103":472},"0e0638dc-6192-11f0-b56a-0224a6c84d84","2e109c08-60ca-11f0-9855-0224a6c84d84",["D",1752594037674],7,"# Glance Demo Platform\n\nA personalized demo platform that integrates with Notion to manage demo content, track interactions, and provide analytics.\n\n## Architecture\n\n- **Backend**: Hono-based API with modular services\n- **Frontend**: React-based dashboard for demo management\n- **Database**: Notion databases for demos, content, and interactions\n- **Authentication**: \n - Google OAuth via LastLogin for user access\n - X-API-KEY header authentication for webhook endpoints\n- **Caching**: Blob storage for performance optimization\n- **Cron Jobs**: Automated data synchronization\n- **Webhooks**: Notion webhook integration for real-time updates\n\n## Environment Variables Required\n\nAdd these to your `vars.env` file and import them in Val Town:\n\n- `NOTION_API_KEY` - Your Notion integration API key\n- `GLANCE_DEMOS_DB_ID` - Notion database ID for demos\n- `GLANCE_CONTENT_DB_ID` - Notion database ID for demo content\n- `GLANCE_INTERACTIONS_DB_ID` - Notion database ID for interactions\n- `NOTION_WEBHOOK_SECRET` - Secret key for authenticating Notion webhooks\n\n## Directory Structure\n\n```\n├── backend/\n│ ├── controllers/ # Request handlers and business logic\n│ ├── crons/ # Scheduled tasks\n│ ├── routes/ # API route definitions\n│ ├── services/ # External service integrations (Notion)\n│ ├── types/ # TypeScript type definitions\n│ └── utils/ # Utility functions\n├── frontend/\n│ ├── components/ # React components\n│ └── index.html # Main HTML template\n├── shared/ # Code shared between frontend and backend\n└── main.tsx # Main application entry point\n```\n\n## API Endpoints\n\n### Demos\n- `POST /api/demos` - Create a new demo\n- `GET /api/demos` - List all demos\n- `GET /api/demos/:id` - Get demo details\n- `GET /api/demos/:id/full` - Get demo with content and interactions\n\n### Content\n- `POST /api/content` - Create demo content\n- `GET /api/demos/:demoId/content` - Get content for a demo\n\n### Interactions\n- `POST /api/interactions` - Track user interaction\n- `GET /api/demos/:demoId/interactions` - Get interactions for a demo\n\n### Webhooks (Notion Integration)\n- `POST /tasks/notion-webhook` - Notion webhook endpoint (requires X-API-KEY header)\n- `POST /tasks/test` - Test webhook authentication\n- `GET /tasks/debug-webhook` - Debug webhook configuration (requires X-API-KEY header)\n\n## Service Response Pattern\n\nThe application uses a consistent two-layer response handling:\n\n1. **HTTP Transport Layer** (`response.ok`) - For external API calls\n2. **Service Business Logic** (`result.success`) - For internal service responses\n\nThis provides clear separation between network issues and business logic failures.\n\n## Features\n\n- ✅ Demo creation and management\n- ✅ Content management system\n- ✅ Interaction tracking and analytics\n- ✅ Caching layer for performance\n- ✅ React-based dashboard\n- ✅ Automated data synchronization\n- ✅ Notion integration\n- ✅ Google OAuth authentication via LastLogin\n- ✅ Webhook authentication for Notion integration\n- ✅ Dual authentication system (user auth + webhook auth)\n\n## Getting Started\n\n1. Set up your Notion integration and databases\n2. Configure environment variables\n3. Deploy to Val Town\n4. Access the dashboard at your Val's URL (authentication required)\n5. Sign in with Google via LastLogin\n6. Create demos and share them with prospects\n\n## Demo Viewer\n\nProspects can view demos at `/demo/:id` which automatically tracks pageviews and provides an interactive experience.\n\n## Cron Jobs\n\n- **Demo Sync** (`/backend/crons/sync-demos.ts`) - Syncs demo data and updates cache (configure schedule in Val Town UI)\n\n## Development\n\nThe application follows Val Town best practices:\n- Uses Hono for API routing\n- Implements proper error handling\n- Uses blob storage for caching\n- Follows TypeScript conventions\n- Separates concerns with modular architecture\n\n## Webhook Authentication\n\nThe application implements a dual authentication system:\n\n### User Authentication (Google OAuth)\n- Applied to: `/`, `/api/*`, `/views/*`\n- Uses LastLogin for Google OAuth\n- Shows login page for unauthenticated users\n\n### Webhook Authentication (X-API-KEY)\n- Applied to: `/tasks/*` routes only\n- Uses `X-API-KEY` header with `NOTION_WEBHOOK_SECRET` environment variable\n- Constant-time comparison to prevent timing attacks\n- Returns 401/403 for authentication failures\n\n### Testing Webhook Authentication\n\n1. **Test without header** (should fail):\n ```bash\n POST /tasks/test\n Expected: 401 \"Authentication required\"\n ```\n\n2. **Test with wrong key** (should fail):\n ```bash\n POST /tasks/test\n Headers: {\"X-API-KEY\": \"wrong-key\"}\n Expected: 403 \"Authentication failed\"\n ```\n\n3. **Test with correct key** (should succeed):\n ```bash\n POST /tasks/test\n Headers: {\"X-API-KEY\": \"your-configured-secret-value\"}\n Expected: 200 (success response)\n ```\n\n### Middleware Order\n\nThe middleware is applied in this specific order:\n1. Webhook auth for `/tasks/*` routes\n2. User auth for `/api/*`, `/views/*`, and `/` routes\n3. Route handlers\n\nThis ensures complete separation between webhook and user authentication systems.",[],[221],{"_108":474,"_100":475,"_157":476,"_159":-5,"_160":139,"_161":477,"_163":164,"_110":478,"_105":31,"_166":180,"_168":479,"_169":27,"_170":-5,"_171":480,"_103":481},"4285f2fa-60c5-11f0-9f19-0224a6c84d84","deno.json","4285f3e0-60c5-11f0-9f19-0224a6c84d84",2,["D",1752506078931],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\n \"https://www.val.town/types/valtown.d.ts\"\n ],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"files\": {\n \"include\": [\n \"deno:/https/esm.town/**/*\"\n ]\n },\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\"\n ]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}",[],[475],{"_108":483,"_100":484,"_157":485,"_159":-5,"_160":139,"_161":138,"_163":164,"_110":486,"_105":487,"_166":488,"_168":489,"_169":27,"_170":-5,"_171":490,"_103":491},"0e064836-6192-11f0-b56a-0224a6c84d84","main.tsx","2392e53f-63fc-4a79-9e0f-8da0aa4e8a41",["D",1752594037674],69,"http","import { Hono } from \"npm:hono@3.12.12\";\nimport { lastlogin } from \"https://esm.town/v/stevekrouse/lastlogin_safe\";\n\n// Import route modules\nimport apiRoutes from \"./backend/routes/api/_api.routes.ts\";\nimport taskRoutes from \"./backend/routes/tasks/_tasks.routes.ts\";\nimport viewRoutes from \"./backend/routes/views/_views.routes.ts\";\nimport authCheck from \"./backend/routes/authCheck.ts\";\nimport webhookAuth from \"./backend/routes/webhookAuthCheck.ts\";\nimport dashboardRoute from \"./backend/routes/dashboard.tsx\";\n\nconst app = new Hono();\n\n// Unwrap Hono errors to see original error details\napp.onError((err, c) => {\n throw err;\n});\n\n// 1. Webhook auth - ONLY for /tasks/* routes\napp.use(\"/tasks/*\", webhookAuth);\n\n// 2. User auth - for ALL routes EXCEPT /tasks/*\napp.use(\"/api/*\", authCheck);\napp.use(\"/views/*\", authCheck);\napp.use(\"/\", authCheck);\n\n// Add dashboard route - now serves the authenticated dashboard\napp.get(\"/\", dashboardRoute);\n\n// 3. Mount routes AFTER middleware\napp.route(\"/api\", apiRoutes);\napp.route(\"/tasks\", taskRoutes);\napp.route(\"/views\", viewRoutes);\n\n// Main HTTP handler\nasync function handler(request: Request): Promise {\n return app.fetch(request);\n}\n\n// Wrap and export the main HTTP handler with lastlogin\nexport default lastlogin(handler);\n",[],[484],"files",[154,173,184,194,205,212,219,227,238,245,253,260,267,274,284,291,298,307,314,321,331,338,347,355,364,371,378,388,395,403,410,418,426,433,441,448,456,465,473,482],"counts",{"_496":31,"_497":477,"_498":31,"_499":500},"pulls","branches","forks","envVars",5,"contents",[],{"_108":372,"_100":221,"_157":373,"_159":367,"_160":139,"_161":368,"_163":164,"_110":504,"_105":31,"_166":180,"_168":375,"_169":27,"_170":-5,"_103":505},["D",1752592697751],[207,366,221],"upstreamProject",{"_108":508,"_100":101,"_116":-5,"_117":-5,"_114":146,"_21":509},"9e8f7a6c-60bb-11f0-88ba-0224a6c84d84",{"_98":510,"_134":511},"glance","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJ4Z0tGaEdPSVVibDJHOVVJdncyM0ZWUnBleiJ9","upstreamBranch",{"_108":142,"_110":514,"_515":516,"_100":42,"_140":508,"_105":144,"_141":-5,"_143":-5,"_517":-5,"_112":-5,"_151":27,"_114":146,"_150":510,"_149":101},["D",1752501938378],"updatedAt",["D",1752501938395],"lockfileKey","emptyEnvVars","isNew","routes/_app.x.$handle.$name.code.$",{"_98":99,"_100":101,"_102":42,"_105":-7,"_103":104,"_106":522,"_152":526,"_492":647,"_180":648,"_501":650,"_651":652,"_655":27,"_656":-5,"_657":342,"_658":31,"_659":660},{"_108":109,"_100":101,"_110":523,"_112":-5,"_113":27,"_114":115,"_116":-5,"_117":-5,"_12":118,"_119":-5,"_120":27,"_121":-5,"_122":31,"_14":123,"_124":125,"_126":125,"_127":128,"_129":128,"_130":128,"_131":125,"_132":125,"_21":524,"_136":525,"_151":27},["D",1752503815980],{"_98":99,"_134":135},{"_105":138,"_100":42,"_108":139,"_140":109,"_141":142,"_143":144,"_145":146,"_147":148,"_149":101,"_150":99},[527,539,623,629,635,638,641,644],{"_108":155,"_100":156,"_157":158,"_159":-5,"_160":139,"_161":162,"_163":164,"_110":165,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":528,"_103":538},[529,532,535],{"_108":174,"_100":175,"_157":176,"_159":158,"_160":139,"_161":177,"_163":164,"_110":178,"_105":179,"_166":180,"_168":181,"_169":27,"_170":-5,"_171":530,"_103":531},[],[156,175],{"_108":185,"_100":186,"_157":187,"_159":158,"_160":139,"_161":188,"_163":164,"_110":189,"_105":190,"_166":180,"_168":191,"_169":27,"_170":-5,"_171":533,"_103":534},[],[156,186],{"_108":195,"_100":196,"_157":197,"_159":158,"_160":139,"_161":198,"_163":164,"_110":199,"_105":200,"_166":180,"_168":201,"_169":27,"_170":-5,"_171":536,"_103":537},[],[156,196],[156],{"_108":206,"_100":207,"_157":208,"_159":-5,"_160":139,"_161":209,"_163":164,"_110":210,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":540,"_103":622},[541,550,556,598,607,613,619],{"_108":213,"_100":214,"_157":215,"_159":208,"_160":139,"_161":216,"_163":164,"_110":217,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":542,"_103":549},[543,546],{"_108":220,"_100":221,"_157":222,"_159":215,"_160":139,"_161":216,"_163":164,"_110":223,"_105":31,"_166":180,"_168":224,"_169":27,"_170":-5,"_171":544,"_103":545},[],[207,214,221],{"_108":228,"_100":229,"_157":230,"_159":215,"_160":139,"_161":231,"_163":164,"_110":232,"_105":31,"_166":233,"_168":234,"_169":27,"_170":-5,"_171":547,"_103":548},[],[207,214,229],[207,214],{"_108":239,"_100":240,"_157":241,"_159":208,"_160":139,"_161":242,"_163":164,"_110":243,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":551,"_103":555},[552],{"_108":246,"_100":221,"_157":247,"_159":241,"_160":139,"_161":242,"_163":164,"_110":248,"_105":31,"_166":180,"_168":249,"_169":27,"_170":-5,"_171":553,"_103":554},[],[207,240,221],[207,240],{"_108":254,"_100":255,"_157":256,"_159":208,"_160":139,"_161":257,"_163":164,"_110":258,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":557,"_103":597},[558,567,576,585,588,591,594],{"_108":261,"_100":262,"_157":263,"_159":256,"_160":139,"_161":264,"_163":164,"_110":265,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":559,"_103":566},[560,563],{"_108":268,"_100":221,"_157":269,"_159":263,"_160":139,"_161":264,"_163":164,"_110":270,"_105":31,"_166":180,"_168":271,"_169":27,"_170":-5,"_171":561,"_103":562},[],[207,255,262,221],{"_108":275,"_100":276,"_157":277,"_159":263,"_160":139,"_161":278,"_163":164,"_110":279,"_105":144,"_166":233,"_168":280,"_169":27,"_170":-5,"_171":564,"_103":565},[],[207,255,262,276],[207,255,262],{"_108":285,"_100":286,"_157":287,"_159":256,"_160":139,"_161":288,"_163":164,"_110":289,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":568,"_103":575},[569,572],{"_108":292,"_100":221,"_157":293,"_159":287,"_160":139,"_161":288,"_163":164,"_110":294,"_105":31,"_166":180,"_168":295,"_169":27,"_170":-5,"_171":570,"_103":571},[],[207,255,286,221],{"_108":299,"_100":300,"_157":301,"_159":287,"_160":139,"_161":138,"_163":164,"_110":302,"_105":144,"_166":233,"_168":303,"_169":27,"_170":-5,"_171":573,"_103":574},[],[207,255,286,300],[207,255,286],{"_108":308,"_100":309,"_157":310,"_159":256,"_160":139,"_161":311,"_163":164,"_110":312,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":577,"_103":584},[578,581],{"_108":315,"_100":221,"_157":316,"_159":310,"_160":139,"_161":311,"_163":164,"_110":317,"_105":31,"_166":180,"_168":318,"_169":27,"_170":-5,"_171":579,"_103":580},[],[207,255,309,221],{"_108":322,"_100":323,"_157":324,"_159":310,"_160":139,"_161":325,"_163":164,"_110":326,"_105":31,"_166":233,"_168":327,"_169":27,"_170":-5,"_171":582,"_103":583},[],[207,255,309,323],[207,255,309],{"_108":332,"_100":221,"_157":333,"_159":256,"_160":139,"_161":257,"_163":164,"_110":334,"_105":31,"_166":180,"_168":335,"_169":27,"_170":-5,"_171":586,"_103":587},[],[207,255,221],{"_108":339,"_100":340,"_157":341,"_159":256,"_160":139,"_161":342,"_163":164,"_110":343,"_105":31,"_166":233,"_168":344,"_169":27,"_170":-5,"_171":589,"_103":590},[],[207,255,340],{"_108":348,"_100":349,"_157":350,"_159":256,"_160":139,"_161":342,"_163":164,"_110":351,"_105":31,"_166":233,"_168":352,"_169":27,"_170":-5,"_171":592,"_103":593},[],[207,255,349],{"_108":356,"_100":357,"_157":358,"_159":256,"_160":139,"_161":138,"_163":164,"_110":359,"_105":31,"_166":233,"_168":360,"_169":27,"_170":-5,"_171":595,"_103":596},[],[207,255,357],[207,255],{"_108":365,"_100":366,"_157":367,"_159":208,"_160":139,"_161":368,"_163":164,"_110":369,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":599,"_103":606},[600,603],{"_108":372,"_100":221,"_157":373,"_159":367,"_160":139,"_161":368,"_163":164,"_110":374,"_105":31,"_166":180,"_168":375,"_169":27,"_170":-5,"_171":601,"_103":602},[],[207,366,221],{"_108":379,"_100":380,"_157":381,"_159":367,"_160":139,"_161":382,"_163":164,"_110":383,"_105":31,"_166":233,"_168":384,"_169":27,"_170":-5,"_171":604,"_103":605},[],[207,366,380],[207,366],{"_108":389,"_100":390,"_157":391,"_159":208,"_160":139,"_161":392,"_163":164,"_110":393,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":608,"_103":612},[609],{"_108":396,"_100":221,"_157":397,"_159":391,"_160":139,"_161":392,"_163":164,"_110":398,"_105":31,"_166":180,"_168":399,"_169":27,"_170":-5,"_171":610,"_103":611},[],[207,390,221],[207,390],{"_108":404,"_100":405,"_157":406,"_159":208,"_160":139,"_161":407,"_163":164,"_110":408,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":614,"_103":618},[615],{"_108":411,"_100":221,"_157":412,"_159":406,"_160":139,"_161":407,"_163":164,"_110":413,"_105":31,"_166":180,"_168":414,"_169":27,"_170":-5,"_171":616,"_103":617},[],[207,405,221],[207,405],{"_108":419,"_100":221,"_157":420,"_159":208,"_160":139,"_161":209,"_163":164,"_110":421,"_105":31,"_166":180,"_168":422,"_169":27,"_170":-5,"_171":620,"_103":621},[],[207,221],[207],{"_108":427,"_100":428,"_157":429,"_159":-5,"_160":139,"_161":430,"_163":164,"_110":431,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":624,"_103":628},[625],{"_108":434,"_100":221,"_157":435,"_159":429,"_160":139,"_161":430,"_163":164,"_110":436,"_105":31,"_166":180,"_168":437,"_169":27,"_170":-5,"_171":626,"_103":627},[],[428,221],[428],{"_108":442,"_100":443,"_157":444,"_159":-5,"_160":139,"_161":445,"_163":164,"_110":446,"_105":31,"_166":167,"_168":-5,"_169":27,"_170":-5,"_171":630,"_103":634},[631],{"_108":449,"_100":221,"_157":450,"_159":444,"_160":139,"_161":445,"_163":164,"_110":451,"_105":31,"_166":180,"_168":452,"_169":27,"_170":-5,"_171":632,"_103":633},[],[443,221],[443],{"_108":457,"_100":458,"_157":459,"_159":-5,"_160":139,"_161":460,"_163":164,"_110":461,"_105":31,"_166":180,"_168":462,"_169":27,"_170":-5,"_171":636,"_103":637},[],[458],{"_108":466,"_100":221,"_157":467,"_159":-5,"_160":139,"_161":138,"_163":164,"_110":468,"_105":469,"_166":180,"_168":470,"_169":27,"_170":-5,"_171":639,"_103":640},[],[221],{"_108":474,"_100":475,"_157":476,"_159":-5,"_160":139,"_161":477,"_163":164,"_110":478,"_105":31,"_166":180,"_168":479,"_169":27,"_170":-5,"_171":642,"_103":643},[],[475],{"_108":483,"_100":484,"_157":485,"_159":-5,"_160":139,"_161":138,"_163":164,"_110":486,"_105":487,"_166":488,"_168":489,"_169":27,"_170":-5,"_171":645,"_103":646},[],[484],[527,529,532,535,539,541,543,546,550,552,556,558,560,563,567,569,572,576,578,581,585,588,591,594,598,600,603,607,609,613,615,619,623,625,629,631,635,638,641,644],{"_108":372,"_100":221,"_157":373,"_159":367,"_160":139,"_161":368,"_163":164,"_110":504,"_105":31,"_166":180,"_168":375,"_169":27,"_170":-5,"_103":649},[207,366,221],[],"upstream",{"_108":142,"_110":653,"_515":654,"_100":42,"_140":508,"_105":144,"_141":-5,"_143":-5,"_517":-5,"_112":-5,"_151":27,"_114":146,"_150":510,"_149":101},["D",1752501938378],["D",1752501938395],"showCompareCallout","pull","ahead","behind","templates",[],"routes/_app","actionData","errors"]

Welcome

Sign in

Sign in to Glance

Glance Demo Platform

Welcome back!

System Health