[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_168":169,"_170":171},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_127":-5,"_20":128,"_22":129,"_130":131,"_132":133,"_25":134,"_24":-5,"_135":-5,"_136":-5,"_137":54,"_138":139,"_140":45,"_141":-5,"_142":-5,"_143":144},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","maxm","name","userspaceAuth","branchName","main","version","path","","project",{"_34":74,"_13":14,"_46":75,"_76":-5,"_77":45,"_78":79,"_80":79,"_81":-5,"_82":-5,"_83":84,"_85":38,"_86":45,"_87":-5,"_88":-5,"_89":62,"_90":91,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_105":106,"_107":108,"_109":110,"_111":54},"tree",[65,66],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_18":64},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":56},"id","f25ff218-252c-11f0-8a67-569c3dd06744","main.tsx","fileId","efcd5cac-252c-11f0-8a67-569c3dd06744","parentId","branchId","efcab29a-252c-11f0-8a67-569c3dd06744","branchVersion",129,"latest",true,"createdAt",["D",1712512323414],128,"fileType","http","content","/** @jsxImportSource https://esm.sh/preact */\nimport { blob } from \"https://esm.town/v/std/blob\";\n// import * as opaque from \"npm:@cloudflare/opaque-ts\";\nimport { Hono } from \"npm:hono@3\";\nimport { render } from \"npm:preact-render-to-string\";\n\nconst resp = (content, status) =>\n new Response(render(content), {\n status,\n headers: {\n \"Content-Type\": \"text/html\",\n },\n });\n\nconst trimSuffix = (s: string, suffix: string): string => {\n if (!s.endsWith(suffix)) {\n return s;\n }\n return s.slice(0, s.length - suffix.length);\n};\n\nconst getPassword = async (): Promise => {\n try {\n let resp = await blob.get(PASSWORD_BLOB_KEY);\n return await resp.text();\n } catch (e) {\n return undefined;\n }\n};\n\nconst KNOWN_HOSTNAME = \".web.val.run\";\nconst PASSWORD_BLOB_KEY = \"password\"; // hah\n\nconst app = new Hono();\napp.get(\"/\", async (c) => {\n const password = await getPassword();\n const u = new URL(c.req.url);\n if (!u.host.endsWith(KNOWN_HOSTNAME)) {\n return resp((

Hostname does not end with {KNOWN_HOSTNAME}, cannot continue

), 400);\n }\n const userAndValName = trimSuffix(u.host, KNOWN_HOSTNAME);\n const [username, valName] = userAndValName.split(\"-\");\n if (username === \"\") {\n return resp((

Username not found

), 400);\n }\n if (valName !== \"userspaceauth\") {\n return resp((

Val must be called \"userspaceAuth\"

), 400);\n }\n\n let content = password\n ?

Your password has been set up and this val is ready to authenticate requests for you

\n : (\n \n );\n\n return resp(\n (<>\n

Username: {username}

Val Name: {valName}

{content}

\n ),\n 200,\n );\n});\n\napp.post(\"/\", async (c) => {\n const fd = await c.req.formData();\n const password = fd.get(\"password\");\n // TODO: more validation\n if (typeof password !== \"string\" || password.length < 8) {\n return resp((

Invalid password!

), 400);\n }\n await blob.set(PASSWORD_BLOB_KEY, \"password\");\n return c.redirect(\"/\");\n});\napp.get(\"/reset\", async (c) => {\n // TODO: this can be abused\n await blob.delete(PASSWORD_BLOB_KEY);\n});\napp.post(\"/validate\", async (c) => {\n const realPassword = await getPassword();\n const fd = await c.req.formData();\n const password = fd.get(\"password\");\n const match = password === realPassword;\n return c.json(match, match ? 200 : 401);\n});\napp.get(\"/validate/:password\", async (c) => {\n const realPassword = await getPassword();\n const password = c.req.param(\"password\");\n const match = password === realPassword;\n return c.json(match, match ? 200 : 401);\n});\nexport default app.fetch;\n\n// console.log(await opaque.getOpaqueConfig(opaque.OpaqueID.OPAQUE_P521).ake.generateAuthKeyPair());","deleted",false,"label",[36],"efcd61ca-252c-11f0-8a67-569c3dd06744","README.md","efcd6242-252c-11f0-8a67-569c3dd06744",1,["D",1712507041560],0,"null\n\nMigrated from folder: userspaceauth/userspaceAuth",[58],{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_68":72,"_18":73},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":69,"_18":70},["D",1712512323414],"children",[],[36],["D",1712507041560],[],[58],"efca5610-252c-11f0-8a67-569c3dd06744",["D",1745953538026],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","418c1e39-eb48-4f2f-8c97-122ece94631c","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","c1e7642a-74cc-4d69-8652-20abbdeaa94e","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_126":122},"org",{"_11":12,"_120":-5,"_121":122,"_83":84,"_123":124,"_125":54},"branch",{"_17":43,"_13":16,"_34":41,"_112":74,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJnTEtkSHlOMWxWZm1GRHdKYUVTNklYM3FpdiJ9","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":74,"_13":14,"_46":164,"_76":-5,"_77":45,"_78":79,"_80":79,"_81":-5,"_82":-5,"_83":84,"_85":38,"_86":45,"_87":-5,"_88":-5,"_89":62,"_90":91,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":97,"_98":97,"_99":100,"_101":100,"_102":100,"_103":97,"_104":97,"_105":165,"_107":166,"_109":167,"_111":54},[158,159],"files",[158,159],"counts",{"_149":62,"_150":60,"_151":60,"_31":152,"_153":154},[145,146],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_18":148},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":147},[36],[58],"pulls","branches","forks",{"_155":62,"_157":62},"connections",{"_155":62,"_156":62},"count","unfilledCount","emptyCount",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_68":162,"_18":163},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":160,"_18":161},[],[36],[],[58],["D",1745953538026],{"_11":12,"_126":122},{"_11":12,"_120":-5,"_121":122,"_83":84,"_123":124,"_125":54},{"_17":43,"_13":16,"_34":41,"_112":74,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":14,"_119":12},"ctx",{"_105":-5,"_142":201,"_202":203,"_204":205,"_206":54,"_207":54,"_208":54,"_209":45,"_210":-5,"_211":-7,"_212":-7,"_213":62,"_214":54,"_215":54,"_216":-5,"_217":54,"_218":54,"_219":54,"_220":-5},"ENV",{"_172":173,"_174":175,"_176":16,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","a3e067d4463eea85f6334f8e583e8516ae58c4f6","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code