[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_181":182,"_183":184},"routes/_app.x.$handle.$name",{"_96":95,"_33":46,"_105":86,"_28":38,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":27,"_119":120,"_121":25,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_33":46,"_39":47,"_48":-5,"_49":27,"_50":51,"_52":51,"_53":38,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":27},"version",11,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":27,"_28":29,"_30":29},"file",{"_31":32,"_33":29,"_35":36,"_37":38,"_39":40,"_41":14,"_42":43,"_24":27},"previous",{"_31":32,"_33":34,"_35":36,"_37":38},"deleted",true,"deletedHere",false,"path","db.ts","latestPath","fileId","8705b56c-a16c-11f1-a39c-1607ee4eb77e","name","new-file-2929.ts","fileType","script","content","","createdAt",["D",1787762294166],"branchVersion","branchId","f409cc80-4dfe-4648-826c-5f94984b93a7","id","67d3ebca-0208-40ef-9e43-526d7a9d01a3","eticket",["D",1787751631620],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","7ed13655-83c2-4934-a981-01578302df33","pinnedFileId","b50ac696-a153-11f1-85e9-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f99eb-d944-7332-99f8-2fbb8b1e7011","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":27},"branch",{"_13":85,"_33":86,"_44":43,"_87":45,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":46,"_94":95},"isOwned",17,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mdevslabs","handle","displayName","mProjects","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/ec72623f-c02d-461a-9b1c-c2f416214400/square512?exp=1789541999&sig=b8a4bd681ba35663ee760ea4ee42cf81eb333e427132a2271b6ff477c9901c45","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_44":45,"_33":46,"_39":177,"_48":-5,"_49":27,"_50":51,"_52":51,"_53":38,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":178,"_80":179,"_82":180,"_84":27},"tree",[164,165,166],"files",[164,165,166],"counts",{"_153":62,"_154":151,"_155":62,"_156":157,"_158":159},"contents",[126,127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":149,"_33":29,"_31":32,"_132":-5,"_42":43,"_41":14,"_134":27,"_39":150,"_13":151,"_35":36,"_37":38,"_24":27,"_139":-5,"_28":152},{"_44":141,"_33":142,"_31":57,"_132":-5,"_42":43,"_41":143,"_134":27,"_39":144,"_13":145,"_35":146,"_37":147,"_24":27,"_139":46,"_28":148},{"_44":129,"_33":130,"_31":131,"_132":-5,"_42":43,"_41":133,"_134":25,"_39":135,"_13":136,"_35":137,"_37":138,"_24":27,"_139":-5,"_28":140},"3f2cc61b-8cdd-4025-bd4e-9fb44ea489e1","purge.ts","60942de0-a154-11f1-94ff-1607ee4eb77e","parentId",8,"latest",["D",1787751953719],4,"interval","/**\n * E-Ticket — Cron val Val Town (optionnel)\n * -----------------------------------------------------------------------------\n * Crée un Val « Scheduled » qui tourne 1× / jour et colle ce fichier.\n * Il appelle le HTTP val pour supprimer les tickets dont la date d'expiration\n * est dépassée — même si personne n'ouvre l'application.\n *\n * Variables : API_BASE_URL (https://xxx.web.val.run) et CRON_SECRET.\n */\n\nexport default async function purgeExpiredTickets() {\n const base = (Deno.env.get(\"API_BASE_URL\") ?? \"\").replace(/\\/$/, \"\");\n const secret = Deno.env.get(\"CRON_SECRET\") ?? \"\";\n if (!base || !secret) {\n console.error(\"API_BASE_URL ou CRON_SECRET manquant\");\n return;\n }\n const res = await fetch(`${base}/internal/purge`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${secret}` },\n });\n const body = await res.text();\n console.log(\"purge\", res.status, body);\n}","label",[130],"d9425ba7-1ab6-44bf-8e56-4921a3fc99cd","main.ts",9,["D",1787762255830],3,"http","/**\n * E-Ticket v2 — HTTP val Val Town\n * -----------------------------------------------------------------------------\n * Comptes individuels (email + mot de passe) et **espaces partagés** rejoints\n * par code. Les métadonnées et les fichiers vivent dans **Neon Postgres**.\n *\n * Fichiers du val :\n * main.ts (ce fichier) — routes HTTP\n * db.ts — accès Postgres (postgres.js) + schéma auto\n *\n * Variables d'environnement (Val Town → Settings → Environment variables) :\n * DATABASE_URL — chaîne de connexion Neon (endpoint -pooler conseillé)\n * JWT_SECRET — secret HMAC (32+ caractères)\n * CRON_SECRET — optionnel, pour le val cron de purge\n * CORS_ORIGIN — origines autorisées, `*` par défaut\n *\n * Authentification :\n * - Compte : POST /auth/signup puis POST /oauth/token (grant password, email)\n * - Espace : POST /vaults (créer) ou POST /vaults/join (rejoindre avec code)\n * - Chaque requête d'espace envoie l'en-tête `X-Vault-Id` ; le serveur\n * vérifie l'appartenance avant tout accès aux données.\n */\n\nimport postgres from \"npm:postgres\";\nimport * as store from \"./db.ts\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nconst ITERATIONS = 120_000;\nconst TOKEN_TTL_SEC = 60 * 60 * 24 * 7; // 7 jours\n\n/** Domaines email autorisés à l'inscription. */\nconst ALLOWED_EMAIL_DOMAINS = [\"gmail.com\", \"yahoo.fr\", \"hotmail.fr\"];\n\ntype TicketKind = \"pdf\" | \"image\" | \"other\";\n\nclass HttpError extends Error {\n status: number;\n constructor(status: number, message: string) {\n super(message);\n this.status = status;\n }\n}\n\nfunction env(name: string, fallback = \"\"): string {\n return (Deno.env.get(name) ?? fallback).trim();\n}\n\nfunction json(data: unknown, status = 200, extra: HeadersInit = {}): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...extra },\n });\n}\n\nfunction corsHeaders(req: Request): Record {\n const allowed = env(\"CORS_ORIGIN\", \"*\");\n const origin = req.headers.get(\"origin\") ?? \"\";\n const list = allowed.split(\",\").map((s) => s.trim()).filter(Boolean);\n const allow = allowed === \"*\" || list.includes(\"*\")\n ? \"*\"\n : list.includes(origin)\n ? origin\n : list[0] ?? \"*\";\n return {\n \"access-control-allow-origin\": allow,\n \"access-control-allow-headers\": \"Authorization, Content-Type, X-Vault-Id\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n vary: \"Origin\",\n };\n}\n\nfunction withCors(req: Request, res: Response): Response {\n const headers = new Headers(res.headers);\n for (const [k, v] of Object.entries(corsHeaders(req))) headers.set(k, v);\n return new Response(res.body, { status: res.status, headers });\n}\n\n/* ------------------------------ crypto helpers ---------------------------- */\n\nfunction b64url(bytes: Uint8Array): string {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\n \"=\",\n \"\",\n );\n}\n\nfunction b64urlDecode(s: string): Uint8Array {\n const pad = s.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (s.length % 4));\n const b64 = s.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + pad;\n const bin = atob(b64);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt: salt as unknown as BufferSource,\n iterations,\n },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\n\nasync function sha256Hex(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(input));\n return b64url(new Uint8Array(digest));\n}\n\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** Format stocké : pbkdf2$iterations$saltB64url$hashB64url */\nasync function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await pbkdf2(password, salt, ITERATIONS);\n return `pbkdf2$${ITERATIONS}$${b64url(salt)}$${b64url(hash)}`;\n}\n\nasync function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n const [algo, iters, saltB64, hashB64] = stored.split(\"$\");\n if (algo !== \"pbkdf2\") return false;\n const got = await pbkdf2(\n password,\n b64urlDecode(saltB64),\n Number(iters) || ITERATIONS,\n );\n return timingSafeEqual(got, b64urlDecode(hashB64));\n}\n\nasync function hmac(secret: string, data: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\n \"sign\",\n ],\n );\n return new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data)),\n );\n}\n\nasync function signJwt(payload: Record): Promise {\n const header = b64url(\n encoder.encode(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" })),\n );\n const body = b64url(encoder.encode(JSON.stringify(payload)));\n const sig = b64url(await hmac(requiredJwtSecret(), `${header}.${body}`));\n return `${header}.${body}.${sig}`;\n}\n\nfunction requiredJwtSecret(): string {\n const s = env(\"JWT_SECRET\");\n if (!s) throw new HttpError(500, \"Variable manquante : JWT_SECRET\");\n return s;\n}\n\nasync function verifyJwt(token: string): Promise<{ sub: string; exp: number }> {\n const parts = token.split(\".\");\n if (parts.length !== 3) throw new HttpError(401, \"Jeton invalide\");\n const sig = b64url(\n await hmac(requiredJwtSecret(), `${parts[0]}.${parts[1]}`),\n );\n if (sig !== parts[2]) throw new HttpError(401, \"Jeton invalide\");\n let payload: Record;\n try {\n payload = JSON.parse(decoder.decode(b64urlDecode(parts[1])));\n } catch {\n throw new HttpError(401, \"Jeton invalide\");\n }\n if (typeof payload.exp !== \"number\" || payload.exp * 1000 < Date.now()) {\n throw new HttpError(401, \"Session expirée\");\n }\n return payload as { sub: string; exp: number };\n}\n\nasync function issueToken(\n user: store.UserRow,\n): Promise<\n {\n access_token: string;\n token_type: string;\n expires_in: number;\n user: PublicUser;\n }\n> {\n const now = Math.floor(Date.now() / 1000);\n const access_token = await signJwt({\n sub: user.id,\n iat: now,\n exp: now + TOKEN_TTL_SEC,\n });\n return {\n access_token,\n token_type: \"Bearer\",\n expires_in: TOKEN_TTL_SEC,\n user: publicUser(user),\n };\n}\n\n/* ------------------------------ auth & guards ----------------------------- */\n\nexport interface PublicUser {\n id: string;\n email: string;\n displayName: string;\n createdAt: string;\n}\n\nfunction publicUser(u: store.UserRow): PublicUser {\n return {\n id: u.id,\n email: u.email,\n displayName: u.display_name,\n createdAt: new Date(u.created_at).toISOString(),\n };\n}\n\nasync function requireUser(req: Request): Promise {\n const header = req.headers.get(\"authorization\") ?? \"\";\n const m = header.match(/^Bearer\\s+(.+)$/i);\n if (!m) throw new HttpError(401, \"Authentification requise\");\n const payload = await verifyJwt(m[1].trim());\n const user = await store.getUserById(payload.sub);\n if (!user) throw new HttpError(401, \"Compte introuvable\");\n return user;\n}\n\n/** Vérifie l'appartenance à l'espace indiqué par X-Vault-Id. */\nasync function requireVault(\n req: Request,\n user: store.UserRow,\n): Promise<{ vault: store.VaultRow; role: string }> {\n const vaultId = req.headers.get(\"x-vault-id\")?.trim() ?? \"\";\n if (!vaultId) {\n throw new HttpError(400, \"Espace non sélectionné (X-Vault-Id manquant)\");\n }\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n const vault = await store.getVault(vaultId);\n if (!vault) throw new HttpError(404, \"Espace introuvable\");\n return { vault, role: membership.role };\n}\n\nasync function readBody(req: Request): Promise> {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n const params = new URLSearchParams(await req.text());\n const out: Record = {};\n for (const [k, v] of params) out[k] = v;\n return out;\n }\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const out: Record = {};\n for (const [k, v] of form.entries()) out[k] = v;\n return out;\n }\n if (!ct || ct.includes(\"application/json\")) {\n const text = await req.text();\n if (!text) return {};\n return JSON.parse(text);\n }\n return {};\n}\n\n/** Montant d'une dépense : nombre ≥ 0, arrondi à 2 décimales (0 = non renseigné). */\nexport function parseAmount(input: unknown): number {\n const n = Number(String(input ?? \"\").replace(\",\", \".\"));\n if (!Number.isFinite(n) || n < 0) return 0;\n return Math.round(n * 100) / 100;\n}\n\nfunction parseTags(input: unknown): string[] {\n if (Array.isArray(input)) {\n return [\n ...new Set(\n input.map((t) => String(t).trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n if (typeof input === \"string\") {\n return [\n ...new Set(\n input.split(/[,;#]/).map((t) => t.trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n return [];\n}\n\nfunction kindFromMime(mime: string, fileName: string): TicketKind {\n if (mime === \"application/pdf\" || fileName.toLowerCase().endsWith(\".pdf\")) {\n return \"pdf\";\n }\n if (mime.startsWith(\"image/\")) return \"image\";\n return \"other\";\n}\n\nfunction ticketPublic(t: store.TicketRow) {\n return {\n id: t.id,\n name: t.name,\n brandId: t.brand_id,\n tags: t.tags,\n color: t.color,\n kind: t.kind,\n fileName: t.file_name,\n mimeType: t.mime_type,\n size: Number(t.size),\n notes: t.notes,\n amount: Number(t.amount ?? 0),\n expiresAt: t.expires_at ? new Date(t.expires_at).toISOString() : null,\n createdAt: new Date(t.created_at).toISOString(),\n updatedAt: new Date(t.updated_at).toISOString(),\n createdBy: t.created_by_name ?? \"Famille\",\n hasFile: Number(t.size) > 0 && Boolean(t.file_name),\n pinned: t.pinned,\n };\n}\n\nfunction brandPublic(b: store.BrandRow) {\n return {\n id: b.id,\n name: b.name,\n color: b.color,\n createdAt: new Date(b.created_at).toISOString(),\n };\n}\n\nfunction vaultPublic(v: store.VaultSummary) {\n return {\n id: v.id,\n name: v.name,\n role: v.role,\n members: v.members,\n tickets: v.tickets,\n createdAt: v.createdAt,\n };\n}\n\n/* --------------------------------- handlers -------------------------------- */\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nexport function emailDomainAllowed(email: string): boolean {\n const domain = email.trim().toLowerCase().split(\"@\")[1] ?? \"\";\n return ALLOWED_EMAIL_DOMAINS.includes(domain);\n}\n\nasync function handleSignup(req: Request): Promise {\n const body = await readBody(req);\n const email = String(body.email ?? \"\").trim();\n const password = String(body.password ?? \"\");\n const displayName = String(body.displayName ?? \"\").trim();\n if (!EMAIL_RE.test(email) || !emailDomainAllowed(email)) {\n throw new HttpError(\n 400,\n \"Email non autorisé : seuls les domaines @gmail.com, @yahoo.fr et @hotmail.fr sont acceptés\",\n );\n }\n if (password.length < 8) {\n throw new HttpError(400, \"Mot de passe trop court (8 caractères minimum)\");\n }\n if (!displayName) throw new HttpError(400, \"Le prénom est obligatoire\");\n if (await store.getUserByEmail(email)) {\n throw new HttpError(409, \"Un compte existe déjà avec cet email\");\n }\n const user = await store.insertUser(\n email,\n await hashPassword(password),\n displayName,\n );\n return json({ ...(await issueToken(user)) }, 201);\n}\n\nasync function handleLogin(req: Request): Promise {\n const body = await readBody(req);\n const grant = String(body.grant_type ?? \"password\");\n if (grant !== \"password\") {\n throw new HttpError(400, \"grant_type non supporté (utiliser password)\");\n }\n const email = String(body.username ?? body.email ?? \"\").trim();\n const password = String(body.password ?? \"\");\n const user = await store.getUserByEmail(email);\n if (!user || !(await verifyPassword(password, user.password_hash))) {\n throw new HttpError(401, \"Email ou mot de passe incorrect\");\n }\n return json(await issueToken(user));\n}\n\nasync function handleMe(req: Request, user: store.UserRow): Promise {\n return json({\n user: publicUser(user),\n vaults: (await store.listUserVaults(user.id)).map(vaultPublic),\n });\n}\n\nasync function handlePasswordChange(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const current = String(body.current ?? body.oldPassword ?? \"\");\n const next = String(body.next ?? body.newPassword ?? \"\");\n if (next.length < 8) {\n throw new HttpError(\n 400,\n \"Nouveau mot de passe trop court (8 caractères min.)\",\n );\n }\n if (!(await verifyPassword(current, user.password_hash))) {\n throw new HttpError(401, \"Mot de passe actuel incorrect\");\n }\n await store.updateUserPassword(user.id, await hashPassword(next));\n return json({ ok: true, message: \"Mot de passe du compte mis à jour.\" });\n}\n\nasync function handleNameChange(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const displayName = String(body.displayName ?? \"\").trim();\n if (!displayName) throw new HttpError(400, \"Le prénom est obligatoire\");\n await store.updateUserDisplayName(user.id, displayName);\n return json({ user: publicUser({ ...user, display_name: displayName }) });\n}\n\nasync function handleCreateVault(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim();\n const code = String(body.code ?? \"\").trim();\n if (!name) throw new HttpError(400, \"Le nom de l'espace est obligatoire\");\n if (code.length < 6) {\n throw new HttpError(\n 400,\n \"Le code de l'espace doit faire au moins 6 caractères\",\n );\n }\n const vault = await store.insertVault(\n name,\n await sha256Hex(code),\n await hashPassword(code),\n user.id,\n );\n const summary = (await store.listUserVaults(user.id)).find((v) =>\n v.id === vault.id\n )!;\n return json({ vault: vaultPublic(summary) }, 201);\n}\n\nasync function handleJoinVault(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const code = String(body.code ?? \"\").trim();\n if (!code) throw new HttpError(400, \"Saisis le code de l'espace\");\n const vault = await store.getVaultByCodeLookup(await sha256Hex(code));\n if (!vault || !(await verifyPassword(code, vault.join_code_hash))) {\n throw new HttpError(401, \"Code d'espace incorrect\");\n }\n await store.insertMembership(user.id, vault.id);\n const summary = (await store.listUserVaults(user.id)).find((v) =>\n v.id === vault.id\n )!;\n return json({ vault: vaultPublic(summary) });\n}\n\nasync function handleMembers(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n return json({ members: await store.listMembers(vaultId) });\n}\n\nasync function handleLeaveVault(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(404, \"Tu n'es pas membre de cet espace\");\n if (membership.role === \"owner\") {\n throw new HttpError(\n 400,\n \"Le propriétaire ne peut pas quitter l'espace : supprime-le depuis les réglages.\",\n );\n }\n await store.deleteMembership(user.id, vaultId);\n return json({ ok: true });\n}\n\nasync function handleDeleteVault(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n void req;\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n if (membership.role !== \"owner\") {\n throw new HttpError(403, \"Seul le propriétaire peut supprimer l'espace\");\n }\n await store.deleteVault(vaultId); // tickets, fichiers, marques, membres : cascade\n return json({ ok: true });\n}\n\nasync function handleTicketsList(\n req: Request,\n vaultId: string,\n): Promise {\n const url = new URL(req.url);\n const q = url.searchParams.get(\"q\") ?? \"\";\n await store.purgeExpired(vaultId);\n const [tickets, brands] = await Promise.all([\n store.listTickets(vaultId, q),\n store.listBrands(vaultId),\n ]);\n return json({\n tickets: tickets.map(ticketPublic),\n brands: brands.map(brandPublic),\n });\n}\n\nasync function handleCreateTicket(\n req: Request,\n vaultId: string,\n user: store.UserRow,\n): Promise {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let meta: Record = {};\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n for (const [k, v] of form.entries()) {\n if (k === \"file\" && typeof v !== \"string\") file = v;\n else meta[k] = v;\n }\n } else {\n meta = await readBody(req);\n }\n\n const name = String(meta.name ?? file?.name ?? \"Ticket\").trim();\n if (!name) throw new HttpError(400, \"Le nom est obligatoire\");\n\n const fileName = file?.name || String(meta.fileName ?? \"\");\n const mimeType = file?.type ||\n String(meta.mimeType ?? \"application/octet-stream\");\n let data: Uint8Array | null = null;\n if (file) {\n data = new Uint8Array(await file.arrayBuffer()); // pas de limite de taille\n }\n\n const ticket = await store.insertTicket({\n vaultId,\n name,\n brandId: meta.brandId ? String(meta.brandId) : null,\n tags: parseTags(meta.tags),\n color: String(meta.color ?? \"#c45c26\"),\n kind: data ? kindFromMime(mimeType, fileName) : \"other\",\n fileName: data ? fileName : \"\",\n mimeType,\n size: data ? data.byteLength : 0,\n notes: String(meta.notes ?? \"\"),\n amount: parseAmount(meta.amount),\n expiresAt: meta.expiresAt ? String(meta.expiresAt) : null,\n createdBy: user.id,\n });\n if (data && fileName) {\n await store.upsertFile(ticket.id, data, mimeType, fileName);\n }\n\n const full = await store.getTicket(vaultId, ticket.id);\n return json({ ticket: ticketPublic(full ?? ticket) }, 201);\n}\n\nasync function handlePatchTicket(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const body = await readBody(req);\n const patch: store.TicketPatch = {};\n if (body.name != null) patch.name = String(body.name).trim();\n if (body.brandId !== undefined) {\n patch.brandId = body.brandId\n ? String(body.brandId)\n : null;\n }\n if (body.tags != null) patch.tags = parseTags(body.tags);\n if (body.color != null) patch.color = String(body.color);\n if (body.notes != null) patch.notes = String(body.notes);\n if (body.amount !== undefined) patch.amount = parseAmount(body.amount);\n if (body.expiresAt !== undefined) {\n patch.expiresAt = body.expiresAt\n ? String(body.expiresAt)\n : null;\n }\n if (body.pinned != null) patch.pinned = Boolean(body.pinned);\n const updated = await store.updateTicket(id, patch);\n if (!updated) throw new HttpError(404, \"Ticket introuvable\");\n const full = await store.getTicket(vaultId, id);\n return json({ ticket: ticketPublic(full ?? updated) });\n}\n\nasync function handleDeleteTicket(\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n await store.deleteTicket(id); // le fichier est supprimé par cascade\n return json({ ok: true, id });\n}\n\nasync function handleFile(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n const row = await store.getFile(id);\n if (!row) throw new HttpError(404, \"Fichier absent\");\n const disposition = new URL(req.url).searchParams.get(\"download\") === \"1\"\n ? \"attachment\"\n : \"inline\";\n return new Response(row.data as unknown as BodyInit, {\n status: 200,\n headers: {\n \"content-type\": row.mime_type || ticket.mime_type ||\n \"application/octet-stream\",\n \"content-length\": String(row.data.byteLength),\n \"content-disposition\": `${disposition}; filename=\"${\n row.file_name.replaceAll('\"', \"\")\n }\"`,\n \"cache-control\": \"private, max-age=120\",\n },\n });\n}\n\nasync function handleUpload(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const v = form.get(\"file\");\n if (v && typeof v !== \"string\") file = v;\n }\n if (!file) throw new HttpError(400, \"Fichier manquant (champ file)\");\n const data = new Uint8Array(await file.arrayBuffer()); // pas de limite de taille\n await store.upsertFile(\n id,\n data,\n file.type || \"application/octet-stream\",\n file.name,\n );\n await store.updateTicketFileMeta(id, {\n fileName: file.name,\n mimeType: file.type || ticket.mime_type || \"application/octet-stream\",\n size: data.byteLength,\n kind: kindFromMime(file.type || \"\", file.name),\n });\n const patched = await store.getTicket(vaultId, id);\n return json({ ticket: ticketPublic(patched ?? ticket) });\n}\n\nasync function handleBrands(req: Request, vaultId: string): Promise {\n if (req.method === \"GET\") {\n return json({ brands: (await store.listBrands(vaultId)).map(brandPublic) });\n }\n if (req.method === \"POST\") {\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim();\n if (!name) throw new HttpError(400, \"Nom de marque obligatoire\");\n try {\n const brand = await store.insertBrand(\n vaultId,\n name,\n String(body.color ?? \"#c45c26\"),\n );\n return json({ brand: brandPublic(brand) }, 201);\n } catch (e) {\n if (store.isUniqueViolation(e)) {\n throw new HttpError(\n 409,\n \"Une marque porte déjà ce nom dans cet espace\",\n );\n }\n throw e;\n }\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleBrandItem(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const brand = (await store.listBrands(vaultId)).find((b) => b.id === id);\n if (!brand) throw new HttpError(404, \"Marque introuvable\");\n if (req.method === \"PATCH\") {\n const body = await readBody(req);\n const updated = await store.updateBrand(id, {\n name: body.name != null ? String(body.name).trim() : undefined,\n color: body.color != null ? String(body.color) : undefined,\n });\n return json({ brand: brandPublic(updated ?? brand) });\n }\n if (req.method === \"DELETE\") {\n await store.deleteBrand(id);\n return json({ ok: true });\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleStats(vaultId: string): Promise {\n await store.purgeExpired(vaultId);\n return json({ stats: await store.computeStats(vaultId) });\n}\n\nasync function handlePurge(req: Request): Promise {\n const secret = env(\"CRON_SECRET\");\n const header = req.headers.get(\"authorization\") ?? \"\";\n const q = new URL(req.url).searchParams.get(\"secret\") ?? \"\";\n const bearer = header.replace(/^Bearer\\s+/i, \"\");\n let authed = Boolean(secret) && (bearer === secret || q === secret);\n if (!authed) {\n try {\n const user = await requireUser(req);\n void user; // un membre connecté peut aussi forcer la purge\n authed = true;\n } catch {\n throw new HttpError(401, \"CRON_SECRET ou session requis\");\n }\n }\n const purged = await store.purgeExpired(null);\n return json({ ok: true, purged });\n}\n\nasync function handleGetPreferences(\n req: Request,\n user: store.UserRow,\n): Promise {\n void req;\n return json({ preferences: await store.getPreferences(user.id) });\n}\n\nasync function handleSavePreferences(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const data = (body.preferences ?? body) as Record;\n if (typeof data !== \"object\" || data === null || Array.isArray(data)) {\n throw new HttpError(400, \"Préférences invalides\");\n }\n return json({ preferences: await store.savePreferences(user.id, data) });\n}\n\nconst RECURRENCES = [\"none\", \"daily\", \"weekly\", \"monthly\", \"yearly\"];\n\nfunction reminderPublic(r: store.ReminderRow) {\n return {\n id: r.id,\n title: r.title,\n notes: r.notes,\n kind: r.kind,\n dueAt: r.due_at ? new Date(r.due_at).toISOString() : null,\n done: r.done,\n ticketId: r.ticket_id,\n ticketName: r.ticket_name ?? null,\n brandId: r.brand_id,\n brandName: r.brand_name ?? null,\n tags: r.tags ?? [],\n recurrence: r.recurrence ?? \"none\",\n createdBy: r.created_by_name ?? \"Famille\",\n createdAt: new Date(r.created_at).toISOString(),\n completedAt: r.completed_at ? new Date(r.completed_at).toISOString() : null,\n lastCompletedAt: r.last_completed_at\n ? new Date(r.last_completed_at).toISOString()\n : null,\n };\n}\n\nasync function handleCreateReminder(\n req: Request,\n vaultId: string,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const title = String(body.title ?? \"\").trim();\n if (!title) throw new HttpError(400, \"Le titre du rappel est obligatoire\");\n const recurrence = RECURRENCES.includes(String(body.recurrence))\n ? String(body.recurrence)\n : \"none\";\n const reminder = await store.insertReminder({\n vaultId,\n createdBy: user.id,\n title,\n notes: String(body.notes ?? \"\"),\n kind: [\"create_ticket\", \"import\", \"custom\"].includes(String(body.kind))\n ? String(body.kind)\n : \"custom\",\n dueAt: body.dueAt ? String(body.dueAt) : null,\n ticketId: body.ticketId ? String(body.ticketId) : null,\n brandId: body.brandId ? String(body.brandId) : null,\n tags: parseTags(body.tags),\n recurrence,\n });\n const full = await store.getReminder(vaultId, reminder.id);\n return json({ reminder: reminderPublic(full ?? reminder) }, 201);\n}\n\nasync function handlePatchReminder(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const body = await readBody(req);\n const doneRequested = body.done != null ? Boolean(body.done) : undefined;\n\n // Rappel récurrent terminé : on reprogramme l'occurrence suivante au lieu de le clore.\n let reprogrammed: string | null = null;\n if (doneRequested === true) {\n const current = await store.getReminder(vaultId, id);\n if (current && current.recurrence && current.recurrence !== \"none\") {\n const base = current.due_at ? new Date(current.due_at) : new Date();\n const next = store.nextRecurrenceDate(\n base > new Date() ? base : new Date(),\n current.recurrence,\n );\n if (next) reprogrammed = next.toISOString();\n }\n }\n\n const updated = await store.updateReminder(id, {\n title: body.title != null ? String(body.title).trim() : undefined,\n notes: body.notes != null ? String(body.notes) : undefined,\n dueAt: reprogrammed\n ? reprogrammed\n : body.dueAt !== undefined\n ? (body.dueAt ? String(body.dueAt) : null)\n : undefined,\n done: reprogrammed ? undefined : doneRequested,\n completedNow: Boolean(reprogrammed),\n brandId: body.brandId !== undefined\n ? (body.brandId ? String(body.brandId) : null)\n : undefined,\n tags: body.tags != null ? parseTags(body.tags) : undefined,\n recurrence:\n body.recurrence != null && RECURRENCES.includes(String(body.recurrence))\n ? String(body.recurrence)\n : undefined,\n });\n if (!updated) throw new HttpError(404, \"Rappel introuvable\");\n const full = await store.getReminder(vaultId, id);\n return json({\n reminder: reminderPublic(full ?? updated),\n rescheduledTo: reprogrammed,\n });\n}\n\nasync function handleDeleteReminder(\n vaultId: string,\n id: string,\n): Promise {\n const reminder = await store.getReminder(vaultId, id);\n if (!reminder) throw new HttpError(404, \"Rappel introuvable\");\n await store.deleteReminder(id);\n return json({ ok: true, id });\n}\n\nasync function handleNotifyLog(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const type = String(body.type ?? \"\").trim();\n if (!type) throw new HttpError(400, \"Type de notification manquant\");\n const first = await store.logNotification(\n user.id,\n type,\n String(body.refId ?? \"\"),\n );\n return json({ first });\n}\n\n/* --------------------------------- routing -------------------------------- */\n\nfunction match(\n pathname: string,\n pattern: string,\n): Record | null {\n const a = pathname.split(\"/\").filter(Boolean);\n const b = pattern.split(\"/\").filter(Boolean);\n if (a.length !== b.length) return null;\n const params: Record = {};\n for (let i = 0; i < a.length; i++) {\n if (b[i].startsWith(\":\")) params[b[i].slice(1)] = decodeURIComponent(a[i]);\n else if (a[i] !== b[i]) return null;\n }\n return params;\n}\n\nasync function route(req: Request): Promise {\n await store.ensureSchema();\n const url = new URL(req.url);\n let path = url.pathname.replace(/^\\/v\\d+/, \"\");\n if (path.length > 1 && path.endsWith(\"/\")) path = path.slice(0, -1);\n\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204 });\n\n if (req.method === \"GET\" && (path === \"/\" || path === \"/health\")) {\n return json({\n name: \"E-Ticket API\",\n version: 2,\n ok: true,\n storage: \"postgres\",\n auth: \"accounts+vaults\",\n time: new Date().toISOString(),\n });\n }\n\n if (req.method === \"POST\" && path === \"/auth/signup\") {\n return await handleSignup(req);\n }\n\n if (\n req.method === \"POST\" &&\n (path === \"/oauth/token\" || path === \"/auth/login\" ||\n path === \"/auth/token\")\n ) {\n return await handleLogin(req);\n }\n\n if (\n path === \"/internal/purge\" &&\n (req.method === \"POST\" || req.method === \"GET\")\n ) {\n return await handlePurge(req);\n }\n\n const user = await requireUser(req);\n\n if (req.method === \"GET\" && path === \"/auth/me\") {\n return await handleMe(req, user);\n }\n if (req.method === \"POST\" && path === \"/auth/password\") {\n return await handlePasswordChange(req, user);\n }\n if (req.method === \"PATCH\" && path === \"/auth/me\") {\n return await handleNameChange(req, user);\n }\n if (req.method === \"GET\" && path === \"/auth/preferences\") {\n return await handleGetPreferences(req, user);\n }\n if (req.method === \"PUT\" && path === \"/auth/preferences\") {\n return await handleSavePreferences(req, user);\n }\n if (req.method === \"POST\" && path === \"/notify/log\") {\n return await handleNotifyLog(req, user);\n }\n\n if (req.method === \"POST\" && path === \"/vaults\") {\n return await handleCreateVault(req, user);\n }\n if (req.method === \"GET\" && path === \"/vaults\") {\n return json({\n vaults: (await store.listUserVaults(user.id)).map(vaultPublic),\n });\n }\n if (req.method === \"POST\" && path === \"/vaults/join\") {\n return await handleJoinVault(req, user);\n }\n\n let m = match(path, \"/vaults/:id/members\");\n if (m && req.method === \"GET\") return await handleMembers(req, user, m.id);\n\n m = match(path, \"/vaults/:id/members/me\");\n if (m && req.method === \"DELETE\") {\n return await handleLeaveVault(req, user, m.id);\n }\n\n m = match(path, \"/vaults/:id\");\n if (m && req.method === \"DELETE\") {\n return await handleDeleteVault(req, user, m.id);\n }\n\n // À partir d'ici, tout est relatif à un espace partagé.\n const { vault } = await requireVault(req, user);\n\n if (req.method === \"GET\" && path === \"/tickets\") {\n return await handleTicketsList(req, vault.id);\n }\n if (req.method === \"POST\" && path === \"/tickets\") {\n return await handleCreateTicket(req, vault.id, user);\n }\n\n if (req.method === \"GET\" && path === \"/stats\") {\n return await handleStats(vault.id);\n }\n\n if (req.method === \"GET\" && path === \"/reminders\") {\n const url = new URL(req.url);\n const includeDone = url.searchParams.get(\"done\") !== \"0\";\n return json({\n reminders: (await store.listReminders(vault.id, includeDone)).map(\n reminderPublic,\n ),\n });\n }\n if (req.method === \"POST\" && path === \"/reminders\") {\n return await handleCreateReminder(req, vault.id, user);\n }\n\n m = match(path, \"/reminders/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const reminder = await store.getReminder(vault.id, m.id);\n if (!reminder) throw new HttpError(404, \"Rappel introuvable\");\n return json({ reminder: reminderPublic(reminder) });\n }\n if (req.method === \"PATCH\") {\n return await handlePatchReminder(req, vault.id, m.id);\n }\n if (req.method === \"DELETE\") {\n return await handleDeleteReminder(vault.id, m.id);\n }\n }\n\n if (path === \"/brands\") return await handleBrands(req, vault.id);\n\n m = match(path, \"/tickets/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const ticket = await store.getTicket(vault.id, m.id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n return json({ ticket: ticketPublic(ticket) });\n }\n if (req.method === \"PATCH\") {\n return await handlePatchTicket(req, vault.id, m.id);\n }\n if (req.method === \"DELETE\") {\n return await handleDeleteTicket(vault.id, m.id);\n }\n }\n\n m = match(path, \"/tickets/:id/file\");\n if (m && req.method === \"GET\") return await handleFile(req, vault.id, m.id);\n if (m && (req.method === \"POST\" || req.method === \"PUT\")) {\n return await handleUpload(req, vault.id, m.id);\n }\n\n m = match(path, \"/brands/:id\");\n if (m) return await handleBrandItem(req, vault.id, m.id);\n\n if (req.method === \"GET\" && path === \"/tags\") {\n return json({ tags: await store.listTags(vault.id) });\n }\n\n throw new HttpError(404, `Route inconnue : ${req.method} ${path}`);\n}\n\nexport default async function handler(req: Request): Promise {\n try {\n return withCors(req, await route(req));\n } catch (err) {\n if (err instanceof store.DbError) {\n return withCors(\n req,\n json({ error: err.message, status: err.status }, err.status),\n );\n }\n if (err instanceof postgres.PostgresError) {\n console.error(\"E-Ticket API [postgres]\", err.code, err.message);\n const status = err.code === \"23505\" ? 409 : 500;\n const message = err.code === \"23505\"\n ? \"Cette valeur existe déjà\"\n : \"Erreur de base de données\";\n return withCors(req, json({ error: message, status }, status));\n }\n const status = err instanceof HttpError ? err.status : 500;\n const message = err instanceof Error ? err.message : \"Erreur interne\";\n console.error(\"E-Ticket API\", status, message);\n return withCors(req, json({ error: message, status }, status));\n }\n}",[142],"b1ddc841-e7ef-479a-8889-0eca515d94c2",["D",1787762294166],1,[29],"pulls","branches","forks","envVars",{"_160":162,"_163":62},"connections",{"_160":62,"_161":62},"count","unfilledCount",29,"emptyCount",{"_44":149,"_33":29,"_31":32,"_132":-5,"_42":43,"_41":14,"_134":27,"_39":174,"_13":151,"_35":36,"_37":38,"_24":27,"_139":-5,"_168":175,"_28":176},{"_44":141,"_33":142,"_31":57,"_132":-5,"_42":43,"_41":143,"_134":27,"_39":171,"_13":145,"_35":146,"_37":147,"_24":27,"_139":46,"_168":172,"_28":173},{"_44":129,"_33":130,"_31":131,"_132":-5,"_42":43,"_41":133,"_134":25,"_39":167,"_13":136,"_35":137,"_37":138,"_24":27,"_139":-5,"_168":169,"_28":170},["D",1787751953719],"children",[],[130],["D",1787762255830],[],[142],["D",1787762294166],[],[29],["D",1787751631620],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":27},{"_13":85,"_33":86,"_44":43,"_87":45,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":46,"_94":95},"ctx",{"_78":-5,"_123":214,"_215":216,"_217":218,"_219":27,"_220":27,"_221":27,"_222":25,"_223":-5,"_224":-7,"_225":-7,"_226":62,"_227":27,"_228":27,"_229":-5,"_230":27,"_231":27,"_232":27,"_233":-5},"ENV",{"_185":186,"_187":188,"_189":86,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v11