[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_173":174,"_175":176},"routes/_app.x.$handle.$name",{"_96":95,"_32":44,"_105":86,"_27":53,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":48,"_119":120,"_121":25,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":48,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":48},"version",16,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",true,"deletedHere","path","db.ts","latestPath","fileId","8705b56c-a16c-11f1-a39c-1607ee4eb77e","name","fileType","script","content","/**\n * E-Ticket v2 — accès Neon Postgres (driver postgres.js).\n * -----------------------------------------------------------------------------\n * Fonctionne sur Val Town (Deno) : `import postgres from \"npm:postgres\"`.\n * La chaîne de connexion vient de DATABASE_URL (Neon → Connection string,\n * de préférence l'endpoint « -pooler »).\n *\n * Le schéma est créé automatiquement au premier appel (DDL idempotent).\n * Il est aussi disponible sous forme SQL pure dans ./schema.sql.\n */\n\nimport postgres from \"npm:postgres\";\n\nlet client: postgres.Sql | null = null;\nlet schemaPromise: Promise | null = null;\n\n/** Erreur porteuse de statut HTTP, relancée en HttpError par main.ts. */\nexport class DbError extends Error {\n status: number;\n constructor(status: number, message: string) {\n super(message);\n this.status = status;\n }\n}\n\nfunction requiredEnv(name: string): string {\n const v = (Deno.env.get(name) ?? \"\").trim();\n if (!v) throw new DbError(500, `Variable manquante : ${name}`);\n return v;\n}\n\nexport function db(): postgres.Sql {\n if (client) return client;\n let url = requiredEnv(\"DATABASE_URL\");\n // Neon exige TLS : on force sslmode si absent de la chaîne.\n if (!/sslmode=/.test(url)) {\n url += (url.includes(\"?\") ? \"&\" : \"?\") + \"sslmode=require\";\n }\n client = postgres(url, {\n max: 5,\n idle_timeout: 20,\n connect_timeout: 10,\n prepare: false, // compatibilité poolers (Neon PgBouncer)\n onnotice: () => {},\n });\n return client;\n}\n\nexport async function ensureSchema(): Promise {\n schemaPromise ??= (async () => {\n const sql = db();\n await sql`\n create table if not exists users (\n id uuid primary key default gen_random_uuid(),\n email text not null unique,\n password_hash text not null,\n display_name text not null,\n created_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists vaults (\n id uuid primary key default gen_random_uuid(),\n name text not null,\n join_code_lookup text not null unique, -- sha256 du code (recherche rapide)\n join_code_hash text not null, -- pbkdf2 (vérification lente)\n created_by uuid not null references users(id) on delete cascade,\n created_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists memberships (\n user_id uuid not null references users(id) on delete cascade,\n vault_id uuid not null references vaults(id) on delete cascade,\n role text not null default 'member',\n joined_at timestamptz not null default now(),\n primary key (user_id, vault_id)\n )`;\n await sql`\n create table if not exists brands (\n id uuid primary key default gen_random_uuid(),\n vault_id uuid not null references vaults(id) on delete cascade,\n name text not null,\n color text not null default '#c45c26',\n created_at timestamptz not null default now(),\n unique (vault_id, name)\n )`;\n await sql`\n create table if not exists tickets (\n id uuid primary key default gen_random_uuid(),\n vault_id uuid not null references vaults(id) on delete cascade,\n name text not null,\n brand_id uuid references brands(id) on delete set null,\n tags text[] not null default '{}',\n color text not null default '#c45c26',\n kind text not null default 'other',\n file_name text not null default '',\n mime_type text not null default 'application/octet-stream',\n size bigint not null default 0,\n notes text not null default '',\n expires_at timestamptz,\n pinned boolean not null default false,\n created_by uuid references users(id) on delete set null,\n created_at timestamptz not null default now(),\n updated_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists files (\n ticket_id uuid primary key references tickets(id) on delete cascade,\n data bytea not null,\n mime_type text not null,\n file_name text not null,\n size bigint not null,\n uploaded_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists preferences (\n user_id uuid primary key references users(id) on delete cascade,\n data jsonb not null default '{}', -- theme, vue, tri, notifications, hors ligne par défaut…\n updated_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists reminders (\n id uuid primary key default gen_random_uuid(),\n vault_id uuid not null references vaults(id) on delete cascade,\n created_by uuid references users(id) on delete set null,\n title text not null,\n notes text not null default '',\n kind text not null default 'custom', -- 'create_ticket' | 'import' | 'custom'\n due_at timestamptz,\n done boolean not null default false,\n ticket_id uuid references tickets(id) on delete set null,\n created_at timestamptz not null default now(),\n completed_at timestamptz\n )`;\n await sql`\n create table if not exists notification_log (\n id uuid primary key default gen_random_uuid(),\n user_id uuid not null references users(id) on delete cascade,\n type text not null, -- 'offline' | 'reminder' | 'expiry' | 'custom'\n ref_id text not null default '', -- ticket / rappel concerné\n day date not null default current_date,\n created_at timestamptz not null default now(),\n unique (user_id, type, ref_id, day)\n )`;\n // v3 : montant dépensé par ticket (historique des dépenses)\n await sql`alter table tickets add column if not exists amount numeric not null default 0`;\n // v4 : quota de stockage par compte et espace (1 Gio)\n await sql`alter table users add column if not exists storage_bytes bigint not null default 0`;\n await sql`alter table vaults add column if not exists storage_bytes bigint not null default 0`;\n // v2.2 : récurrence, marque et tags sur les rappels (migration idempotente)\n await sql`alter table reminders add column if not exists brand_id uuid references brands(id) on delete set null`;\n await sql`alter table reminders add column if not exists tags text[] not null default '{}'`;\n await sql`alter table reminders add column if not exists recurrence text not null default 'none'`;\n await sql`alter table reminders add column if not exists last_completed_at timestamptz`;\n await sql`create index if not exists idx_tickets_vault on tickets (vault_id, created_at desc)`;\n await sql`create index if not exists idx_tickets_expiry on tickets (expires_at) where expires_at is not null`;\n await sql`create index if not exists idx_brands_vault on brands (vault_id)`;\n await sql`create index if not exists idx_memberships_vault on memberships (vault_id)`;\n await sql`create index if not exists idx_reminders_vault on reminders (vault_id, due_at)`;\n await sql`create index if not exists idx_reminders_due on reminders (due_at) where done = false`;\n })();\n try {\n await schemaPromise;\n } catch (e) {\n schemaPromise = null; // permettre un nouvel essai au prochain appel\n throw e;\n }\n}\n\n/** Numéro d'erreur PostgreSQL : 23505 = violation d'unicité. */\nexport function isUniqueViolation(e: unknown): boolean {\n return typeof e === \"object\" && e !== null && \"code\" in e &&\n (e as { code?: string }).code === \"23505\";\n}\n\n/* ---------------------------------- users --------------------------------- */\n\nexport interface UserRow {\n id: string;\n email: string;\n password_hash: string;\n display_name: string;\n created_at: Date;\n}\n\nexport async function getUserByEmail(email: string): Promise {\n const rows =\n (await db()`select * from users where email = ${email.trim().toLowerCase()} limit 1`) as UserRow[];\n return rows[0] ?? null;\n}\n\nexport async function getUserById(id: string): Promise {\n const rows =\n (await db()`select * from users where id = ${id} limit 1`) as UserRow[];\n return rows[0] ?? null;\n}\n\nexport async function insertUser(\n email: string,\n passwordHash: string,\n displayName: string,\n): Promise {\n const rows = (await db()`\n insert into users (email, password_hash, display_name)\n values (${email.trim().toLowerCase()}, ${passwordHash}, ${displayName})\n returning *`) as UserRow[];\n return rows[0];\n}\n\nexport async function updateUserPassword(\n id: string,\n passwordHash: string,\n): Promise {\n await db()`update users set password_hash = ${passwordHash} where id = ${id}`;\n}\n\nexport async function updateUserDisplayName(\n id: string,\n displayName: string,\n): Promise {\n await db()`update users set display_name = ${displayName} where id = ${id}`;\n}\n\n/* ---------------------------------- vaults -------------------------------- */\n\nexport interface VaultRow {\n id: string;\n name: string;\n join_code_lookup: string;\n join_code_hash: string;\n created_by: string;\n created_at: Date;\n}\n\nexport async function insertVault(\n name: string,\n codeLookup: string,\n codeHash: string,\n createdBy: string,\n): Promise {\n return (await db().begin(async (tx) => {\n const v = (await tx`\n insert into vaults (name, join_code_lookup, join_code_hash, created_by)\n values (${name}, ${codeLookup}, ${codeHash}, ${createdBy})\n returning *`) as VaultRow[];\n await tx`insert into memberships (user_id, vault_id, role) values (${createdBy}, ${\n v[0].id\n }, 'owner')`;\n return v[0];\n })) as VaultRow;\n}\n\nexport async function getVault(id: string): Promise {\n const rows =\n (await db()`select * from vaults where id = ${id} limit 1`) as VaultRow[];\n return rows[0] ?? null;\n}\n\nexport async function getVaultByCodeLookup(\n lookup: string,\n): Promise {\n const rows =\n (await db()`select * from vaults where join_code_lookup = ${lookup} limit 1`) as VaultRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteVault(id: string): Promise {\n await db()`delete from vaults where id = ${id}`;\n}\n\nexport interface VaultSummary {\n id: string;\n name: string;\n role: \"owner\" | \"member\";\n members: number;\n tickets: number;\n createdAt: string;\n}\n\ninterface VaultListRow {\n id: string;\n name: string;\n role: string;\n members: number;\n tickets: number;\n created_at: Date;\n}\n\ninterface MemberRow {\n id: string;\n email: string;\n display_name: string;\n role: string;\n joined_at: Date;\n}\n\nexport async function listUserVaults(userId: string): Promise {\n const rows = await db()`\n select v.id, v.name, v.created_at, m.role,\n (select count(*) from memberships m2 where m2.vault_id = v.id)::int as members,\n (select count(*) from tickets t where t.vault_id = v.id)::int as tickets\n from vaults v\n join memberships m on m.vault_id = v.id and m.user_id = ${userId}\n order by v.created_at asc`;\n return (rows as unknown as VaultListRow[]).map((r) => ({\n id: r.id,\n name: r.name,\n role: r.role === \"owner\" ? \"owner\" : \"member\",\n members: Number(r.members),\n tickets: Number(r.tickets),\n createdAt: new Date(r.created_at).toISOString(),\n }));\n}\n\nexport interface MemberSummary {\n id: string;\n email: string;\n displayName: string;\n role: \"owner\" | \"member\";\n joinedAt: string;\n}\n\nexport async function listMembers(vaultId: string): Promise {\n const rows = await db()`\n select u.id, u.email, u.display_name, m.role, m.joined_at\n from memberships m\n join users u on u.id = m.user_id\n where m.vault_id = ${vaultId}\n order by m.joined_at asc`;\n return (rows as unknown as MemberRow[]).map((r) => ({\n id: r.id,\n email: r.email,\n displayName: r.display_name,\n role: r.role === \"owner\" ? \"owner\" : \"member\",\n joinedAt: new Date(r.joined_at).toISOString(),\n }));\n}\n\nexport async function getMembership(\n userId: string,\n vaultId: string,\n): Promise<{ role: string } | null> {\n const rows =\n (await db()`select role from memberships where user_id = ${userId} and vault_id = ${vaultId} limit 1`) as {\n role: string;\n }[];\n return rows[0] ?? null;\n}\n\nexport async function insertMembership(\n userId: string,\n vaultId: string,\n): Promise {\n await db()`insert into memberships (user_id, vault_id) values (${userId}, ${vaultId}) on conflict do nothing`;\n}\n\nexport async function deleteMembership(\n userId: string,\n vaultId: string,\n): Promise {\n await db()`delete from memberships where user_id = ${userId} and vault_id = ${vaultId}`;\n}\n\n/* ---------------------------------- brands -------------------------------- */\n\nexport interface BrandRow {\n id: string;\n vault_id: string;\n name: string;\n color: string;\n created_at: Date;\n}\n\nexport async function listBrands(vaultId: string): Promise {\n return (await db()`select * from brands where vault_id = ${vaultId} order by name asc`) as BrandRow[];\n}\n\nexport async function insertBrand(\n vaultId: string,\n name: string,\n color: string,\n): Promise {\n const rows = (await db()`\n insert into brands (vault_id, name, color) values (${vaultId}, ${name}, ${color}) returning *`) as BrandRow[];\n return rows[0];\n}\n\nexport async function updateBrand(\n id: string,\n body: { name?: string; color?: string },\n): Promise {\n const sets: string[] = [];\n const params: unknown[] = [];\n if (body.name !== undefined) {\n params.push(body.name);\n sets.push(`name = $${params.length}`);\n }\n if (body.color !== undefined) {\n params.push(body.color);\n sets.push(`color = $${params.length}`);\n }\n if (!sets.length) return null;\n params.push(id);\n const rows = (await db().unsafe(\n `update brands set ${\n sets.join(\", \")\n } where id = $${params.length} returning *`,\n params as never[],\n )) as BrandRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteBrand(id: string): Promise {\n await db()`delete from brands where id = ${id}`;\n}\n\n/* ---------------------------------- tickets ------------------------------- */\n\nexport interface TicketRow {\n id: string;\n vault_id: string;\n name: string;\n brand_id: string | null;\n tags: string[];\n color: string;\n kind: string;\n file_name: string;\n mime_type: string;\n size: string | number;\n notes: string;\n amount: string | number;\n expires_at: Date | null;\n pinned: boolean;\n created_by: string | null;\n created_at: Date;\n updated_at: Date;\n brand_name?: string | null;\n created_by_name?: string | null;\n}\n\nexport async function listTickets(\n vaultId: string,\n q = \"\",\n): Promise {\n const sql = db();\n const needle = `%${q.trim()}%`;\n const search = q.trim()\n ? sql` and (\n t.name ilike ${needle}\n or t.notes ilike ${needle}\n or t.file_name ilike ${needle}\n or b.name ilike ${needle}\n or u.display_name ilike ${needle}\n or exists (select 1 from unnest(t.tags) tag where tag ilike ${needle})\n )`\n : sql``;\n return (await sql`\n select t.*, b.name as brand_name, u.display_name as created_by_name\n from tickets t\n left join brands b on b.id = t.brand_id\n left join users u on u.id = t.created_by\n where t.vault_id = ${vaultId} ${search}\n order by t.pinned desc, t.created_at desc`) as TicketRow[];\n}\n\nexport async function getTicket(\n vaultId: string,\n id: string,\n): Promise {\n const rows = (await db()`\n select t.*, b.name as brand_name, u.display_name as created_by_name\n from tickets t\n left join brands b on b.id = t.brand_id\n left join users u on u.id = t.created_by\n where t.vault_id = ${vaultId} and t.id = ${id}\n limit 1`) as TicketRow[];\n return rows[0] ?? null;\n}\n\nexport interface NewTicket {\n vaultId: string;\n name: string;\n brandId: string | null;\n tags: string[];\n color: string;\n kind: string;\n fileName: string;\n mimeType: string;\n size: number;\n notes: string;\n amount: number;\n expiresAt: string | null;\n createdBy: string;\n}\n\nexport async function insertTicket(t: NewTicket): Promise {\n const rows = (await db()`\n insert into tickets (vault_id, name, brand_id, tags, color, kind, file_name, mime_type, size, notes, amount, expires_at, created_by)\n values (${t.vaultId}, ${t.name}, ${t.brandId}, ${t.tags}, ${t.color}, ${t.kind}, ${t.fileName}, ${t.mimeType},\n ${t.size}, ${t.notes}, ${t.amount}, ${t.expiresAt}, ${t.createdBy})\n returning *`) as TicketRow[];\n return rows[0];\n}\n\nexport interface TicketPatch {\n name?: string;\n brandId?: string | null;\n tags?: string[];\n color?: string;\n notes?: string;\n amount?: number;\n expiresAt?: string | null;\n pinned?: boolean;\n}\n\nexport async function updateTicket(\n id: string,\n body: TicketPatch,\n): Promise {\n const sets: string[] = [];\n const params: unknown[] = [];\n if (body.name !== undefined) {\n params.push(body.name);\n sets.push(`name = $${params.length}`);\n }\n if (body.brandId !== undefined) {\n params.push(body.brandId);\n sets.push(`brand_id = $${params.length}::uuid`);\n }\n if (body.tags !== undefined) {\n params.push(body.tags);\n sets.push(`tags = $${params.length}::text[]`);\n }\n if (body.color !== undefined) {\n params.push(body.color);\n sets.push(`color = $${params.length}`);\n }\n if (body.notes !== undefined) {\n params.push(body.notes);\n sets.push(`notes = $${params.length}`);\n }\n if (body.amount !== undefined) {\n params.push(body.amount);\n sets.push(`amount = $${params.length}::numeric`);\n }\n if (body.expiresAt !== undefined) {\n params.push(body.expiresAt);\n sets.push(`expires_at = $${params.length}::timestamptz`);\n }\n if (body.pinned !== undefined) {\n params.push(body.pinned);\n sets.push(`pinned = $${params.length}::boolean`);\n }\n sets.push(\"updated_at = now()\");\n params.push(id);\n const rows = (await db().unsafe(\n `update tickets set ${\n sets.join(\", \")\n } where id = $${params.length}::uuid returning *`,\n params as never[],\n )) as TicketRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteTicket(id: string): Promise {\n await db().begin(async (tx) => {\n const rows =\n await tx`select vault_id, created_by, size from tickets where id = ${id} for update` as unknown as {\n vault_id: string;\n created_by: string | null;\n size: string | number;\n }[];\n if (!rows[0]) return;\n const size = Number(rows[0].size);\n await tx`delete from tickets where id = ${id}`;\n await tx`update vaults set storage_bytes = greatest(0, storage_bytes - ${size}) where id = ${\n rows[0].vault_id\n }`;\n if (rows[0].created_by) {\n await tx`update users set storage_bytes = greatest(0, storage_bytes - ${size}) where id = ${\n rows[0].created_by\n }`;\n }\n });\n}\n\n/** Métadonnées à mettre à jour quand le fichier d'un ticket est remplacé. */\nexport async function updateTicketFileMeta(\n id: string,\n meta: { fileName: string; mimeType: string; size: number; kind: string },\n): Promise {\n await db()`\n update tickets\n set file_name = ${meta.fileName}, mime_type = ${meta.mimeType}, size = ${meta.size},\n kind = ${meta.kind}, updated_at = now()\n where id = ${id}`.then(() => undefined);\n}\n\n/** Supprime les tickets expirés (d'un espace ou de tous) — les fichiers suivent par cascade. */\nexport async function purgeExpired(\n vaultId: string | null = null,\n): Promise {\n const ids = vaultId\n ? await db()`select id from tickets where vault_id = ${vaultId} and expires_at is not null and expires_at < now()`\n : await db()`select id from tickets where expires_at is not null and expires_at < now()`;\n for (const row of ids as unknown as { id: string }[]) {\n await deleteTicket(row.id);\n }\n return ids.length;\n}\n\n/* ---------------------------------- files --------------------------------- */\n\nexport interface FileRow {\n ticket_id: string;\n data: Uint8Array;\n mime_type: string;\n file_name: string;\n size: string | number;\n}\n\nexport async function upsertFile(\n ticketId: string,\n data: Uint8Array,\n mimeType: string,\n fileName: string,\n): Promise {\n await db().begin(async (tx) => {\n const rows =\n await tx`select vault_id, created_by, size from tickets where id = ${ticketId} for update` as unknown as {\n vault_id: string;\n created_by: string | null;\n size: string | number;\n }[];\n if (!rows[0]) throw new DbError(404, \"Ticket introuvable\");\n const oldSize = Number(rows[0].size);\n const delta = data.byteLength - oldSize;\n const quota = 1073741824;\n const usage = await tx`select storage_bytes from vaults where id = ${\n rows[0].vault_id\n } for update` as unknown as { storage_bytes: string | number }[];\n if (Number(usage[0]?.storage_bytes ?? 0) + delta > quota) {\n throw new DbError(413, \"Quota de stockage de l'espace dépassé (1 Gio)\");\n }\n if (rows[0].created_by) {\n const account = await tx`select storage_bytes from users where id = ${\n rows[0].created_by\n } for update` as unknown as { storage_bytes: string | number }[];\n if (Number(account[0]?.storage_bytes ?? 0) + delta > quota) {\n throw new DbError(413, \"Quota de stockage du compte dépassé (1 Gio)\");\n }\n }\n await tx`insert into files (ticket_id, data, mime_type, file_name, size)\n values (${ticketId}, ${data}, ${mimeType}, ${fileName}, ${data.byteLength})\n on conflict (ticket_id) do update set data = excluded.data, mime_type = excluded.mime_type,\n file_name = excluded.file_name, size = excluded.size, uploaded_at = now()`;\n await tx`update vaults set storage_bytes = storage_bytes + ${delta} where id = ${\n rows[0].vault_id\n }`;\n if (rows[0].created_by) {\n await tx`update users set storage_bytes = storage_bytes + ${delta} where id = ${\n rows[0].created_by\n }`;\n }\n });\n}\n\nexport async function getFile(ticketId: string): Promise {\n const rows =\n (await db()`select * from files where ticket_id = ${ticketId} limit 1`) as FileRow[];\n return rows[0] ?? null;\n}\n\n/* ------------------------------ préférences ------------------------------- */\n\nfunction parseJsonb(value: unknown): Record {\n if (typeof value === \"string\") {\n try {\n return JSON.parse(value) as Record;\n } catch {\n return {};\n }\n }\n return (value as Record) ?? {};\n}\n\nexport async function getPreferences(\n userId: string,\n): Promise> {\n const rows =\n (await db()`select data from preferences where user_id = ${userId} limit 1`) as unknown as {\n data: unknown;\n }[];\n return rows[0] ? parseJsonb(rows[0].data) : {};\n}\n\nexport async function savePreferences(\n userId: string,\n data: Record,\n): Promise> {\n const rows = (await db()`\n insert into preferences (user_id, data, updated_at)\n values (${userId}, ${JSON.stringify(data)}, now())\n on conflict (user_id) do update\n set data = ${JSON.stringify(data)}, updated_at = now()\n returning data`) as unknown as { data: unknown }[];\n return rows[0] ? parseJsonb(rows[0].data) : data;\n}\n\n/* -------------------------------- rappels --------------------------------- */\n\nexport interface ReminderRow {\n id: string;\n vault_id: string;\n created_by: string | null;\n title: string;\n notes: string;\n kind: string;\n due_at: Date | null;\n done: boolean;\n ticket_id: string | null;\n brand_id: string | null;\n tags: string[];\n recurrence: string; // 'none' | 'daily' | 'weekly' | 'monthly' | 'yearly'\n created_at: Date;\n completed_at: Date | null;\n last_completed_at: Date | null;\n created_by_name?: string | null;\n ticket_name?: string | null;\n brand_name?: string | null;\n}\n\nexport async function listReminders(\n vaultId: string,\n includeDone = true,\n): Promise {\n const sql = db();\n const filter = includeDone ? sql`` : sql` where r.done = false`;\n return (await sql`\n select r.*, u.display_name as created_by_name, t.name as ticket_name, b.name as brand_name\n from reminders r\n left join users u on u.id = r.created_by\n left join tickets t on t.id = r.ticket_id\n left join brands b on b.id = r.brand_id\n ${filter}\n order by r.done asc, r.due_at asc nulls last, r.created_at desc`) as unknown as ReminderRow[];\n}\n\nexport async function getReminder(\n vaultId: string,\n id: string,\n): Promise {\n const rows = (await db()`\n select r.*, u.display_name as created_by_name, t.name as ticket_name, b.name as brand_name\n from reminders r\n left join users u on u.id = r.created_by\n left join tickets t on t.id = r.ticket_id\n left join brands b on b.id = r.brand_id\n where r.vault_id = ${vaultId} and r.id = ${id}\n limit 1`) as unknown as ReminderRow[];\n return rows[0] ?? null;\n}\n\n/** Date de la prochaine occurrence pour un rappel récurrent. */\nexport function nextRecurrenceDate(\n from: Date,\n recurrence: string,\n): Date | null {\n const d = new Date(from);\n switch (recurrence) {\n case \"daily\":\n d.setDate(d.getDate() + 1);\n return d;\n case \"weekly\":\n d.setDate(d.getDate() + 7);\n return d;\n case \"monthly\":\n d.setMonth(d.getMonth() + 1);\n return d;\n case \"yearly\":\n d.setFullYear(d.getFullYear() + 1);\n return d;\n default:\n return null;\n }\n}\n\nexport interface NewReminder {\n vaultId: string;\n createdBy: string;\n title: string;\n notes: string;\n kind: string;\n dueAt: string | null;\n ticketId: string | null;\n brandId: string | null;\n tags: string[];\n recurrence: string;\n}\n\nexport async function insertReminder(r: NewReminder): Promise {\n const rows = (await db()`\n insert into reminders (vault_id, created_by, title, notes, kind, due_at, ticket_id, brand_id, tags, recurrence)\n values (${r.vaultId}, ${r.createdBy}, ${r.title}, ${r.notes}, ${r.kind}, ${r.dueAt}, ${r.ticketId},\n ${r.brandId}, ${r.tags}, ${r.recurrence})\n returning *`) as unknown as ReminderRow[];\n return rows[0];\n}\n\nexport interface ReminderPatch {\n title?: string;\n notes?: string;\n dueAt?: string | null;\n done?: boolean;\n brandId?: string | null;\n tags?: string[];\n recurrence?: string;\n /** Marque l'occurrence comme traitée (rappel récurrent replanifié). */\n completedNow?: boolean;\n}\n\nexport async function updateReminder(\n id: string,\n body: ReminderPatch,\n): Promise {\n const sets: string[] = [];\n const params: unknown[] = [];\n if (body.title !== undefined) {\n params.push(body.title);\n sets.push(`title = $${params.length}`);\n }\n if (body.notes !== undefined) {\n params.push(body.notes);\n sets.push(`notes = $${params.length}`);\n }\n if (body.dueAt !== undefined) {\n params.push(body.dueAt);\n sets.push(`due_at = $${params.length}::timestamptz`);\n }\n if (body.brandId !== undefined) {\n params.push(body.brandId);\n sets.push(`brand_id = $${params.length}::uuid`);\n }\n if (body.tags !== undefined) {\n params.push(body.tags);\n sets.push(`tags = $${params.length}::text[]`);\n }\n if (body.recurrence !== undefined) {\n params.push(body.recurrence);\n sets.push(`recurrence = $${params.length}`);\n }\n if (body.done !== undefined) {\n params.push(body.done);\n sets.push(`done = $${params.length}::boolean`);\n if (body.done) {\n sets.push(\"completed_at = now(), last_completed_at = now()\");\n } else {\n sets.push(\"completed_at = null\");\n }\n }\n if (body.completedNow) {\n sets.push(\"completed_at = now(), last_completed_at = now()\");\n }\n if (!sets.length) return null;\n params.push(id);\n const rows = (await db().unsafe(\n `update reminders set ${\n sets.join(\", \")\n } where id = $${params.length}::uuid returning *`,\n params as never[],\n )) as unknown as ReminderRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteReminder(id: string): Promise {\n await db()`delete from reminders where id = ${id}`;\n}\n\n/* --------------------------- journal de notifications --------------------- */\n\n/** Enregistre « notification déjà envoyée aujourd'hui » ; renvoie true si c'est la 1re fois. */\nexport async function logNotification(\n userId: string,\n type: string,\n refId: string,\n): Promise {\n const rows = (await db()`\n insert into notification_log (user_id, type, ref_id, day)\n values (${userId}, ${type}, ${refId}, current_date)\n on conflict (user_id, type, ref_id, day) do nothing\n returning id`) as unknown as { id: string }[];\n return rows.length > 0;\n}\n\n/* ---------------------------------- stats --------------------------------- */\n\nexport interface StatsRow {\n tickets: number;\n brands: number;\n tags: number;\n expiringSoon: number;\n withExpiry: number;\n pdfs: number;\n images: number;\n bytes: number;\n /** Total dépensé (somme des montants renseignés) et nombre de dépenses. */\n spent: number;\n expenses: number;\n byBrand: Record;\n byTag: Record;\n}\n\nexport async function computeStats(vaultId: string): Promise {\n const sql = db();\n const totals = await sql`\n select\n count(*)::int as tickets,\n count(*) filter (where kind = 'pdf')::int as pdfs,\n count(*) filter (where kind = 'image')::int as images,\n coalesce(sum(size), 0)::bigint as bytes,\n count(*) filter (where expires_at is not null)::int as with_expiry,\n count(*) filter (where expires_at >= now() and expires_at < now() + interval '7 days')::int as expiring_soon,\n coalesce(sum(amount), 0)::float8 as spent,\n count(*) filter (where amount > 0)::int as expenses\n from tickets where vault_id = ${vaultId}`;\n const brandCount =\n await sql`select count(*)::int as n from brands where vault_id = ${vaultId}`;\n const byBrand = await sql`\n select coalesce(b.name, 'Sans marque') as label, count(*)::int as n\n from tickets t left join brands b on b.id = t.brand_id\n where t.vault_id = ${vaultId}\n group by 1 order by n desc`;\n const byTag = await sql`\n select tag, count(*)::int as n\n from tickets t, unnest(t.tags) as tag\n where t.vault_id = ${vaultId}\n group by 1 order by n desc`;\n const t = totals[0];\n return {\n tickets: t.tickets,\n brands: brandCount[0].n,\n tags: byTag.length,\n expiringSoon: t.expiring_soon,\n withExpiry: t.with_expiry,\n pdfs: t.pdfs,\n images: t.images,\n bytes: Number(t.bytes),\n spent: Number(t.spent),\n expenses: t.expenses,\n byBrand: Object.fromEntries(byBrand.map((r) => [r.label, r.n])),\n byTag: Object.fromEntries(byTag.map((r) => [r.tag, r.n])),\n };\n}\n\nexport async function listTags(vaultId: string): Promise {\n const rows = await db()`\n select distinct tag from tickets t, unnest(t.tags) as tag\n where t.vault_id = ${vaultId} order by tag asc`;\n return (rows as unknown as { tag: string }[]).map((r) => r.tag);\n}","createdAt",["D",1788077630434],"branchVersion","branchId","f409cc80-4dfe-4648-826c-5f94984b93a7","id","67d3ebca-0208-40ef-9e43-526d7a9d01a3","eticket",["D",1787751631620],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","","imageUrl","7ed13655-83c2-4934-a981-01578302df33","pinnedFileId","b50ac696-a153-11f1-85e9-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f99eb-d944-7332-99f8-2fbb8b1e7011","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":48},"branch",{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"isOwned",17,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mdevslabs","handle","displayName","mProjects","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/ec72623f-c02d-461a-9b1c-c2f416214400/square512?exp=1789538399&sig=b90c7895d89b2c8a9d976c298024ed06d954dd92e3be0b0905971776951516a4","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_32":44,"_37":169,"_46":-5,"_47":48,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":170,"_80":171,"_82":172,"_84":48},"tree",[160,161],"files",[160,161],"counts",{"_148":62,"_149":150,"_151":62,"_152":153,"_154":155},"contents",[126,127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":140,"_32":141,"_30":57,"_131":-5,"_40":41,"_39":142,"_133":48,"_37":143,"_13":144,"_33":145,"_35":146,"_24":48,"_138":44,"_27":147},{"_42":128,"_32":129,"_30":130,"_131":-5,"_40":41,"_39":132,"_133":25,"_37":134,"_13":135,"_33":136,"_35":137,"_24":48,"_138":-5,"_27":139},"3f2cc61b-8cdd-4025-bd4e-9fb44ea489e1","purge.ts","60942de0-a154-11f1-94ff-1607ee4eb77e","parentId",8,"latest",["D",1787751953719],4,"interval","/**\n * E-Ticket — Cron val Val Town (optionnel)\n * -----------------------------------------------------------------------------\n * Crée un Val « Scheduled » qui tourne 1× / jour et colle ce fichier.\n * Il appelle le HTTP val pour supprimer les tickets dont la date d'expiration\n * est dépassée — même si personne n'ouvre l'application.\n *\n * Variables : API_BASE_URL (https://xxx.web.val.run) et CRON_SECRET.\n */\n\nexport default async function purgeExpiredTickets() {\n const base = (Deno.env.get(\"API_BASE_URL\") ?? \"\").replace(/\\/$/, \"\");\n const secret = Deno.env.get(\"CRON_SECRET\") ?? \"\";\n if (!base || !secret) {\n console.error(\"API_BASE_URL ou CRON_SECRET manquant\");\n return;\n }\n const res = await fetch(`${base}/internal/purge`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${secret}` },\n });\n const body = await res.text();\n console.log(\"purge\", res.status, body);\n}","label",[129],"dace8e68-0bfb-4106-b21e-31e55d751e1d","main.ts",15,["D",1788077619180],5,"http","/**\n * E-Ticket — HTTP val Val Town\n * -----------------------------------------------------------------------------\n * Colle ce fichier dans un Val HTTP (nom suggéré : eticket).\n * Déclare les variables d'environnement dans Val Town (voir /.env.example).\n *\n * Auth : OAuth 2.0 Resource Owner Password Credentials\n * POST /oauth/token (grant_type=password)\n * Stockage : Z1 Storage (S3) — un index JSON + fichiers, aucune base SQL.\n *\n * Coffres famille : un seul mot de passe partagé, tickets communs.\n */\n\nimport { AwsClient } from \"https://esm.sh/aws4fetch@1.0.20\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\ntype TicketKind = \"pdf\" | \"image\" | \"other\";\n\ninterface Brand {\n id: string;\n name: string;\n color: string;\n createdAt: string;\n}\n\ninterface Ticket {\n id: string;\n name: string;\n brandId: string | null;\n tags: string[];\n color: string;\n kind: TicketKind;\n fileName: string;\n mimeType: string;\n size: number;\n notes: string;\n expiresAt: string | null;\n createdAt: string;\n updatedAt: string;\n createdBy: string;\n storageKey: string;\n}\n\ninterface VaultIndex {\n version: number;\n brands: Brand[];\n tickets: Ticket[];\n updatedAt: string;\n}\n\ninterface AuthRecord {\n algo: \"pbkdf2-sha256\";\n iterations: number;\n salt: string;\n hash: string;\n updatedAt: string;\n /** Incrémenté à chaque changement de mot de passe — permet de révoquer les JWT */\n authVersion: number;\n}\n\nconst ITERATIONS = 120_000;\nconst TOKEN_TTL_SEC = 60 * 60 * 24 * 7;\n\n// Helpers sanitization\nfunction sanitizeDisplayName(raw: string): string {\n // Limite 32 car, retire \\r\\n et contrôles, trim\n const s = raw.trim().replace(/[\\r\\n\\t]/g, \" \").replace(/\\s+/g, \" \").slice(\n 0,\n 32,\n );\n // Retire caractères de contrôle restants\n return s.replace(/[\\x00-\\x1F\\x7F]/g, \"\") || \"Famille\";\n}\n\nfunction sanitizeColor(input: string, fallback = \"#c45c26\"): string {\n const s = String(input).trim();\n if (/^#[0-9a-fA-F]{6}$/.test(s)) return s.toLowerCase();\n if (/^#[0-9a-fA-F]{3}$/.test(s)) {\n return `#${s[1]}${s[1]}${s[2]}${s[2]}${s[3]}${s[3]}`.toLowerCase();\n }\n return fallback;\n}\n\nfunction sanitizeFileName(raw: string): string {\n // basename + retire \\r\\n \" ; / \\ et ..\n let name = raw.split(\"/\").pop() ?? raw;\n name = name.split(\"\\\\\").pop() ?? name;\n name = name.replace(/[\\r\\n\"]/g, \"\").replace(/;/g, \"\").replace(/\\.\\.+/g, \".\")\n .trim();\n // Limite 120 car\n if (name.length > 120) {\n const ext = name.includes(\".\")\n ? `.${name.split(\".\").pop()!.slice(0, 10)}`\n : \"\";\n name = `${name.slice(0, 120 - ext.length)}${ext}`;\n }\n return name || \"ticket.bin\";\n}\n\nfunction sanitizeStorageKey(id: string, fileName: string): string {\n const safe = sanitizeFileName(fileName);\n return `files/${id}/${safe}`.replace(/\\/+/g, \"/\");\n}\n\nfunction validateExpiresAt(raw: unknown): string | null {\n if (raw == null || raw === \"\") return null;\n const s = String(raw).trim();\n const ms = Date.parse(s);\n if (Number.isNaN(ms)) {\n throw new HttpError(400, \"Date d'expiration invalide (ISO attendu)\");\n }\n // Normalise en ISO\n return new Date(ms).toISOString();\n}\n\nfunction env(name: string, fallback = \"\"): string {\n return (Deno.env.get(name) ?? fallback).trim();\n}\n\nfunction requiredEnv(name: string): string {\n const v = env(name);\n if (!v) throw new HttpError(500, `Variable manquante : ${name}`);\n return v;\n}\n\nfunction s3(): {\n client: AwsClient;\n bucket: string;\n prefix: string;\n endpoint: string;\n} {\n const accessKey = requiredEnv(\"Z1_ACCESS_KEY\");\n const secretKey = requiredEnv(\"Z1_SECRET_KEY\");\n const bucket = requiredEnv(\"Z1_BUCKET\");\n const endpoint = env(\"Z1_ENDPOINT\", \"https://s3.z1storage.com\").replace(\n /\\/$/,\n \"\",\n );\n const region = env(\"Z1_REGION\", \"default\");\n const prefix = env(\"Z1_PREFIX\", \"eticket\").replace(/^\\/|\\/$/g, \"\");\n const client = new AwsClient({\n accessKeyId: accessKey,\n secretAccessKey: secretKey,\n region,\n service: \"s3\",\n });\n return { client, bucket, prefix, endpoint };\n}\n\nfunction objectUrl(endpoint: string, bucket: string, key: string): string {\n return `${endpoint}/${bucket}/${\n key.split(\"/\").map(encodeURIComponent).join(\"/\")\n }`;\n}\n\nasync function s3Send(\n method: string,\n key: string,\n body?: Uint8Array | string | null,\n contentType?: string,\n): Promise {\n const { client, bucket, prefix, endpoint } = s3();\n const fullKey = `${prefix}/${key}`.replace(/\\/+/g, \"/\");\n const headers: Record = {};\n if (contentType) headers[\"content-type\"] = contentType;\n if (body != null) {\n headers[\"content-length\"] = String(\n typeof body === \"string\"\n ? encoder.encode(body).byteLength\n : body.byteLength,\n );\n }\n return await client.fetch(objectUrl(endpoint, bucket, fullKey), {\n method,\n headers,\n body: body as unknown as BodyInit | undefined,\n });\n}\n\nasync function s3Get(\n key: string,\n): Promise<{ status: number; bytes: Uint8Array; type: string }> {\n const res = await s3Send(\"GET\", key);\n const bytes = new Uint8Array(await res.arrayBuffer());\n return {\n status: res.status,\n bytes,\n type: res.headers.get(\"content-type\") ?? \"application/octet-stream\",\n };\n}\n\nasync function s3Put(\n key: string,\n body: Uint8Array | string,\n contentType: string,\n): Promise {\n const res = await s3Send(\"PUT\", key, body, contentType);\n if (!res.ok) {\n // Ne pas exposer le body S3 au client (fuite info)\n console.error(`Z1 Storage PUT ${res.status} ${key}`);\n throw new HttpError(502, `Erreur de stockage (${res.status})`);\n }\n}\n\nasync function s3Delete(key: string): Promise {\n const res = await s3Send(\"DELETE\", key);\n if (!res.ok && res.status !== 404) {\n console.error(`Z1 Storage DELETE ${res.status} ${key}`);\n throw new HttpError(502, `Erreur de stockage (${res.status})`);\n }\n}\n\nclass HttpError extends Error {\n status: number;\n constructor(status: number, message: string) {\n super(message);\n this.status = status;\n }\n}\n\nfunction json(data: unknown, status = 200, extra: HeadersInit = {}): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...extra },\n });\n}\n\nfunction corsHeaders(req: Request): Record {\n const allowed = env(\"CORS_ORIGIN\", \"*\");\n const origin = req.headers.get(\"origin\") ?? \"\";\n // Si * autorisé partout, on renvoie * sans Vary\n if (allowed === \"*\") {\n return {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-headers\":\n \"Authorization, Content-Type, X-Display-Name\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n };\n }\n const list = allowed.split(\",\").map((s) => s.trim()).filter(Boolean);\n if (list.includes(\"*\")) {\n return {\n \"access-control-allow-origin\": \"*\",\n \"access-control-allow-headers\":\n \"Authorization, Content-Type, X-Display-Name\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n };\n }\n // Pas de fallback vers list[0] : si origin non autorisé, on ne renvoie pas ACAO (le navigateur bloquera)\n if (origin && list.includes(origin)) {\n return {\n \"access-control-allow-origin\": origin,\n \"access-control-allow-headers\":\n \"Authorization, Content-Type, X-Display-Name\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n \"vary\": \"Origin\",\n };\n }\n // Pas d'origin ou origin non listé : pas de header ACAO (ou on pourrait renvoyer 403 côté route)\n return {\n \"access-control-allow-headers\":\n \"Authorization, Content-Type, X-Display-Name\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n \"vary\": \"Origin\",\n };\n}\n\nfunction withCors(req: Request, res: Response): Response {\n const headers = new Headers(res.headers);\n for (const [k, v] of Object.entries(corsHeaders(req))) headers.set(k, v);\n return new Response(res.body, { status: res.status, headers });\n}\n\nfunction b64url(bytes: Uint8Array): string {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\n \"=\",\n \"\",\n );\n}\n\nfunction b64urlDecode(s: string): Uint8Array {\n const pad = s.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (s.length % 4));\n const b64 = s.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + pad;\n let bin: string;\n try {\n bin = atob(b64);\n } catch {\n throw new HttpError(401, \"Jeton invalide\");\n }\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt: salt as unknown as ArrayBuffer,\n iterations,\n },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\n\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\nfunction timingSafeEqualString(a: string, b: string): boolean {\n const ab = encoder.encode(a);\n const bb = encoder.encode(b);\n if (ab.length !== bb.length) {\n // Comparaison dummy pour garder temps constant quand longueurs diffèrent\n // On compare quand même jusqu'à max len avec différence forcée\n const max = Math.max(ab.length, bb.length);\n let diff = ab.length ^ bb.length;\n for (let i = 0; i < max; i++) diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);\n return false;\n }\n return timingSafeEqual(ab, bb);\n}\n\nasync function hmac(secret: string, data: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n return new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data)),\n );\n}\n\nasync function signJwt(payload: Record): Promise {\n const header = b64url(\n encoder.encode(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" })),\n );\n const body = b64url(encoder.encode(JSON.stringify(payload)));\n const sig = b64url(\n await hmac(requiredEnv(\"JWT_SECRET\"), `${header}.${body}`),\n );\n return `${header}.${body}.${sig}`;\n}\n\nasync function verifyJwt(\n token: string,\n): Promise<{ sub: string; name: string; exp: number; av?: number }> {\n const parts = token.split(\".\");\n if (parts.length !== 3) throw new HttpError(401, \"Jeton invalide\");\n // Validation header alg\n let header: { alg?: string };\n try {\n header = JSON.parse(decoder.decode(b64urlDecode(parts[0])));\n } catch {\n throw new HttpError(401, \"Jeton invalide\");\n }\n if (header.alg !== \"HS256\") throw new HttpError(401, \"Jeton invalide\");\n let payload: { sub: string; name: string; exp: number; av?: number };\n try {\n payload = JSON.parse(decoder.decode(b64urlDecode(parts[1])));\n } catch {\n throw new HttpError(401, \"Jeton invalide\");\n }\n const expectedSig = b64url(\n await hmac(requiredEnv(\"JWT_SECRET\"), `${parts[0]}.${parts[1]}`),\n );\n // Comparaison timing-safe\n const sigBytes = encoder.encode(parts[2]);\n const expBytes = encoder.encode(expectedSig);\n const sigOk = timingSafeEqual(sigBytes, expBytes) && parts[2] === expectedSig;\n if (!sigOk) throw new HttpError(401, \"Jeton invalide\");\n if (typeof payload.exp !== \"number\" || payload.exp * 1000 < Date.now()) {\n throw new HttpError(401, \"Session expirée\");\n }\n if (typeof payload.sub !== \"string\" || typeof payload.name !== \"string\") {\n throw new HttpError(401, \"Jeton invalide\");\n }\n // Vérification authVersion : si auth.json a une version plus récente, le token est révoqué\n const rec = await readJson(\"auth.json\").catch(() => null);\n const currentAv = rec?.authVersion ?? 0;\n if (typeof payload.av === \"number\" && payload.av < currentAv) {\n throw new HttpError(401, \"Session expirée — mot de passe changé\");\n }\n // Si pas de av dans token et qu'on a déjà changé le mdp au moins une fois, on invalide les vieux tokens sans av\n if (payload.av == null && currentAv > 0) {\n // Tolérance : les tokens émis avant l'introduction de av restent valides jusqu'à expiration,\n // mais après un changement de mdp ils seront rejetés car currentAv > 0 et pas de av.\n // On exige désormais av.\n throw new HttpError(401, \"Session expirée — reconnecte-toi\");\n }\n return payload;\n}\n\nasync function requireAuth(req: Request): Promise<{ name: string }> {\n const header = req.headers.get(\"authorization\") ?? \"\";\n const m = header.match(/^Bearer\\s+(.+)$/i);\n if (!m) throw new HttpError(401, \"Authentification requise\");\n const payload = await verifyJwt(m[1].trim());\n const rawDisplay = req.headers.get(\"x-display-name\")?.trim() ||\n payload.name || \"Famille\";\n const name = sanitizeDisplayName(rawDisplay);\n return { name };\n}\n\nasync function readJson(key: string): Promise {\n const { status, bytes } = await s3Get(key);\n if (status === 404) return null;\n if (status >= 400) {\n console.error(`Z1 lecture ${key} : ${status}`);\n throw new HttpError(502, `Erreur de lecture (${status})`);\n }\n try {\n return JSON.parse(decoder.decode(bytes)) as T;\n } catch {\n console.error(`Z1 JSON parse error ${key}`);\n throw new HttpError(502, \"Erreur de lecture\");\n }\n}\n\nasync function writeJson(key: string, data: unknown): Promise {\n await s3Put(key, JSON.stringify(data, null, 2), \"application/json\");\n}\n\nfunction emptyIndex(): VaultIndex {\n return {\n version: 1,\n brands: [],\n tickets: [],\n updatedAt: new Date().toISOString(),\n };\n}\n\nasync function loadIndex(): Promise {\n const idx = await readJson(\"index.json\");\n return idx ?? emptyIndex();\n}\n\nasync function saveIndex(index: VaultIndex): Promise {\n index.version = (index.version ?? 0) + 1;\n index.updatedAt = new Date().toISOString();\n await writeJson(\"index.json\", index);\n return index;\n}\n\n/** Purge en mémoire sans sauver — pour les handlers d'écriture (évite double save) */\nfunction stripExpiredInPlace(index: VaultIndex): Ticket[] {\n const now = Date.now();\n const keep: Ticket[] = [];\n const removed: Ticket[] = [];\n for (const t of index.tickets) {\n const exp = t.expiresAt ? Date.parse(t.expiresAt) : NaN;\n // Si expiresAt invalide (NaN), on garde (mais sera corrigé à la validation)\n if (t.expiresAt && !Number.isNaN(exp) && exp < now) removed.push(t);\n else keep.push(t);\n }\n if (removed.length) {\n // Best-effort deletion des blobs, sans bloquer si échec\n // On ne fait pas await ici dans stripExpiredInPlace synchrone ; caller fera best-effort async\n index.tickets = keep;\n }\n return removed;\n}\n\nasync function deleteBlobsBestEffort(tickets: Ticket[]): Promise {\n for (const t of tickets) {\n if (!t.storageKey) continue;\n try {\n await s3Delete(t.storageKey);\n } catch {\n /* best-effort */\n }\n }\n}\n\nasync function purgeExpired(\n index: VaultIndex,\n): Promise<{ index: VaultIndex; removed: Ticket[] }> {\n const now = Date.now();\n const keep: Ticket[] = [];\n const removed: Ticket[] = [];\n for (const t of index.tickets) {\n const exp = t.expiresAt ? Date.parse(t.expiresAt) : NaN;\n if (t.expiresAt && !Number.isNaN(exp) && exp < now) removed.push(t);\n else keep.push(t);\n }\n if (!removed.length) return { index, removed };\n await deleteBlobsBestEffort(removed);\n index.tickets = keep;\n await saveIndex(index);\n return { index, removed };\n}\n\nasync function ensureAuthRecord(): Promise {\n return await readJson(\"auth.json\");\n}\n\nasync function verifyPassword(password: string): Promise {\n if (!password) return false;\n const bootstrap = env(\"VAULT_PASSWORD\");\n const rec = await ensureAuthRecord();\n if (rec) {\n const salt = b64urlDecode(rec.salt);\n const got = await pbkdf2(password, salt, rec.iterations);\n const expected = b64urlDecode(rec.hash);\n if (timingSafeEqual(got, expected)) return true;\n // Mot de passe de récupération toujours accepté — timing-safe\n if (bootstrap && timingSafeEqualString(password, bootstrap)) return true;\n return false;\n }\n if (bootstrap && timingSafeEqualString(password, bootstrap)) {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await pbkdf2(password, salt, ITERATIONS);\n const record: AuthRecord = {\n algo: \"pbkdf2-sha256\",\n iterations: ITERATIONS,\n salt: b64url(salt),\n hash: b64url(hash),\n updatedAt: new Date().toISOString(),\n authVersion: 0,\n };\n await writeJson(\"auth.json\", record);\n return true;\n }\n return false;\n}\n\nasync function issueToken(\n displayName: string,\n): Promise<{ access_token: string; token_type: string; expires_in: number }> {\n const now = Math.floor(Date.now() / 1000);\n const name = sanitizeDisplayName(displayName);\n const rec = await readJson(\"auth.json\").catch(() => null);\n const av = rec?.authVersion ?? 0;\n const access_token = await signJwt({\n sub: \"family-vault\",\n name,\n av,\n iat: now,\n exp: now + TOKEN_TTL_SEC,\n });\n return { access_token, token_type: \"Bearer\", expires_in: TOKEN_TTL_SEC };\n}\n\nfunction kindFromMime(mime: string, fileName: string): TicketKind {\n if (mime === \"application/pdf\" || fileName.toLowerCase().endsWith(\".pdf\")) {\n return \"pdf\";\n }\n if (mime.startsWith(\"image/\")) return \"image\";\n return \"other\";\n}\n\nfunction slugId(): string {\n return crypto.randomUUID();\n}\n\nfunction parseTags(input: unknown): string[] {\n if (Array.isArray(input)) {\n return [\n ...new Set(\n input.map((t) => String(t).trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n if (typeof input === \"string\") {\n return [\n ...new Set(\n input.split(/[,;#]/).map((t) => t.trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n return [];\n}\n\nasync function readBody(req: Request): Promise> {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n const text = await req.text();\n const params = new URLSearchParams(text);\n const out: Record = {};\n for (const [k, v] of params) out[k] = v;\n return out;\n }\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const out: Record = {};\n for (const [k, v] of form.entries()) {\n if (typeof v === \"string\") out[k] = v;\n else out[k] = v;\n }\n return out;\n }\n if (!ct || ct.includes(\"application/json\")) {\n const text = await req.text();\n if (!text) return {};\n try {\n return JSON.parse(text);\n } catch {\n throw new HttpError(400, \"JSON invalide\");\n }\n }\n return {};\n}\n\nfunction ticketPublic(t: Ticket) {\n return {\n id: t.id,\n name: t.name,\n brandId: t.brandId,\n tags: t.tags,\n color: t.color,\n kind: t.kind,\n fileName: t.fileName,\n mimeType: t.mimeType,\n size: t.size,\n notes: t.notes,\n expiresAt: t.expiresAt,\n createdAt: t.createdAt,\n updatedAt: t.updatedAt,\n createdBy: t.createdBy,\n hasFile: Boolean(t.storageKey),\n };\n}\n\nfunction computeStats(index: VaultIndex) {\n const now = Date.now();\n const soon = now + 7 * 24 * 3600 * 1000;\n const byBrand: Record = {};\n const byTag: Record = {};\n let expiringSoon = 0;\n let withExpiry = 0;\n let bytes = 0;\n let pdfs = 0;\n let images = 0;\n for (const t of index.tickets) {\n bytes += t.size || 0;\n if (t.kind === \"pdf\") pdfs++;\n if (t.kind === \"image\") images++;\n if (t.expiresAt) {\n withExpiry++;\n const exp = Date.parse(t.expiresAt);\n if (!Number.isNaN(exp) && exp >= now && exp <= soon) expiringSoon++;\n }\n const brand = index.brands.find((b) => b.id === t.brandId);\n const label = brand?.name ?? \"Sans marque\";\n byBrand[label] = (byBrand[label] ?? 0) + 1;\n for (const tag of t.tags) byTag[tag] = (byTag[tag] ?? 0) + 1;\n }\n return {\n tickets: index.tickets.length,\n brands: index.brands.length,\n tags: Object.keys(byTag).length,\n expiringSoon,\n withExpiry,\n pdfs,\n images,\n bytes,\n byBrand,\n byTag,\n updatedAt: index.updatedAt,\n };\n}\n\nasync function handleLogin(req: Request): Promise {\n const body = await readBody(req);\n const password = String(body.password ?? \"\");\n const displayName = String(\n body.username ?? body.displayName ?? body.name ?? \"Famille\",\n );\n const grant = String(body.grant_type ?? \"password\");\n if (grant !== \"password\") {\n throw new HttpError(400, \"grant_type non supporté (utiliser password)\");\n }\n const ok = await verifyPassword(password);\n if (!ok) throw new HttpError(401, \"Mot de passe incorrect\");\n const token = await issueToken(displayName);\n return json({\n ...token,\n scope: \"vault.family\",\n vault: \"shared\",\n displayName: sanitizeDisplayName(displayName),\n });\n}\n\nasync function handlePasswordChange(req: Request): Promise {\n await requireAuth(req);\n const body = await readBody(req);\n const current = String(body.current ?? body.oldPassword ?? \"\");\n const next = String(body.next ?? body.newPassword ?? \"\");\n if (next.length < 8) {\n throw new HttpError(\n 400,\n \"Nouveau mot de passe trop court (8 caractères min.)\",\n );\n }\n if (!(await verifyPassword(current))) {\n throw new HttpError(401, \"Mot de passe actuel incorrect\");\n }\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await pbkdf2(next, salt, ITERATIONS);\n const existing = await readJson(\"auth.json\");\n const nextVersion = (existing?.authVersion ?? 0) + 1;\n const record: AuthRecord = {\n algo: \"pbkdf2-sha256\",\n iterations: ITERATIONS,\n salt: b64url(salt),\n hash: b64url(hash),\n updatedAt: new Date().toISOString(),\n authVersion: nextVersion,\n };\n await writeJson(\"auth.json\", record);\n return json({\n ok: true,\n message:\n \"Mot de passe coffre mis à jour. Les autres appareils devront se reconnecter.\",\n });\n}\n\nfunction filterTickets(index: VaultIndex, url: URL): Ticket[] {\n const q = (url.searchParams.get(\"q\") ?? \"\").trim().toLowerCase();\n const brandId = url.searchParams.get(\"brand\") ?? \"\";\n const tag = (url.searchParams.get(\"tag\") ?? \"\").trim().toLowerCase();\n const color = url.searchParams.get(\"color\") ?? \"\";\n const kind = url.searchParams.get(\"kind\") ?? \"\";\n const expiring = url.searchParams.get(\"expiring\") ?? \"\";\n const now = Date.now();\n const soon = now + 7 * 24 * 3600 * 1000;\n return index.tickets.filter((t) => {\n if (brandId && t.brandId !== brandId) return false;\n if (tag && !t.tags.includes(tag)) return false;\n if (color && t.color.toLowerCase() !== color.toLowerCase()) return false;\n if (kind && t.kind !== kind) return false;\n if (expiring === \"soon\") {\n if (!t.expiresAt) return false;\n const exp = Date.parse(t.expiresAt);\n if (Number.isNaN(exp) || !(exp >= now && exp <= soon)) return false;\n }\n if (q) {\n const brand = index.brands.find((b) => b.id === t.brandId)?.name ?? \"\";\n const hay = `${t.name} ${t.notes} ${t.fileName} ${\n t.tags.join(\" \")\n } ${brand} ${t.createdBy}`.toLowerCase();\n if (!hay.includes(q)) return false;\n }\n return true;\n });\n}\n\nasync function handleCreateTicket(\n req: Request,\n actor: string,\n): Promise {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let meta: Record = {};\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n for (const [k, v] of form.entries()) {\n if (k === \"file\" && typeof v !== \"string\") file = v;\n else meta[k] = v;\n }\n } else {\n meta = await readBody(req);\n }\n\n const name = String(meta.name ?? file?.name ?? \"Ticket\").trim().slice(0, 120);\n if (!name) throw new HttpError(400, \"Le nom est obligatoire\");\n\n const now = new Date().toISOString();\n const id = slugId();\n const rawFileName = file?.name || String(meta.fileName ?? \"ticket.bin\");\n const fileName = sanitizeFileName(rawFileName);\n const mimeType = file?.type ||\n String(meta.mimeType ?? \"application/octet-stream\");\n const storageKey = sanitizeStorageKey(id, fileName);\n\n if (file) {\n // Vérif taille avant de charger en RAM\n if (file.size > 12 * 1024 * 1024) {\n throw new HttpError(\n 413,\n \"Fichier trop volumineux (12 Mo max via l'API).\",\n );\n }\n const buf = new Uint8Array(await file.arrayBuffer());\n if (buf.byteLength > 12 * 1024 * 1024) {\n throw new HttpError(\n 413,\n \"Fichier trop volumineux (12 Mo max via l'API).\",\n );\n }\n try {\n await s3Put(storageKey, buf, mimeType || \"application/octet-stream\");\n } catch (e) {\n throw e;\n }\n meta.size = buf.byteLength;\n }\n\n // Validation brandId : doit exister sinon null\n const loaded = await loadIndex();\n const expired = stripExpiredInPlace(loaded);\n if (expired.length) await deleteBlobsBestEffort(expired);\n // Valider brandId\n let brandId: string | null = meta.brandId ? String(meta.brandId) : null;\n if (brandId && !loaded.brands.some((b) => b.id === brandId)) brandId = null;\n const color = sanitizeColor(String(meta.color ?? \"#c45c26\"));\n let expiresAt: string | null = null;\n try {\n expiresAt = validateExpiresAt(meta.expiresAt);\n } catch (e) {\n // Si échec de validation, on propage 400 ; mais si fichier déjà upload, nettoyer\n if (file) await s3Delete(storageKey).catch(() => {});\n throw e;\n }\n\n const ticket: Ticket = {\n id,\n name,\n brandId,\n tags: parseTags(meta.tags),\n color,\n kind: kindFromMime(mimeType, fileName),\n fileName,\n mimeType,\n size: Number(meta.size ?? 0),\n notes: String(meta.notes ?? \"\").slice(0, 2000),\n expiresAt,\n createdAt: now,\n updatedAt: now,\n createdBy: sanitizeDisplayName(String(meta.createdBy ?? actor)),\n storageKey: file ? storageKey : \"\",\n };\n\n loaded.tickets.unshift(ticket);\n try {\n await saveIndex(loaded);\n } catch (e) {\n // Orphelin : on a déjà mis le blob, mais index save a échoué → nettoyer\n if (file) await s3Delete(storageKey).catch(() => {});\n throw e;\n }\n return json({ ticket: ticketPublic(ticket) }, 201);\n}\n\nasync function handlePatchTicket(req: Request, id: string): Promise {\n const body = await readBody(req);\n const loaded = await loadIndex();\n const expired = stripExpiredInPlace(loaded);\n if (expired.length) await deleteBlobsBestEffort(expired);\n const ticket = loaded.tickets.find((t) => t.id === id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n\n if (body.name != null) {\n const n = String(body.name).trim().slice(0, 120);\n if (n) ticket.name = n;\n }\n if (body.brandId !== undefined) {\n const raw = body.brandId ? String(body.brandId) : null;\n if (raw && !loaded.brands.some((b) => b.id === raw)) ticket.brandId = null;\n else ticket.brandId = raw;\n }\n if (body.tags != null) ticket.tags = parseTags(body.tags);\n if (body.color != null) {\n ticket.color = sanitizeColor(String(body.color), ticket.color);\n }\n if (body.notes != null) ticket.notes = String(body.notes).slice(0, 2000);\n if (body.expiresAt !== undefined) {\n ticket.expiresAt = body.expiresAt\n ? validateExpiresAt(String(body.expiresAt))\n : null;\n }\n ticket.updatedAt = new Date().toISOString();\n // Sauvegarde unique (purge déjà faite en mémoire)\n if (expired.length) {\n // On a déjà nettoyé les expirés en mémoire, on sauvegarde une seule fois ci-dessous\n }\n await saveIndex(loaded);\n return json({ ticket: ticketPublic(ticket) });\n}\n\nasync function handleUpload(req: Request, id: string): Promise {\n const loaded = await loadIndex();\n const expired = stripExpiredInPlace(loaded);\n if (expired.length) await deleteBlobsBestEffort(expired);\n const ticket = loaded.tickets.find((t) => t.id === id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const v = form.get(\"file\");\n if (v && typeof v !== \"string\") file = v;\n }\n if (!file) throw new HttpError(400, \"Fichier manquant (champ file)\");\n if (file.size > 12 * 1024 * 1024) {\n throw new HttpError(413, \"Fichier trop volumineux (12 Mo max).\");\n }\n const buf = new Uint8Array(await file.arrayBuffer());\n if (buf.byteLength > 12 * 1024 * 1024) {\n throw new HttpError(413, \"Fichier trop volumineux (12 Mo max).\");\n }\n\n const oldKey = ticket.storageKey;\n const storageKey = sanitizeStorageKey(id, file.name);\n await s3Put(storageKey, buf, file.type || \"application/octet-stream\");\n // Supprimer ancien fichier best-effort après succès du nouveau\n if (oldKey && oldKey !== storageKey) {\n await s3Delete(oldKey).catch(() => {});\n }\n ticket.storageKey = storageKey;\n ticket.fileName = sanitizeFileName(file.name);\n ticket.mimeType = file.type || ticket.mimeType;\n ticket.size = buf.byteLength;\n ticket.kind = kindFromMime(ticket.mimeType, ticket.fileName);\n ticket.updatedAt = new Date().toISOString();\n await saveIndex(loaded);\n return json({ ticket: ticketPublic(ticket) });\n}\n\nasync function handleDeleteTicket(id: string): Promise {\n const index = await loadIndex();\n const ticket = index.tickets.find((t) => t.id === id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n const key = ticket.storageKey;\n // D'abord retirer de l'index et sauver (évite référence dangling si save échoue)\n index.tickets = index.tickets.filter((t) => t.id !== id);\n await saveIndex(index);\n // Puis supprimer le blob best-effort\n if (key) await s3Delete(key).catch(() => {});\n return json({ ok: true, id });\n}\n\nasync function handleFile(id: string): Promise {\n const { index } = await purgeExpired(await loadIndex());\n const ticket = index.tickets.find((t) => t.id === id);\n if (!ticket || !ticket.storageKey) {\n throw new HttpError(404, \"Fichier introuvable\");\n }\n const { status, bytes, type } = await s3Get(ticket.storageKey);\n if (status === 404) throw new HttpError(404, \"Fichier absent du bucket\");\n if (status >= 400) {\n console.error(`Z1 file ${status} ${ticket.storageKey}`);\n throw new HttpError(502, `Erreur de lecture (${status})`);\n }\n const safeName = sanitizeFileName(ticket.fileName).replace(/\"/g, \"\");\n return new Response(bytes as unknown as BodyInit, {\n status: 200,\n headers: {\n \"content-type\": type || ticket.mimeType || \"application/octet-stream\",\n \"content-length\": String(bytes.byteLength),\n \"content-disposition\": `inline; filename=\"${safeName}\"`,\n \"cache-control\": \"private, max-age=120\",\n },\n });\n}\n\nasync function handleBrands(req: Request, _actor: string): Promise {\n const loaded = await loadIndex();\n // Pour GET on veut purger et sauver si besoin\n if (req.method === \"GET\") {\n const { index } = await purgeExpired(loaded);\n return json({ brands: index.brands });\n }\n if (req.method === \"POST\") {\n const expired = stripExpiredInPlace(loaded);\n if (expired.length) await deleteBlobsBestEffort(expired);\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim().slice(0, 60);\n if (!name) throw new HttpError(400, \"Nom de marque obligatoire\");\n const brand: Brand = {\n id: slugId(),\n name,\n color: sanitizeColor(String(body.color ?? \"#3d5a45\")),\n createdAt: new Date().toISOString(),\n };\n loaded.brands.push(brand);\n await saveIndex(loaded);\n return json({ brand }, 201);\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleBrandItem(req: Request, id: string): Promise {\n const loaded = await loadIndex();\n const brand = loaded.brands.find((b) => b.id === id);\n if (!brand) throw new HttpError(404, \"Marque introuvable\");\n if (req.method === \"PATCH\") {\n const expired = stripExpiredInPlace(loaded);\n if (expired.length) await deleteBlobsBestEffort(expired);\n const body = await readBody(req);\n if (body.name != null) {\n const n = String(body.name).trim().slice(0, 60);\n if (n) brand.name = n;\n }\n if (body.color != null) {\n brand.color = sanitizeColor(String(body.color), brand.color);\n }\n await saveIndex(loaded);\n return json({ brand });\n }\n if (req.method === \"DELETE\") {\n const expired = stripExpiredInPlace(loaded);\n if (expired.length) await deleteBlobsBestEffort(expired);\n loaded.brands = loaded.brands.filter((b) => b.id !== id);\n for (const t of loaded.tickets) {\n if (t.brandId === id) t.brandId = null;\n }\n await saveIndex(loaded);\n return json({ ok: true });\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handlePurge(req: Request): Promise {\n const secret = env(\"CRON_SECRET\");\n const header = req.headers.get(\"authorization\") ?? \"\";\n const url = new URL(req.url);\n const q = url.searchParams.get(\"secret\") ?? \"\";\n const bearer = header.replace(/^Bearer\\s+/i, \"\");\n let authed = false;\n if (secret) {\n // Timing-safe compare pour bearer et query\n if (bearer && timingSafeEqualString(bearer, secret)) authed = true;\n if (q && timingSafeEqualString(q, secret)) authed = true;\n if (q) {\n console.warn(\n \"Purge via ?secret= déprécié — préférer Authorization header\",\n );\n }\n }\n if (!authed) {\n // Un membre connecté peut aussi forcer la purge.\n try {\n await requireAuth(req);\n authed = true;\n } catch {\n throw new HttpError(401, \"CRON_SECRET ou session requis\");\n }\n }\n const { index, removed } = await purgeExpired(await loadIndex());\n return json({\n ok: true,\n purged: removed.length,\n remaining: index.tickets.length,\n ids: removed.map((t) => t.id),\n });\n}\n\nfunction match(\n pathname: string,\n pattern: string,\n): Record | null {\n const a = pathname.split(\"/\").filter(Boolean);\n const b = pattern.split(\"/\").filter(Boolean);\n if (a.length !== b.length) return null;\n const params: Record = {};\n for (let i = 0; i < a.length; i++) {\n if (b[i].startsWith(\":\")) params[b[i].slice(1)] = decodeURIComponent(a[i]);\n else if (a[i] !== b[i]) return null;\n }\n return params;\n}\n\nasync function route(req: Request): Promise {\n const url = new URL(req.url);\n let path = url.pathname;\n // Val Town préfixe parfois /v1 ou le nom du val.\n path = path.replace(/^\\/v\\d+/, \"\");\n if (path.length > 1 && path.endsWith(\"/\")) path = path.slice(0, -1);\n\n if (req.method === \"OPTIONS\") {\n const cors = corsHeaders(req);\n // Répondre 204 avec headers CORS appropriés\n return new Response(null, { status: 204, headers: cors });\n }\n\n if (req.method === \"GET\" && (path === \"/\" || path === \"/health\")) {\n return json({\n name: \"E-Ticket API\",\n ok: true,\n storage: \"z1\",\n auth: \"oauth2-password\",\n time: new Date().toISOString(),\n });\n }\n\n if (\n req.method === \"POST\" &&\n (path === \"/oauth/token\" || path === \"/auth/login\" ||\n path === \"/auth/token\")\n ) {\n return await handleLogin(req);\n }\n\n if (\n path === \"/internal/purge\" &&\n (req.method === \"POST\" || req.method === \"GET\")\n ) {\n return await handlePurge(req);\n }\n\n const actor = await requireAuth(req);\n\n if (req.method === \"GET\" && path === \"/auth/me\") {\n const index = await loadIndex();\n return json({\n displayName: actor.name,\n vault: \"shared\",\n tickets: index.tickets.length,\n });\n }\n\n if (req.method === \"POST\" && path === \"/auth/password\") {\n return await handlePasswordChange(req);\n }\n\n if (req.method === \"GET\" && path === \"/tickets\") {\n const { index } = await purgeExpired(await loadIndex());\n const tickets = filterTickets(index, url).map(ticketPublic);\n return json({ tickets, brands: index.brands, version: index.version });\n }\n\n if (req.method === \"POST\" && path === \"/tickets\") {\n return await handleCreateTicket(req, actor.name);\n }\n\n if (req.method === \"GET\" && path === \"/stats\") {\n const { index } = await purgeExpired(await loadIndex());\n return json({ stats: computeStats(index) });\n }\n\n if (path === \"/brands\") return await handleBrands(req, actor.name);\n\n let m = match(path, \"/tickets/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const { index } = await purgeExpired(await loadIndex());\n const ticket = index.tickets.find((t) => t.id === m!.id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n return json({ ticket: ticketPublic(ticket) });\n }\n if (req.method === \"PATCH\") return await handlePatchTicket(req, m.id);\n if (req.method === \"DELETE\") return await handleDeleteTicket(m.id);\n }\n\n m = match(path, \"/tickets/:id/file\");\n if (m && req.method === \"GET\") return await handleFile(m.id);\n if (m && (req.method === \"POST\" || req.method === \"PUT\")) {\n return await handleUpload(req, m.id);\n }\n\n m = match(path, \"/brands/:id\");\n if (m) return await handleBrandItem(req, m.id);\n\n if (req.method === \"GET\" && path === \"/tags\") {\n const { index } = await purgeExpired(await loadIndex());\n const tags = [...new Set(index.tickets.flatMap((t) => t.tags))].sort();\n return json({ tags });\n }\n\n throw new HttpError(404, `Route inconnue : ${req.method} ${path}`);\n}\n\nexport default async function handler(req: Request): Promise {\n try {\n return withCors(req, await route(req));\n } catch (err) {\n const status = err instanceof HttpError ? err.status : 500;\n const message = err instanceof Error ? err.message : \"Erreur interne\";\n console.error(\"E-Ticket API\", status, message);\n return withCors(req, json({ error: message, status }, status));\n }\n}",[141],"pulls","branches",1,"forks","envVars",{"_156":158,"_159":62},"connections",{"_156":62,"_157":62},"count","unfilledCount",29,"emptyCount",{"_42":140,"_32":141,"_30":57,"_131":-5,"_40":41,"_39":142,"_133":48,"_37":166,"_13":144,"_33":145,"_35":146,"_24":48,"_138":44,"_163":167,"_27":168},{"_42":128,"_32":129,"_30":130,"_131":-5,"_40":41,"_39":132,"_133":25,"_37":162,"_13":135,"_33":136,"_35":137,"_24":48,"_138":-5,"_163":164,"_27":165},["D",1787751953719],"children",[],[129],["D",1788077619180],[],[141],["D",1787751631620],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":48},{"_13":85,"_32":86,"_42":41,"_87":43,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":44,"_94":95},"ctx",{"_78":-5,"_123":206,"_207":208,"_209":210,"_211":48,"_212":48,"_213":48,"_214":25,"_215":-5,"_216":-7,"_217":-7,"_218":62,"_219":48,"_220":48,"_221":-5,"_222":48,"_223":48,"_224":48,"_225":-5},"ENV",{"_177":178,"_179":180,"_181":86,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v16