[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_167":168,"_169":170},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":36,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",7,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","purge.ts","latestPath","fileId","60942de0-a154-11f1-94ff-1607ee4eb77e","name","fileType","interval","content","","// Learn more: https://docs.val.town/vals/cron/\nexport default async function (interval: Interval) {\n console.log(interval);\n}","createdAt",["D",1787751940642],"branchVersion","branchId","f409cc80-4dfe-4648-826c-5f94984b93a7","id","67d3ebca-0208-40ef-9e43-526d7a9d01a3","eticket",["D",1787751631620],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","7ed13655-83c2-4934-a981-01578302df33","pinnedFileId","b50ac696-a153-11f1-85e9-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f99eb-d944-7332-99f8-2fbb8b1e7011","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":54,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",17,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mdevslabs","handle","displayName","mProjects","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/ec72623f-c02d-461a-9b1c-c2f416214400/square512?exp=1789549199&sig=7352c859f7aae34f0d8c2fe9e414b6fa60f4156d174825699aea4c91f0faa822","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":163,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":164,"_80":165,"_82":166,"_84":25},"tree",[154,155],"files",[154,155],"counts",{"_142":62,"_143":144,"_145":62,"_146":147,"_148":149},"contents",[126,127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":135,"_32":136,"_30":56,"_129":-5,"_41":42,"_40":132,"_130":25,"_38":137,"_13":138,"_33":139,"_35":140,"_24":25,"_133":45,"_27":141},{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":131,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_27":134},"073e97ac-da1e-41e7-99ba-480ad2793e95","parentId","latest",["D",1787751940642],3,"label",[28],"4974b77a-f3b9-427a-9f48-887f826273e8","main.ts",["D",1787751666206],2,"http","/**\n * E-Ticket — HTTP val Val Town\n * -----------------------------------------------------------------------------\n * Colle ce fichier dans un Val HTTP (nom suggéré : eticket).\n * Déclare les variables d'environnement dans Val Town (voir /.env.example).\n *\n * Auth : OAuth 2.0 Resource Owner Password Credentials\n * POST /oauth/token (grant_type=password)\n * Stockage : Z1 Storage (S3) — un index JSON + fichiers, aucune base SQL.\n *\n * Coffres famille : un seul mot de passe partagé, tickets communs.\n */\n\nimport { AwsClient } from \"https://esm.sh/aws4fetch@1.0.20\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\ntype TicketKind = \"pdf\" | \"image\" | \"other\";\n\ninterface Brand {\n id: string;\n name: string;\n color: string;\n createdAt: string;\n}\n\ninterface Ticket {\n id: string;\n name: string;\n brandId: string | null;\n tags: string[];\n color: string;\n kind: TicketKind;\n fileName: string;\n mimeType: string;\n size: number;\n notes: string;\n expiresAt: string | null;\n createdAt: string;\n updatedAt: string;\n createdBy: string;\n storageKey: string;\n}\n\ninterface VaultIndex {\n version: number;\n brands: Brand[];\n tickets: Ticket[];\n updatedAt: string;\n}\n\ninterface AuthRecord {\n algo: \"pbkdf2-sha256\";\n iterations: number;\n salt: string;\n hash: string;\n updatedAt: string;\n}\n\nconst ITERATIONS = 120_000;\nconst TOKEN_TTL_SEC = 60 * 60 * 24 * 7;\n\nfunction env(name: string, fallback = \"\"): string {\n return (Deno.env.get(name) ?? fallback).trim();\n}\n\nfunction requiredEnv(name: string): string {\n const v = env(name);\n if (!v) throw new HttpError(500, `Variable manquante : ${name}`);\n return v;\n}\n\nfunction s3(): {\n client: AwsClient;\n bucket: string;\n prefix: string;\n endpoint: string;\n} {\n const accessKey = requiredEnv(\"Z1_ACCESS_KEY\");\n const secretKey = requiredEnv(\"Z1_SECRET_KEY\");\n const bucket = requiredEnv(\"Z1_BUCKET\");\n const endpoint = env(\"Z1_ENDPOINT\", \"https://s3.z1storage.com\").replace(\n /\\/$/,\n \"\",\n );\n const region = env(\"Z1_REGION\", \"default\");\n const prefix = env(\"Z1_PREFIX\", \"eticket\").replace(/^\\/|\\/$/g, \"\");\n const client = new AwsClient({\n accessKeyId: accessKey,\n secretAccessKey: secretKey,\n region,\n service: \"s3\",\n });\n return { client, bucket, prefix, endpoint };\n}\n\nfunction objectUrl(endpoint: string, bucket: string, key: string): string {\n return `${endpoint}/${bucket}/${\n key.split(\"/\").map(encodeURIComponent).join(\"/\")\n }`;\n}\n\nasync function s3Send(\n method: string,\n key: string,\n body?: Uint8Array | string | null,\n contentType?: string,\n): Promise {\n const { client, bucket, prefix, endpoint } = s3();\n const fullKey = `${prefix}/${key}`.replace(/\\/+/g, \"/\");\n const headers: Record = {};\n if (contentType) headers[\"content-type\"] = contentType;\n if (body != null) {\n headers[\"content-length\"] = String(\n typeof body === \"string\"\n ? encoder.encode(body).byteLength\n : body.byteLength,\n );\n }\n return await client.fetch(objectUrl(endpoint, bucket, fullKey), {\n method,\n headers,\n body: body ?? undefined,\n });\n}\n\nasync function s3Get(\n key: string,\n): Promise<{ status: number; bytes: Uint8Array; type: string }> {\n const res = await s3Send(\"GET\", key);\n const bytes = new Uint8Array(await res.arrayBuffer());\n return {\n status: res.status,\n bytes,\n type: res.headers.get(\"content-type\") ?? \"application/octet-stream\",\n };\n}\n\nasync function s3Put(\n key: string,\n body: Uint8Array | string,\n contentType: string,\n): Promise {\n const res = await s3Send(\"PUT\", key, body, contentType);\n if (!res.ok) {\n const t = decoder.decode(await res.arrayBuffer()).slice(0, 400);\n throw new HttpError(\n 502,\n `Z1 Storage PUT ${res.status} : ${t || res.statusText}`,\n );\n }\n}\n\nasync function s3Delete(key: string): Promise {\n const res = await s3Send(\"DELETE\", key);\n if (!res.ok && res.status !== 404) {\n throw new HttpError(502, `Z1 Storage DELETE ${res.status}`);\n }\n}\n\nclass HttpError extends Error {\n status: number;\n constructor(status: number, message: string) {\n super(message);\n this.status = status;\n }\n}\n\nfunction json(data: unknown, status = 200, extra: HeadersInit = {}): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...extra },\n });\n}\n\nfunction corsHeaders(req: Request): Record {\n const allowed = env(\"CORS_ORIGIN\", \"*\");\n const origin = req.headers.get(\"origin\") ?? \"\";\n const list = allowed.split(\",\").map((s) => s.trim()).filter(Boolean);\n const allow = allowed === \"*\" || list.includes(\"*\")\n ? \"*\"\n : list.includes(origin)\n ? origin\n : list[0] ?? \"*\";\n return {\n \"access-control-allow-origin\": allow,\n \"access-control-allow-headers\":\n \"Authorization, Content-Type, X-Display-Name\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n \"vary\": \"Origin\",\n };\n}\n\nfunction withCors(req: Request, res: Response): Response {\n const headers = new Headers(res.headers);\n for (const [k, v] of Object.entries(corsHeaders(req))) headers.set(k, v);\n return new Response(res.body, { status: res.status, headers });\n}\n\nfunction b64url(bytes: Uint8Array): string {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\n \"=\",\n \"\",\n );\n}\n\nfunction b64urlDecode(s: string): Uint8Array {\n const pad = s.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (s.length % 4));\n const b64 = s.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + pad;\n const bin = atob(b64);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\n\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\nasync function hmac(secret: string, data: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n return new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data)),\n );\n}\n\nasync function signJwt(payload: Record): Promise {\n const header = b64url(\n encoder.encode(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" })),\n );\n const body = b64url(encoder.encode(JSON.stringify(payload)));\n const sig = b64url(\n await hmac(requiredEnv(\"JWT_SECRET\"), `${header}.${body}`),\n );\n return `${header}.${body}.${sig}`;\n}\n\nasync function verifyJwt(\n token: string,\n): Promise<{ sub: string; name: string; exp: number }> {\n const parts = token.split(\".\");\n if (parts.length !== 3) throw new HttpError(401, \"Jeton invalide\");\n const sig = b64url(\n await hmac(requiredEnv(\"JWT_SECRET\"), `${parts[0]}.${parts[1]}`),\n );\n if (sig !== parts[2]) throw new HttpError(401, \"Jeton invalide\");\n const payload = JSON.parse(decoder.decode(b64urlDecode(parts[1])));\n if (typeof payload.exp !== \"number\" || payload.exp * 1000 < Date.now()) {\n throw new HttpError(401, \"Session expirée\");\n }\n return payload;\n}\n\nasync function requireAuth(req: Request): Promise<{ name: string }> {\n const header = req.headers.get(\"authorization\") ?? \"\";\n const m = header.match(/^Bearer\\s+(.+)$/i);\n if (!m) throw new HttpError(401, \"Authentification requise\");\n const payload = await verifyJwt(m[1].trim());\n const name = req.headers.get(\"x-display-name\")?.trim() || payload.name ||\n \"Famille\";\n return { name };\n}\n\nasync function readJson(key: string): Promise {\n const { status, bytes } = await s3Get(key);\n if (status === 404) return null;\n if (status >= 400) throw new HttpError(502, `Z1 lecture ${key} : ${status}`);\n return JSON.parse(decoder.decode(bytes)) as T;\n}\n\nasync function writeJson(key: string, data: unknown): Promise {\n await s3Put(key, JSON.stringify(data, null, 2), \"application/json\");\n}\n\nfunction emptyIndex(): VaultIndex {\n return {\n version: 1,\n brands: [],\n tickets: [],\n updatedAt: new Date().toISOString(),\n };\n}\n\nasync function loadIndex(): Promise {\n const idx = await readJson(\"index.json\");\n return idx ?? emptyIndex();\n}\n\nasync function saveIndex(index: VaultIndex): Promise {\n index.version = (index.version ?? 0) + 1;\n index.updatedAt = new Date().toISOString();\n await writeJson(\"index.json\", index);\n return index;\n}\n\nasync function purgeExpired(\n index: VaultIndex,\n): Promise<{ index: VaultIndex; removed: Ticket[] }> {\n const now = Date.now();\n const keep: Ticket[] = [];\n const removed: Ticket[] = [];\n for (const t of index.tickets) {\n if (t.expiresAt && Date.parse(t.expiresAt) < now) removed.push(t);\n else keep.push(t);\n }\n if (!removed.length) return { index, removed };\n for (const t of removed) {\n try {\n await s3Delete(t.storageKey);\n } catch {\n /* best-effort */\n }\n }\n index.tickets = keep;\n await saveIndex(index);\n return { index, removed };\n}\n\nasync function ensureAuthRecord(): Promise {\n return await readJson(\"auth.json\");\n}\n\nasync function verifyPassword(password: string): Promise {\n if (!password) return false;\n const bootstrap = env(\"VAULT_PASSWORD\");\n const rec = await ensureAuthRecord();\n if (rec) {\n const salt = b64urlDecode(rec.salt);\n const got = await pbkdf2(password, salt, rec.iterations);\n const expected = b64urlDecode(rec.hash);\n if (timingSafeEqual(got, expected)) return true;\n // Mot de passe de récupération (env) toujours accepté.\n if (bootstrap && password === bootstrap) return true;\n return false;\n }\n if (bootstrap && password === bootstrap) {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await pbkdf2(password, salt, ITERATIONS);\n const record: AuthRecord = {\n algo: \"pbkdf2-sha256\",\n iterations: ITERATIONS,\n salt: b64url(salt),\n hash: b64url(hash),\n updatedAt: new Date().toISOString(),\n };\n await writeJson(\"auth.json\", record);\n return true;\n }\n return false;\n}\n\nasync function issueToken(\n displayName: string,\n): Promise<{ access_token: string; token_type: string; expires_in: number }> {\n const now = Math.floor(Date.now() / 1000);\n const name = displayName.trim() || \"Famille\";\n const access_token = await signJwt({\n sub: \"family-vault\",\n name,\n iat: now,\n exp: now + TOKEN_TTL_SEC,\n });\n return { access_token, token_type: \"Bearer\", expires_in: TOKEN_TTL_SEC };\n}\n\nfunction kindFromMime(mime: string, fileName: string): TicketKind {\n if (mime === \"application/pdf\" || fileName.toLowerCase().endsWith(\".pdf\")) {\n return \"pdf\";\n }\n if (mime.startsWith(\"image/\")) return \"image\";\n return \"other\";\n}\n\nfunction slugId(): string {\n return crypto.randomUUID();\n}\n\nfunction parseTags(input: unknown): string[] {\n if (Array.isArray(input)) {\n return [\n ...new Set(\n input.map((t) => String(t).trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n if (typeof input === \"string\") {\n return [\n ...new Set(\n input.split(/[,;#]/).map((t) => t.trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n return [];\n}\n\nasync function readBody(req: Request): Promise> {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n const text = await req.text();\n const params = new URLSearchParams(text);\n const out: Record = {};\n for (const [k, v] of params) out[k] = v;\n return out;\n }\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const out: Record = {};\n for (const [k, v] of form.entries()) {\n if (typeof v === \"string\") out[k] = v;\n else out[k] = v;\n }\n return out;\n }\n if (!ct || ct.includes(\"application/json\")) {\n const text = await req.text();\n if (!text) return {};\n return JSON.parse(text);\n }\n return {};\n}\n\nfunction ticketPublic(t: Ticket) {\n return {\n id: t.id,\n name: t.name,\n brandId: t.brandId,\n tags: t.tags,\n color: t.color,\n kind: t.kind,\n fileName: t.fileName,\n mimeType: t.mimeType,\n size: t.size,\n notes: t.notes,\n expiresAt: t.expiresAt,\n createdAt: t.createdAt,\n updatedAt: t.updatedAt,\n createdBy: t.createdBy,\n hasFile: Boolean(t.storageKey),\n };\n}\n\nfunction computeStats(index: VaultIndex) {\n const now = Date.now();\n const soon = now + 7 * 24 * 3600 * 1000;\n const byBrand: Record = {};\n const byTag: Record = {};\n let expiringSoon = 0;\n let withExpiry = 0;\n let bytes = 0;\n let pdfs = 0;\n let images = 0;\n for (const t of index.tickets) {\n bytes += t.size || 0;\n if (t.kind === \"pdf\") pdfs++;\n if (t.kind === \"image\") images++;\n if (t.expiresAt) {\n withExpiry++;\n const exp = Date.parse(t.expiresAt);\n if (exp >= now && exp <= soon) expiringSoon++;\n }\n const brand = index.brands.find((b) => b.id === t.brandId);\n const label = brand?.name ?? \"Sans marque\";\n byBrand[label] = (byBrand[label] ?? 0) + 1;\n for (const tag of t.tags) byTag[tag] = (byTag[tag] ?? 0) + 1;\n }\n return {\n tickets: index.tickets.length,\n brands: index.brands.length,\n tags: Object.keys(byTag).length,\n expiringSoon,\n withExpiry,\n pdfs,\n images,\n bytes,\n byBrand,\n byTag,\n updatedAt: index.updatedAt,\n };\n}\n\nasync function handleLogin(req: Request): Promise {\n const body = await readBody(req);\n const password = String(body.password ?? \"\");\n const displayName = String(\n body.username ?? body.displayName ?? body.name ?? \"Famille\",\n );\n const grant = String(body.grant_type ?? \"password\");\n if (grant !== \"password\") {\n throw new HttpError(400, \"grant_type non supporté (utiliser password)\");\n }\n const ok = await verifyPassword(password);\n if (!ok) throw new HttpError(401, \"Mot de passe incorrect\");\n const token = await issueToken(displayName);\n return json({\n ...token,\n scope: \"vault.family\",\n vault: \"shared\",\n displayName: displayName.trim() || \"Famille\",\n });\n}\n\nasync function handlePasswordChange(req: Request): Promise {\n await requireAuth(req);\n const body = await readBody(req);\n const current = String(body.current ?? body.oldPassword ?? \"\");\n const next = String(body.next ?? body.newPassword ?? \"\");\n if (next.length < 8) {\n throw new HttpError(\n 400,\n \"Nouveau mot de passe trop court (8 caractères min.)\",\n );\n }\n if (!(await verifyPassword(current))) {\n throw new HttpError(401, \"Mot de passe actuel incorrect\");\n }\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await pbkdf2(next, salt, ITERATIONS);\n const record: AuthRecord = {\n algo: \"pbkdf2-sha256\",\n iterations: ITERATIONS,\n salt: b64url(salt),\n hash: b64url(hash),\n updatedAt: new Date().toISOString(),\n };\n await writeJson(\"auth.json\", record);\n return json({\n ok: true,\n message:\n \"Mot de passe coffre mis à jour. Les autres appareils devront se reconnecter.\",\n });\n}\n\nfunction filterTickets(index: VaultIndex, url: URL): Ticket[] {\n const q = (url.searchParams.get(\"q\") ?? \"\").trim().toLowerCase();\n const brandId = url.searchParams.get(\"brand\") ?? \"\";\n const tag = (url.searchParams.get(\"tag\") ?? \"\").trim().toLowerCase();\n const color = url.searchParams.get(\"color\") ?? \"\";\n const kind = url.searchParams.get(\"kind\") ?? \"\";\n const expiring = url.searchParams.get(\"expiring\") ?? \"\";\n const now = Date.now();\n const soon = now + 7 * 24 * 3600 * 1000;\n return index.tickets.filter((t) => {\n if (brandId && t.brandId !== brandId) return false;\n if (tag && !t.tags.includes(tag)) return false;\n if (color && t.color.toLowerCase() !== color.toLowerCase()) return false;\n if (kind && t.kind !== kind) return false;\n if (expiring === \"soon\") {\n if (!t.expiresAt) return false;\n const exp = Date.parse(t.expiresAt);\n if (!(exp >= now && exp <= soon)) return false;\n }\n if (q) {\n const brand = index.brands.find((b) => b.id === t.brandId)?.name ?? \"\";\n const hay = `${t.name} ${t.notes} ${t.fileName} ${\n t.tags.join(\" \")\n } ${brand} ${t.createdBy}`.toLowerCase();\n if (!hay.includes(q)) return false;\n }\n return true;\n });\n}\n\nasync function handleCreateTicket(\n req: Request,\n actor: string,\n): Promise {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let meta: Record = {};\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n for (const [k, v] of form.entries()) {\n if (k === \"file\" && typeof v !== \"string\") file = v;\n else meta[k] = v;\n }\n } else {\n meta = await readBody(req);\n }\n\n const name = String(meta.name ?? file?.name ?? \"Ticket\").trim();\n if (!name) throw new HttpError(400, \"Le nom est obligatoire\");\n\n const now = new Date().toISOString();\n const id = slugId();\n const fileName = file?.name || String(meta.fileName ?? \"ticket.bin\");\n const mimeType = file?.type ||\n String(meta.mimeType ?? \"application/octet-stream\");\n const storageKey = `files/${id}/${fileName}`.replace(/\\/+/g, \"/\");\n\n if (file) {\n const buf = new Uint8Array(await file.arrayBuffer());\n if (buf.byteLength > 12 * 1024 * 1024) {\n throw new HttpError(\n 413,\n \"Fichier trop volumineux (12 Mo max via l'API).\",\n );\n }\n await s3Put(storageKey, buf, mimeType || \"application/octet-stream\");\n meta.size = buf.byteLength;\n }\n\n const ticket: Ticket = {\n id,\n name,\n brandId: meta.brandId ? String(meta.brandId) : null,\n tags: parseTags(meta.tags),\n color: String(meta.color ?? \"#c45c26\"),\n kind: kindFromMime(mimeType, fileName),\n fileName,\n mimeType,\n size: Number(meta.size ?? 0),\n notes: String(meta.notes ?? \"\"),\n expiresAt: meta.expiresAt ? String(meta.expiresAt) : null,\n createdAt: now,\n updatedAt: now,\n createdBy: String(meta.createdBy ?? actor),\n storageKey: file ? storageKey : \"\",\n };\n\n const loaded = await loadIndex();\n const { index } = await purgeExpired(loaded);\n index.tickets.unshift(ticket);\n await saveIndex(index);\n return json({ ticket: ticketPublic(ticket) }, 201);\n}\n\nasync function handlePatchTicket(req: Request, id: string): Promise {\n const body = await readBody(req);\n const loaded = await loadIndex();\n const { index } = await purgeExpired(loaded);\n const ticket = index.tickets.find((t) => t.id === id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n\n if (body.name != null) ticket.name = String(body.name).trim() || ticket.name;\n if (body.brandId !== undefined) {\n ticket.brandId = body.brandId\n ? String(body.brandId)\n : null;\n }\n if (body.tags != null) ticket.tags = parseTags(body.tags);\n if (body.color != null) ticket.color = String(body.color);\n if (body.notes != null) ticket.notes = String(body.notes);\n if (body.expiresAt !== undefined) {\n ticket.expiresAt = body.expiresAt\n ? String(body.expiresAt)\n : null;\n }\n ticket.updatedAt = new Date().toISOString();\n await saveIndex(index);\n return json({ ticket: ticketPublic(ticket) });\n}\n\nasync function handleUpload(req: Request, id: string): Promise {\n const loaded = await loadIndex();\n const { index } = await purgeExpired(loaded);\n const ticket = index.tickets.find((t) => t.id === id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const v = form.get(\"file\");\n if (v && typeof v !== \"string\") file = v;\n }\n if (!file) throw new HttpError(400, \"Fichier manquant (champ file)\");\n const buf = new Uint8Array(await file.arrayBuffer());\n if (buf.byteLength > 12 * 1024 * 1024) {\n throw new HttpError(413, \"Fichier trop volumineux (12 Mo max).\");\n }\n\n if (ticket.storageKey) {\n try {\n await s3Delete(ticket.storageKey);\n } catch {\n /* ignore */\n }\n }\n const storageKey = `files/${id}/${file.name}`.replace(/\\/+/g, \"/\");\n await s3Put(storageKey, buf, file.type || \"application/octet-stream\");\n ticket.storageKey = storageKey;\n ticket.fileName = file.name;\n ticket.mimeType = file.type || ticket.mimeType;\n ticket.size = buf.byteLength;\n ticket.kind = kindFromMime(ticket.mimeType, ticket.fileName);\n ticket.updatedAt = new Date().toISOString();\n await saveIndex(index);\n return json({ ticket: ticketPublic(ticket) });\n}\n\nasync function handleDeleteTicket(id: string): Promise {\n const index = await loadIndex();\n const ticket = index.tickets.find((t) => t.id === id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n if (ticket.storageKey) await s3Delete(ticket.storageKey);\n index.tickets = index.tickets.filter((t) => t.id !== id);\n await saveIndex(index);\n return json({ ok: true, id });\n}\n\nasync function handleFile(id: string): Promise {\n const { index } = await purgeExpired(await loadIndex());\n const ticket = index.tickets.find((t) => t.id === id);\n if (!ticket || !ticket.storageKey) {\n throw new HttpError(404, \"Fichier introuvable\");\n }\n const { status, bytes, type } = await s3Get(ticket.storageKey);\n if (status === 404) throw new HttpError(404, \"Fichier absent du bucket\");\n if (status >= 400) throw new HttpError(502, `Z1 ${status}`);\n return new Response(bytes, {\n status: 200,\n headers: {\n \"content-type\": type || ticket.mimeType || \"application/octet-stream\",\n \"content-length\": String(bytes.byteLength),\n \"content-disposition\": `inline; filename=\"${\n ticket.fileName.replaceAll('\"', \"\")\n }\"`,\n \"cache-control\": \"private, max-age=120\",\n },\n });\n}\n\nasync function handleBrands(req: Request, actor: string): Promise {\n const { index } = await purgeExpired(await loadIndex());\n if (req.method === \"GET\") return json({ brands: index.brands });\n if (req.method === \"POST\") {\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim();\n if (!name) throw new HttpError(400, \"Nom de marque obligatoire\");\n const brand: Brand = {\n id: slugId(),\n name,\n color: String(body.color ?? \"#3d5a45\"),\n createdAt: new Date().toISOString(),\n };\n index.brands.push(brand);\n await saveIndex(index);\n return json({ brand }, 201);\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleBrandItem(req: Request, id: string): Promise {\n const { index } = await purgeExpired(await loadIndex());\n const brand = index.brands.find((b) => b.id === id);\n if (!brand) throw new HttpError(404, \"Marque introuvable\");\n if (req.method === \"PATCH\") {\n const body = await readBody(req);\n if (body.name != null) brand.name = String(body.name).trim() || brand.name;\n if (body.color != null) brand.color = String(body.color);\n await saveIndex(index);\n return json({ brand });\n }\n if (req.method === \"DELETE\") {\n index.brands = index.brands.filter((b) => b.id !== id);\n for (const t of index.tickets) {\n if (t.brandId === id) t.brandId = null;\n }\n await saveIndex(index);\n return json({ ok: true });\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handlePurge(req: Request): Promise {\n const secret = env(\"CRON_SECRET\");\n const header = req.headers.get(\"authorization\") ?? \"\";\n const url = new URL(req.url);\n const q = url.searchParams.get(\"secret\") ?? \"\";\n const bearer = header.replace(/^Bearer\\s+/i, \"\");\n const authed = secret && (bearer === secret || q === secret);\n if (!authed) {\n // Un membre connecté peut aussi forcer la purge.\n try {\n await requireAuth(req);\n } catch {\n throw new HttpError(401, \"CRON_SECRET ou session requis\");\n }\n }\n const { index, removed } = await purgeExpired(await loadIndex());\n return json({\n ok: true,\n purged: removed.length,\n remaining: index.tickets.length,\n ids: removed.map((t) => t.id),\n });\n}\n\nfunction match(\n pathname: string,\n pattern: string,\n): Record | null {\n const a = pathname.split(\"/\").filter(Boolean);\n const b = pattern.split(\"/\").filter(Boolean);\n if (a.length !== b.length) return null;\n const params: Record = {};\n for (let i = 0; i < a.length; i++) {\n if (b[i].startsWith(\":\")) params[b[i].slice(1)] = decodeURIComponent(a[i]);\n else if (a[i] !== b[i]) return null;\n }\n return params;\n}\n\nasync function route(req: Request): Promise {\n const url = new URL(req.url);\n let path = url.pathname;\n // Val Town préfixe parfois /v1 ou le nom du val.\n path = path.replace(/^\\/v\\d+/, \"\");\n if (path.length > 1 && path.endsWith(\"/\")) path = path.slice(0, -1);\n\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204 });\n\n if (req.method === \"GET\" && (path === \"/\" || path === \"/health\")) {\n return json({\n name: \"E-Ticket API\",\n ok: true,\n storage: \"z1\",\n auth: \"oauth2-password\",\n time: new Date().toISOString(),\n });\n }\n\n if (\n req.method === \"POST\" &&\n (path === \"/oauth/token\" || path === \"/auth/login\" ||\n path === \"/auth/token\")\n ) {\n return await handleLogin(req);\n }\n\n if (\n path === \"/internal/purge\" &&\n (req.method === \"POST\" || req.method === \"GET\")\n ) {\n return await handlePurge(req);\n }\n\n const actor = await requireAuth(req);\n\n if (req.method === \"GET\" && path === \"/auth/me\") {\n const index = await loadIndex();\n return json({\n displayName: actor.name,\n vault: \"shared\",\n tickets: index.tickets.length,\n });\n }\n\n if (req.method === \"POST\" && path === \"/auth/password\") {\n return await handlePasswordChange(req);\n }\n\n if (req.method === \"GET\" && path === \"/tickets\") {\n const { index } = await purgeExpired(await loadIndex());\n const tickets = filterTickets(index, url).map(ticketPublic);\n return json({ tickets, brands: index.brands, version: index.version });\n }\n\n if (req.method === \"POST\" && path === \"/tickets\") {\n return await handleCreateTicket(req, actor.name);\n }\n\n if (req.method === \"GET\" && path === \"/stats\") {\n const { index } = await purgeExpired(await loadIndex());\n return json({ stats: computeStats(index) });\n }\n\n if (path === \"/brands\") return await handleBrands(req, actor.name);\n\n let m = match(path, \"/tickets/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const { index } = await purgeExpired(await loadIndex());\n const ticket = index.tickets.find((t) => t.id === m!.id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n return json({ ticket: ticketPublic(ticket) });\n }\n if (req.method === \"PATCH\") return await handlePatchTicket(req, m.id);\n if (req.method === \"DELETE\") return await handleDeleteTicket(m.id);\n }\n\n m = match(path, \"/tickets/:id/file\");\n if (m && req.method === \"GET\") return await handleFile(m.id);\n if (m && (req.method === \"POST\" || req.method === \"PUT\")) {\n return await handleUpload(req, m.id);\n }\n\n m = match(path, \"/brands/:id\");\n if (m) return await handleBrandItem(req, m.id);\n\n if (req.method === \"GET\" && path === \"/tags\") {\n const { index } = await purgeExpired(await loadIndex());\n const tags = [...new Set(index.tickets.flatMap((t) => t.tags))].sort();\n return json({ tags });\n }\n\n throw new HttpError(404, `Route inconnue : ${req.method} ${path}`);\n}\n\nexport default async function handler(req: Request): Promise {\n try {\n return withCors(req, await route(req));\n } catch (err) {\n const status = err instanceof HttpError ? err.status : 500;\n const message = err instanceof Error ? err.message : \"Erreur interne\";\n console.error(\"E-Ticket API\", status, message);\n return withCors(req, json({ error: message, status }, status));\n }\n}",[136],"pulls","branches",1,"forks","envVars",{"_150":152,"_153":62},"connections",{"_150":62,"_151":62},"count","unfilledCount",29,"emptyCount",{"_43":135,"_32":136,"_30":56,"_129":-5,"_41":42,"_40":132,"_130":25,"_38":160,"_13":138,"_33":139,"_35":140,"_24":25,"_133":45,"_157":161,"_27":162},{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":156,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_157":158,"_27":159},["D",1787751940642],"children",[],[28],["D",1787751666206],[],[136],["D",1787751631620],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":54,"_101":102,"_103":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_123":200,"_201":202,"_203":204,"_205":25,"_206":25,"_207":25,"_208":58,"_209":-5,"_210":-7,"_211":-7,"_212":62,"_213":25,"_214":25,"_215":-5,"_216":25,"_217":25,"_218":25,"_219":-5},"ENV",{"_171":172,"_173":174,"_175":86,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7