${title}

\n\n \n

Bonjour,

${textContent}

\n \n ${\n showCode\n ? `\n \n

\n ${escapeHtml(code)}\n

Code unique • Expire dans 10 minutes

\n `\n : \"\"\n }\n\n

Si vous n'êtes pas à l'origine de cette demande, vous pouvez l'ignorer ou sécuriser votre compte.

\n\n \n

Cet e-mail automatique a été envoyé de manière sécurisée.

\n\n

\n \n \n `;\n\n // 1. Gmail SMTP via Nodemailer — exige conf env, plus de fallback hardcodé\n const gmailUser = Deno.env.get(\"GMAIL_USER\");\n const gmailAppPass = Deno.env.get(\"GMAIL_APP_PASSWORD\");\n\n if (gmailUser && gmailAppPass) {\n try {\n const transporter = nodemailer.createTransport({\n auth: {\n pass: gmailAppPass,\n user: gmailUser,\n },\n service: \"gmail\",\n });\n\n await transporter.sendMail({\n from: `\"mAI\" <${gmailUser}>`,\n html,\n subject,\n to: email,\n });\n\n const maskedTo = email.replace(/(.{2}).*(@.*)/, \"$1***$2\");\n console.log(`[EMAIL] Gmail OK to=${maskedTo}`);\n return;\n } catch (err: any) {\n console.error(\"Erreur envoi Gmail SMTP :\", err?.message || err);\n }\n } else if (!gmailUser || !gmailAppPass) {\n console.warn(\n \"[EMAIL] GMAIL_USER/GMAIL_APP_PASSWORD non configurés — fallback Resend\",\n );\n }\n\n // 2. Resend Fallback\n const resendKey = Deno.env.get(\"RESEND_API_KEY\");\n if (resendKey) {\n try {\n const res = await fetch(\"https://api.resend.com/emails\", {\n body: JSON.stringify({\n from: \"mAI \",\n html,\n subject,\n to: email,\n }),\n headers: {\n Authorization: `Bearer ${resendKey}`,\n \"Content-Type\": \"application/json\",\n },\n method: \"POST\",\n });\n if (res.ok) {\n }\n } catch (_e) {\n // ignore\n }\n }\n}",[],[230],["D",1787560946504],[],[18],"634a494b-b3d6-42be-b03e-e72fbe0ff814","config.ts","01a032e5-0a44-775c-aa85-581c0a200121",["D",1787560956461],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { neon } from \"npm:@neondatabase/serverless\";\nimport { jwtVerify, SignJWT } from \"npm:jose\";\n\n// ─────────────────────────────────────────────\n// Config & Données\n// ─────────────────────────────────────────────\nexport const JWT_EXPIRY = \"14d\";\nexport const BCRYPT_ROUNDS = 12;\n\n// Limites de tokens hebdomadaires (Input + Output)\nexport const TIER_LIMITS: Record = {\n Free: 2_000_000,\n Max: 20_000_000,\n Plus: 5_000_000,\n Pro: 10_000_000,\n};\n\nexport const TIER_REQUEST_LIMITS: Record = {\n Free: 500,\n Max: 5000,\n Plus: 1000,\n Pro: 2000,\n};\n\n// Limites de stockage Cloud par tier (en bytes) — SSOT: Free 500Mo / Plus 1Go / Pro 2Go / Max 5Go\nexport const STORAGE_LIMITS_BYTES: Record = {\n Free: 500 * 1024 * 1024, // 500 MB\n Plus: 1 * 1024 * 1024 * 1024, // 1 GB\n Pro: 2 * 1024 * 1024 * 1024, // 2 GB\n Max: 5 * 1024 * 1024 * 1024, // 5 GB\n // alias lowercase pour lookup case-insensitive côté Val Town\n free: 500 * 1024 * 1024,\n plus: 1 * 1024 * 1024 * 1024,\n pro: 2 * 1024 * 1024 * 1024,\n max: 5 * 1024 * 1024 * 1024,\n gratuit: 500 * 1024 * 1024,\n} as Record;\n\nexport function getDb() {\n const url = Deno.env.get(\"DATABASE_URL\");\n if (!url) {\n throw new Error(\"DATABASE_URL not set\");\n }\n return neon(url);\n}\n\nexport function getJwtSecret(): Uint8Array {\n const secret = Deno.env.get(\"MAI_JWT_SECRET\");\n if (!secret) {\n throw new Error(\"MAI_JWT_SECRET not set\");\n }\n return new TextEncoder().encode(secret);\n}\n\n// ─────────────────────────────────────────────\n// Helpers d'authentification & Utilitaires\n// ─────────────────────────────────────────────\nexport async function signToken(\n payload: Record,\n): Promise {\n return new SignJWT(payload)\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuedAt()\n .setExpirationTime(JWT_EXPIRY)\n .sign(getJwtSecret());\n}\n\nexport async function verifyToken(\n token: string,\n): Promise> {\n // Vérif SQLite (legacy Val Town) + Postgres (nouveau)\n const sqliteResult = await sqlite.execute({\n args: [token],\n sql: \"SELECT 1 FROM token_blacklist WHERE token = ?\",\n });\n if (sqliteResult.rows.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n // Vérif Postgres token_blacklist avec TTL 14j\n try {\n const sql = getDb();\n const pgResult =\n await sql`SELECT 1 FROM token_blacklist WHERE token = ${token} LIMIT 1`;\n if (pgResult.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n } catch (e: any) {\n if (e?.message === \"Token révoqué.\") throw e;\n // ignore DB errors (table not yet exists)\n }\n const { payload } = await jwtVerify(token, getJwtSecret());\n return payload as Record;\n}\n\nexport async function blacklistToken(token: string) {\n const expiresAt = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000)\n .toISOString();\n try {\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch {}\n try {\n const sql = getDb();\n await sql`INSERT INTO token_blacklist (token, revoked_at, expires_at) VALUES (${token}, NOW(), ${expiresAt}::timestamp) ON CONFLICT (token) DO NOTHING`;\n } catch {}\n // Nettoyage opportuniste des vieux tokens\n try {\n const sql = getDb();\n await sql`DELETE FROM token_blacklist WHERE expires_at < NOW() OR revoked_at < NOW() - INTERVAL '14 days'`;\n } catch {}\n try {\n await sqlite.execute({\n sql:\n \"DELETE FROM token_blacklist WHERE revoked_at < datetime('now', '-14 days')\",\n });\n } catch {}\n}\n\nexport function extractToken(req: Request): string | null {\n const auth = req.headers.get(\"Authorization\");\n if (!auth?.startsWith(\"Bearer \")) {\n return null;\n }\n return auth.slice(7);\n}\n\nexport function parseUserAgent(ua: string) {\n const uaLower = ua.toLowerCase();\n let os = \"linux\";\n let osVersion = \"Linux\";\n\n if (uaLower.includes(\"iphone\")) {\n os = \"apple\";\n osVersion = \"iPhone (iOS)\";\n } else if (uaLower.includes(\"ipad\")) {\n os = \"apple\";\n osVersion = \"iPad (iPadOS)\";\n } else if (uaLower.includes(\"mac os\") || uaLower.includes(\"macintosh\")) {\n os = \"apple\";\n osVersion = \"macOS\";\n } else if (\n uaLower.includes(\"windows nt 10.0\") || uaLower.includes(\"windows 11\") ||\n uaLower.includes(\"windows 10\")\n ) {\n os = \"microsoft\";\n osVersion = \"Windows 10/11\";\n } else if (uaLower.includes(\"win\")) {\n os = \"microsoft\";\n osVersion = \"Windows\";\n } else if (uaLower.includes(\"android\")) {\n os = \"google\";\n osVersion = \"Android\";\n } else if (uaLower.includes(\"ubuntu\")) {\n os = \"linux\";\n osVersion = \"Ubuntu Linux\";\n } else if (uaLower.includes(\"debian\")) {\n os = \"linux\";\n osVersion = \"Debian Linux\";\n } else if (uaLower.includes(\"fedora\")) {\n os = \"linux\";\n osVersion = \"Fedora Linux\";\n }\n\n let model = \"Navigateur Web\";\n let version = \"\";\n\n if (uaLower.includes(\"mai-cli\") || uaLower.includes(\"mai cli\")) {\n model = \"mAI CLI\";\n version = \"Terminal\";\n } else if (uaLower.includes(\"pulse-extension\") || uaLower.includes(\"pulse\")) {\n model = \"Pulse Extension\";\n version = \"Extension\";\n } else if (uaLower.includes(\"edg/\")) {\n model = \"Microsoft Edge\";\n const match = ua.match(/Edg\\/([0-9.]+)/i);\n if (match) version = `v${match[1].split(\".\")[0]}`;\n } else if (uaLower.includes(\"opr/\") || uaLower.includes(\"opera/\")) {\n model = \"Opera\";\n const match = ua.match(/(?:OPR|Opera)\\/([0-9.]+)/i);\n if (match) version = `v${match[1].split(\".\")[0]}`;\n } else if (uaLower.includes(\"chrome/\")) {\n model = \"Google Chrome\";\n const match = ua.match(/Chrome\\/([0-9.]+)/i);\n if (match) version = `v${match[1].split(\".\")[0]}`;\n } else if (uaLower.includes(\"firefox/\")) {\n model = \"Mozilla Firefox\";\n const match = ua.match(/Firefox\\/([0-9.]+)/i);\n if (match) version = `v${match[1].split(\".\")[0]}`;\n } else if (uaLower.includes(\"safari/\") && !uaLower.includes(\"chrome\")) {\n model = \"Apple Safari\";\n const match = ua.match(/Version\\/([0-9.]+)/i);\n if (match) version = `v${match[1].split(\".\")[0]}`;\n }\n\n const fullVersion = version ? `${osVersion} • ${version}` : osVersion;\n const osLabel = os === \"apple\"\n ? \"Apple\"\n : os === \"microsoft\"\n ? \"Windows\"\n : os === \"google\"\n ? \"Google\"\n : \"Linux\";\n const deviceName = `${model} (${osLabel})`;\n\n return {\n os,\n device_model: model,\n device_version: fullVersion,\n device_name: deviceName,\n };\n}\n\nexport function getWeekData() {\n const now = new Date();\n const day = now.getUTCDay() || 7;\n\n const weekStart = new Date(now);\n weekStart.setUTCDate(now.getUTCDate() - (day - 1));\n weekStart.setUTCHours(0, 0, 0, 0);\n\n const nextReset = new Date(weekStart);\n nextReset.setUTCDate(weekStart.getUTCDate() + 7);\n\n return {\n nextResetIso: nextReset.toISOString(),\n weekStartStr: weekStart.toISOString().split(\"T\")[0],\n };\n}\n\n// ─────────────────────────────────────────────\n// E-mails & Vérification (SQLite)\n// ─────────────────────────────────────────────\nexport async function initSQLite() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS verification_codes (\n email TEXT,\n code TEXT,\n action TEXT,\n expires_at DATETIME,\n PRIMARY KEY (email, action)\n );\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS token_blacklist (\n token TEXT PRIMARY KEY,\n revoked_at DATETIME DEFAULT CURRENT_TIMESTAMP\n );\n `);\n}\n\nexport async function generateVerificationCode(\n email: string,\n action: string,\n): Promise {\n const isDeletion = action === \"delete_account\";\n const length = isDeletion ? 8 : 6;\n const min = Math.pow(10, length - 1);\n const max = Math.pow(10, length) - 1;\n // Crypto PRNG (corrige Math.random prévisible)\n const range = max - min;\n const randomValue = crypto.getRandomValues(new Uint32Array(1))[0] /\n 0xffffffff;\n const code = Math.floor(min + randomValue * range).toString().padStart(\n length,\n \"0\",\n );\n const expiresAt = new Date(Date.now() + 10 * 60_000).toISOString(); // 10 minutes\n\n await sqlite.execute({\n args: [email, code, action, expiresAt],\n sql:\n \"INSERT OR REPLACE INTO verification_codes (email, code, action, expires_at) VALUES (?, ?, ?, ?)\",\n });\n\n return code;\n}\n\nexport async function verifyVerificationCode(\n email: string,\n code: string,\n action: string,\n): Promise {\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT code, expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length === 0) {\n return false;\n }\n\n const storedCode = result.rows[0][0] as string;\n const expiresAt = new Date(result.rows[0][1] as string);\n\n if (expiresAt < new Date()) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return false;\n }\n\n if (storedCode === code) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return true;\n }\n\n return false;\n}\n\nexport { sqlite };",[],[241],"3eb2d766-74cb-4ba1-b7be-181fe03ac202","auth.ts","01a032e5-0a44-775c-aa85-575605645a9c",12,["D",1787560963897],"import type { Hono } from \"npm:hono@4\";\nimport bcrypt from \"npm:bcryptjs\";\nimport {\n BCRYPT_ROUNDS,\n extractToken,\n generateVerificationCode,\n getDb,\n parseUserAgent,\n signToken,\n sqlite,\n verifyToken,\n verifyVerificationCode,\n} from \"./config.ts\";\nimport { sendVerificationEmail } from \"./email.ts\";\n\nexport function registerAuthRoutes(app: Hono) {\n // POST /register\n app.post(\"/register\", async (c) => {\n try {\n const { email, username, password } = await c.req.json();\n if (!email || !username || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const code = await generateVerificationCode(email, \"register\");\n await sendVerificationEmail(email, code, \"register\");\n\n return c.json({ email, status: \"verification_required\", success: true });\n } catch (err: any) {\n console.error(\"Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-register\n app.post(\"/verify-register\", async (c) => {\n try {\n const { email, username, password, code } = await c.req.json();\n if (!email || !username || !password || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(email, code, \"register\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n\n const result = await sql`\n INSERT INTO users (email, username, password_hash, tier)\n VALUES (${email}, ${username}, ${hash}, 'Free')\n RETURNING id, tier\n `;\n\n const user = result[0];\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") || \"Inconnue\";\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /login\n app.post(\"/login\", async (c) => {\n try {\n const { email, password, identifier } = await c.req.json();\n const loginId = (identifier || email || \"\").trim();\n if (!loginId || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, email, password_hash, tier FROM users WHERE email = ${loginId} OR username = ${loginId} OR phone = ${loginId} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n const user = users[0];\n const match = await bcrypt.compare(password, user.password_hash);\n if (!match) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n const code = await generateVerificationCode(user.email, \"login\");\n await sendVerificationEmail(user.email, code, \"login\");\n\n return c.json({\n email: user.email,\n status: \"verification_required\",\n success: true,\n });\n } catch (err: any) {\n console.error(\"Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-login\n app.post(\"/verify-login\", async (c) => {\n try {\n const { email, code } = await c.req.json();\n if (!email || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(email, code, \"login\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, tier FROM users WHERE email = ${email} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const user = users[0];\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n // Pour les tests en dev, on utilise une IP par défaut\n let ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") || c.req.header(\"x-real-ip\") || \"\";\n if (!ip || ip === \"::1\" || ip === \"127.0.0.1\") {\n ip = \"8.8.8.8\"; // IP Google par défaut pour ne pas planter l'API\n } else {\n // Extraire la première IP si on a une liste\n ip = ip.split(\",\")[0].trim();\n }\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n let locationStr = \"Lieu inconnu\";\n let countryStr = \"Pays inconnu\";\n try {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 3000);\n const geoRes = await fetch(`https://ip-api.com/json/${ip}`, {\n signal: controller.signal,\n headers: { \"User-Agent\": \"mAI/1.0\" },\n });\n clearTimeout(timeout);\n if (geoRes.ok) {\n const geoData = await geoRes.json();\n if (geoData.status === \"success\") {\n locationStr = `${geoData.city}, ${geoData.country}`;\n countryStr = geoData.country;\n }\n }\n } catch (e) {\n console.error(\"Erreur de géolocalisation:\", e);\n }\n\n // Vérifier si c'est un nouvel appareil ou un nouveau pays\n let isNewDeviceOrLocation = true;\n try {\n const pastDevices = await sql`\n SELECT device_name, location FROM connected_devices \n WHERE user_id = ${user.id}::text\n `;\n if (pastDevices.length > 0) {\n // C'est pas sa toute première connexion\n const knownDevice = pastDevices.some((d) =>\n d.device_name === device_name\n );\n const knownLocation = pastDevices.some((d) =>\n d.location && d.location.includes(countryStr)\n );\n if (knownDevice && knownLocation) {\n isNewDeviceOrLocation = false;\n }\n } else {\n // Première connexion jamais (donc nouvelle par defaut, ou pas besoin d'alerte? on envoie quand meme)\n isNewDeviceOrLocation = true;\n }\n } catch (e) {\n console.error(e);\n }\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name, location)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name}, ${locationStr})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n if (isNewDeviceOrLocation) {\n // On n'attend pas l'envoi de l'email\n sendVerificationEmail(email, \"\", \"new_login\", {\n device: device_name,\n location: locationStr,\n }).catch(console.error);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /resend-code\n app.post(\"/resend-code\", async (c) => {\n try {\n const { email, action } = await c.req.json();\n if (!email || !action) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n // Vérifier le rate-limit (1 minute)\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length > 0) {\n const expiresAt = new Date(result.rows[0][0] as string);\n const now = new Date();\n // Si la date d'expiration est > maintenant + 9 minutes, ça veut dire qu'il a été généré il y a moins d'1 minute.\n const diffMinutes = (expiresAt.getTime() - now.getTime()) / 60_000;\n if (diffMinutes > 9) {\n return c.json(\n { error: \"Veuillez patienter 1 minute avant de renvoyer un code.\" },\n 429,\n );\n }\n }\n\n const code = await generateVerificationCode(email, action);\n await sendVerificationEmail(email, code, action);\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"Resend Code Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-code\n app.post(\"/verify-code\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = String(payload.sub);\n\n const body = await c.req.json();\n const rawCode = body?.code;\n if (!rawCode) {\n return c.json({ error: \"Code requis.\" }, 400);\n }\n\n const inputCode = String(rawCode).trim().toUpperCase();\n const sql = getDb();\n\n let newTier: string | null = null;\n let dbCodeId: number | null = null;\n\n // 1. Recherche dans la table subscription_codes de la base de données\n try {\n const codeRows = await sql`\n SELECT id, code, tier, max_uses, uses_count, is_active, expires_at \n FROM subscription_codes \n WHERE UPPER(code) = UPPER(${inputCode}) \n LIMIT 1\n `;\n\n if (codeRows.length > 0) {\n const row = codeRows[0];\n\n if (!row.is_active) {\n return c.json(\n { error: \"Ce code d'abonnement est désactivé.\" },\n 400,\n );\n }\n\n if (row.expires_at && new Date(row.expires_at) < new Date()) {\n return c.json({ error: \"Ce code d'abonnement a expiré.\" }, 400);\n }\n\n if (\n row.max_uses > 0 && Number(row.uses_count) >= Number(row.max_uses)\n ) {\n return c.json(\n { error: \"Ce code a atteint son quota maximal d'utilisations.\" },\n 400,\n );\n }\n\n // Vérifier si l'utilisateur a déjà activé ce code spécifique\n try {\n const redemptions = await sql`\n SELECT id FROM subscription_code_redemptions \n WHERE code_id = ${row.id} AND user_id = ${userId}::text \n LIMIT 1\n `;\n if (redemptions.length > 0) {\n return c.json(\n {\n error: \"Vous avez déjà débloqué votre forfait avec ce code.\",\n },\n 400,\n );\n }\n } catch (_redErr) {\n // Ignorer si la table de redemptions n'est pas encore créée\n }\n\n newTier = row.tier;\n dbCodeId = row.id;\n }\n } catch (dbErr) {\n console.warn(\n \"Table subscription_codes non accessible, vérification fallback ENV:\",\n dbErr,\n );\n }\n\n // 2. Fallback vers les variables d'environnement si non trouvé en base\n if (!newTier) {\n const upgradeCodes: Record = {};\n\n const plusCode = Deno.env.get(\"MAI_PLUS_CODE\") ||\n Deno.env.get(\"PLUS_CODE\");\n if (plusCode) upgradeCodes[plusCode.trim().toUpperCase()] = \"Plus\";\n\n const proCode = Deno.env.get(\"MAI_PRO_CODE\") ||\n Deno.env.get(\"PRO_CODE\");\n if (proCode) upgradeCodes[proCode.trim().toUpperCase()] = \"Pro\";\n\n const maxCode = Deno.env.get(\"MAI_MAX_CODE\") ||\n Deno.env.get(\"MAX_CODE\");\n if (maxCode) upgradeCodes[maxCode.trim().toUpperCase()] = \"Max\";\n\n newTier = upgradeCodes[inputCode] || null;\n }\n\n if (!newTier) {\n console.log(`[Verify-Code] Code invalide soumis par user=${userId}`);\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // 3. Mise à jour de l'utilisateur et de ses clés API\n await sql`UPDATE users SET tier = ${newTier} WHERE id::text = ${userId}::text`;\n await sql`UPDATE mprojects_api_keys SET plan = ${newTier} WHERE user_id = ${userId}::text`;\n\n // 4. Incrémentation du compteur et log de l'utilisation en base\n if (dbCodeId) {\n try {\n await sql`\n UPDATE subscription_codes \n SET uses_count = uses_count + 1,\n is_active = CASE WHEN max_uses > 0 AND (uses_count + 1) >= max_uses THEN FALSE ELSE is_active END\n WHERE id = ${dbCodeId}\n `;\n await sql`\n INSERT INTO subscription_code_redemptions (code_id, user_id)\n VALUES (${dbCodeId}, ${userId}::text)\n `;\n } catch (updateErr) {\n console.error(\"Erreur mise à jour usage code:\", updateErr);\n }\n }\n\n // 5. Envoi d'un e-mail de remerciements pour la souscription\n try {\n const userRows =\n await sql`SELECT email, username FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (userRows.length > 0 && userRows[0].email) {\n await sendVerificationEmail(\n userRows[0].email,\n \"\",\n \"subscription_unlocked\",\n {\n tier: newTier,\n username: userRows[0].username,\n },\n );\n }\n } catch (mailErr) {\n console.error(\n \"Erreur envoi email remerciements souscription:\",\n mailErr,\n );\n }\n\n // 6. Nouveau token JWT avec le tier débloqué\n const newToken = await signToken({ sub: userId, tier: newTier });\n\n return c.json({\n message: `Merci d'avoir souscrit au forfait ${newTier} !`,\n success: true,\n tier: newTier,\n token: newToken,\n });\n } catch (err: any) {\n console.error(\"Verify-Code error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /update-profile\n app.post(\"/update-profile\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const body = await c.req.json();\n const {\n username,\n email,\n phone,\n password,\n currentPassword,\n newsletter,\n notify_limits,\n auto_logout_minutes,\n } = body;\n const sql = getDb();\n\n // Vérification obligatoire du mot de passe actuel\n if (!currentPassword) {\n return c.json(\n {\n error:\n \"Le mot de passe actuel est obligatoire pour modifier vos informations.\",\n },\n 400,\n );\n }\n\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n currentPassword,\n currentUser[0].password_hash,\n );\n if (!passMatch) {\n return c.json({ error: \"Le mot de passe actuel est incorrect.\" }, 400);\n }\n\n if (username && username.trim()) {\n const cleanUsername = username.trim();\n const existing =\n await sql`SELECT id FROM users WHERE username = ${cleanUsername} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Ce nom d'utilisateur est déjà pris.\" }, 400);\n }\n await sql`UPDATE users SET username = ${cleanUsername} WHERE id::text = ${userId}::text`;\n }\n\n if (email && email.trim()) {\n const cleanEmail = email.trim();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${cleanEmail} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n { error: \"Cette adresse e-mail est déjà utilisée.\" },\n 400,\n );\n }\n if (cleanEmail !== currentUser[0].email) {\n // Send OTP instead of updating directly\n const code = await generateVerificationCode(\n cleanEmail,\n \"verify_new_email\",\n );\n await sendVerificationEmail(cleanEmail, code, \"verify_new_email\");\n return c.json({\n status: \"email_verification_required\",\n email: cleanEmail,\n success: true,\n });\n }\n }\n\n if (phone !== undefined) {\n const cleanPhone = phone ? phone.trim() : null;\n if (cleanPhone) {\n const existing =\n await sql`SELECT id FROM users WHERE phone = ${cleanPhone} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n {\n error:\n \"Ce numéro de téléphone est déjà associé à un autre compte.\",\n },\n 400,\n );\n }\n }\n await sql`UPDATE users SET phone = ${cleanPhone} WHERE id::text = ${userId}::text`;\n }\n\n if (newsletter !== undefined) {\n await sql`UPDATE users SET newsletter = ${\n Boolean(newsletter)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (notify_limits !== undefined) {\n await sql`UPDATE users SET notify_limits = ${\n Boolean(notify_limits)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (auto_logout_minutes !== undefined) {\n const mins = parseInt(auto_logout_minutes, 10);\n if (!isNaN(mins)) {\n await sql`UPDATE users SET auto_logout_minutes = ${mins} WHERE id::text = ${userId}::text`;\n }\n }\n\n if (password && password.trim()) {\n if (password.length < 6) {\n return c.json(\n { error: \"Le mot de passe doit contenir au moins 6 caractères.\" },\n 400,\n );\n }\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n await sql`UPDATE users SET password_hash = ${hash} WHERE id::text = ${userId}::text`;\n }\n\n const updatedUser =\n await sql`SELECT username, email, phone, tier, newsletter, notify_limits FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n const user = updatedUser[0];\n\n return c.json({\n email: user?.email,\n newsletter: user?.newsletter,\n notify_limits: user?.notify_limits,\n phone: user?.phone,\n success: true,\n tier: user?.tier,\n username: user?.username,\n });\n } catch {\n return c.json({ error: \"Erreur lors de la mise à jour du profil.\" }, 500);\n }\n });\n\n // POST /verify-new-email\n app.post(\"/verify-new-email\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { email, code } = await c.req.json();\n if (!email || !code) return c.json({ error: \"Champs manquants.\" }, 400);\n\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"verify_new_email\",\n );\n if (!isValid) return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n\n const sql = getDb();\n await sql`UPDATE users SET email = ${email.trim()} WHERE id::text = ${userId}::text`;\n\n return c.json({ success: true, email: email.trim() });\n } catch (err: any) {\n console.error(\"verify-new-email Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /request-delete-account\n app.post(\"/request-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const email = currentUser[0].email;\n const code = await generateVerificationCode(email, \"delete_account\");\n await sendVerificationEmail(email, code, \"delete_account\");\n\n return c.json({ success: true, email });\n } catch (err: any) {\n console.error(\"request-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /confirm-delete-account\n app.post(\"/confirm-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) return c.json({ error: \"Non authentifié.\" }, 401);\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { password, code, confirmationText } = await c.req.json();\n if (!password || !code || confirmationText !== \"SUPPRIMER LE COMPTE\") {\n return c.json(\n { error: \"Informations de confirmation invalides.\" },\n 400,\n );\n }\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n password,\n currentUser[0].password_hash,\n );\n if (!passMatch) return c.json({ error: \"Mot de passe incorrect.\" }, 400);\n\n const email = currentUser[0].email;\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"delete_account\",\n );\n if (!isValid) return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n\n // Suppression (ou anonymisation)\n await sql`DELETE FROM users WHERE id::text = ${userId}::text`;\n\n // Révoquer le token pour déconnecter immédiatement\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"confirm-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // GET /api-keys\n app.get(\"/api-keys\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const sql = getDb();\n const keys = await sql`\n SELECT api_key, plan, request_count, created_at, last_used_at \n FROM mprojects_api_keys \n WHERE user_id = ${userId}::text\n `;\n\n return c.json({ success: true, keys });\n } catch (err: any) {\n console.error(\"Erreur API Keys:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n}",[],[248],"70b79866-39c0-421a-a9e7-ed98ff140dba","api-middleware.ts","01a032e5-0a43-7549-9388-fe650f699430",["D",1787560971113],2,"import type { Hono } from \"npm:hono@4\";\nimport { getDb, TIER_REQUEST_LIMITS, verifyToken } from \"./config.ts\";\n\nexport function registerMiddleware(app: Hono) {\n // Middleware /v1/* pour Auth & Logging\n app.use(\"/v1/*\", async (c, next) => {\n const path = c.req.path;\n const isPublicRoute = path === \"/v1/models\" || path === \"/v1/mai/models\" ||\n path === \"/v1/status\";\n\n const authHeader = c.req.header(\"Authorization\");\n const apiKey = authHeader?.startsWith(\"Bearer \")\n ? authHeader.slice(7)\n : null;\n const reqUserId = c.req.header(\"x-user-id\");\n const startTime = Date.now();\n\n const systemMaiApiKey = Deno.env.get(\"MAI_API_KEY\");\n\n let userPlan = \"Free\";\n let currentUserId: string | null = null;\n const currentApiKey: string | null = apiKey;\n let matchedApiKey: string | null = apiKey;\n\n function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n }\n\n // 1. Clé système MAI_API_KEY (accès complet aux modèles Plus/Max) — comparaison constant-time\n if (systemMaiApiKey && apiKey && timingSafeEqual(apiKey, systemMaiApiKey)) {\n userPlan = \"Plus\";\n currentUserId = \"system-mai\";\n } // 2. Clé API utilisateur enregistrée — comparaison exacte uniquement (pas de LIKE fuzzy)\n else if (apiKey) {\n const sql = getDb();\n const rows = await sql`\n SELECT k.*, u.tier as user_tier\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${apiKey}::text\n LIMIT 1\n `;\n\n const isJwtRoute = path.startsWith(\"/v1/devices\");\n\n if (rows.length > 0) {\n const apiKeyData = rows[0];\n userPlan = apiKeyData.user_tier || apiKeyData.plan || \"Free\";\n currentUserId = apiKeyData.user_id;\n matchedApiKey = apiKeyData.api_key || apiKey;\n } else if (isJwtRoute && apiKey) {\n // Routes de compte : accepter un token JWT de session (pas une API Key)\n try {\n const payload = await verifyToken(apiKey);\n currentUserId = String(payload.sub);\n userPlan = String(payload.tier || \"Free\");\n } catch {\n return c.json({ error: \"Invalid API Key.\" }, 403);\n }\n } else if (!isPublicRoute) {\n return c.json({ error: \"Invalid API Key.\" }, 403);\n }\n }\n\n // 3. En-tête x-user-id (requêtes web app / internes) : uniquement si déjà authentifié\n if (reqUserId && reqUserId !== \"system-mai\") {\n if (currentUserId) {\n // Déjà authentifié via clé API ou JWT : x-user-id doit correspondre, sinon on l'ignore\n if (reqUserId !== currentUserId) {\n console.warn(\n `[Auth] x-user-id mismatch: header=${reqUserId} vs auth=${currentUserId} — header ignoré`,\n );\n }\n } else if (apiKey) {\n // apiKey présent mais non reconnu (route publique) : ne pas promouvoir via x-user-id seul\n } else {\n // Aucune auth vérifiée\n try {\n const sql = getDb();\n const uRows = await sql`\n SELECT tier FROM users \n WHERE id::text = ${reqUserId}::text OR username = ${reqUserId}::text OR email = ${reqUserId}::text \n LIMIT 1\n `;\n if (uRows.length > 0) {\n if (isPublicRoute) {\n if (uRows[0].tier) userPlan = uRows[0].tier;\n currentUserId = reqUserId;\n } else {\n console.warn(\n `[Auth] x-user-id sans JWT sur route privée ${path} — ignoré`,\n );\n }\n }\n } catch {}\n }\n }\n\n // 4. Aucun identifiant et route privée\n if (!apiKey && !reqUserId && !isPublicRoute) {\n return c.json({ error: \"Service Unavailable. API Key missing.\" }, 401);\n }\n\n // Enregistrer le plan et les infos de contexte\n c.set(\"userPlan\", userPlan);\n c.set(\"userId\", currentUserId);\n c.set(\"apiKey\", currentApiKey);\n c.set(\"matchedApiKey\", matchedApiKey);\n\n // Vérification des quotas pour les clés API enregistrées\n if (apiKey && currentUserId && currentUserId !== \"system-mai\") {\n const tierMap: Record = {\n Free: 500,\n Gratuit: 500,\n Plus: 1000,\n Pro: 2000,\n Max: 5000,\n };\n const limit = TIER_REQUEST_LIMITS?.[userPlan] || tierMap[userPlan] || 500;\n const sql = getDb();\n\n // Réinitialisation mensuelle automatique si le mois a changé (idempotent)\n try {\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = 0\n WHERE user_id = ${currentUserId}::text\n AND last_used_at IS NOT NULL\n AND last_used_at < DATE_TRUNC('month', NOW())\n `;\n } catch {}\n\n // Calculer l'usage global pour l'utilisateur\n const countRows = await sql`\n SELECT SUM(request_count) as total_requests\n FROM mprojects_api_keys\n WHERE user_id = ${currentUserId}::text\n `;\n const globalRequestCount = countRows[0]?.total_requests || 0;\n\n if (globalRequestCount >= limit) {\n if (isPublicRoute) {\n await next();\n return;\n }\n return c.json({ error: \"Quota exceeded for your account.\" }, 429);\n }\n }\n\n await next();\n\n if (isPublicRoute) {\n return; // Ne pas logger les requêtes vers les routes publiques\n }\n\n const latency = Date.now() - startTime;\n const status = c.res.status;\n const endpoint = c.req.path;\n const method = c.req.method;\n\n // Logging & Mise à jour quota (uniquement pour les clés API utilisateur réelles)\n const isJwtRoute = path.startsWith(\"/v1/devices\");\n if (!isJwtRoute && apiKey && apiKey !== systemMaiApiKey) {\n try {\n const sql = getDb();\n const effectiveKeyToLog = matchedApiKey || apiKey;\n\n await sql`\n INSERT INTO mprojects_api_logs (api_key, endpoint, method, status_code, latency_ms)\n VALUES (${effectiveKeyToLog}::text, ${endpoint}::text, ${method}::text, ${status}::integer, ${latency}::integer)\n `;\n\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = request_count + 1, last_used_at = NOW()\n WHERE api_key = ${effectiveKeyToLog}::text\n `;\n } catch (err) {\n console.error(\"Erreur logging API:\", err);\n }\n }\n });\n}",[],[256],["D",1785339526786],["D",1789474235934],{"_11":12,"_138":74},{"_11":12,"_133":134,"_73":74,"_30":72,"_135":136,"_137":24},{"_39":123,"_13":16,"_33":36,"_124":84,"_125":63,"_126":127,"_128":88,"_129":84,"_130":42,"_131":14,"_132":12},"ctx",{"_52":-5,"_158":301,"_302":303,"_304":305,"_306":24,"_307":24,"_308":24,"_309":97,"_310":-5,"_311":-7,"_312":-7,"_313":26,"_314":24,"_315":24,"_316":-5,"_317":24,"_318":24,"_319":24,"_320":-5},"ENV",{"_272":273,"_274":275,"_276":64,"_277":278,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · devices.ts