[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_190":191,"_192":193},"routes/_app.x.$handle.$name",{"_105":104,"_37":50,"_113":95,"_32":107,"_13":14,"_114":-5,"_11":115,"_116":117,"_118":119,"_120":121,"_122":123,"_26":-5,"_124":-5,"_125":-5,"_126":30,"_127":128,"_129":30,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_48":49,"_37":50,"_43":51,"_52":-5,"_53":30,"_54":55,"_56":55,"_57":58,"_59":-5,"_19":60,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":88,"_89":90,"_91":92,"_93":30},"version",3,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","fc844bd9-def4-4b86-9a9b-2a3eb12a9d6a","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":-7,"_29":30,"_31":30,"_32":33,"_34":33},"file",{"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":14,"_46":47,"_29":30},"previous","deleted",false,"deletedHere","path","lib/db.ts","latestPath","fileId","7522e8a4-a740-11f1-9639-1607ee4eb77e","name","db.ts","fileType","script","content","/**\n * SQLite schema + queries for users and sessions.\n * Database is scoped to this val.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport interface User {\n id: number;\n email: string;\n passwordHash: string;\n createdAt: number;\n}\n\nexport interface Session {\n token: string;\n userId: number;\n createdAt: number;\n}\n\nexport async function initDb(): Promise {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n passwordHash TEXT NOT NULL,\n createdAt INTEGER NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n userId INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n createdAt INTEGER NOT NULL\n )`);\n}\n\nexport async function createUser(\n email: string,\n passwordHash: string,\n): Promise {\n const res = await sqlite.execute({\n sql: \"INSERT INTO users (email, passwordHash, createdAt) VALUES (?, ?, ?)\",\n args: [email, passwordHash, Date.now()],\n });\n const id = Number(res.lastInsertRowid);\n return { id, email, passwordHash, createdAt: Date.now() };\n}\n\nexport async function findUserByEmail(email: string): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT id, email, passwordHash, createdAt FROM users WHERE email = ?\",\n args: [email],\n });\n const row = res.rows[0] as Record | undefined;\n if (!row) return null;\n return {\n id: row.id as number,\n email: row.email as string,\n passwordHash: row.passwordHash as string,\n createdAt: row.createdAt as number,\n };\n}\n\nexport async function findUserById(id: number): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT id, email, passwordHash, createdAt FROM users WHERE id = ?\",\n args: [id],\n });\n const row = res.rows[0] as Record | undefined;\n if (!row) return null;\n return {\n id: row.id as number,\n email: row.email as string,\n passwordHash: row.passwordHash as string,\n createdAt: row.createdAt as number,\n };\n}\n\nexport async function createSession(\n token: string,\n userId: number,\n): Promise {\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, userId, createdAt) VALUES (?, ?, ?)\",\n args: [token, userId, Date.now()],\n });\n}\n\nexport async function findSession(\n token: string,\n): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT token, userId, createdAt FROM sessions WHERE token = ?\",\n args: [token],\n });\n const row = res.rows[0] as Record | undefined;\n if (!row) return null;\n return {\n token: row.token as string,\n userId: row.userId as number,\n createdAt: row.createdAt as number,\n };\n}\n\nexport async function deleteSession(token: string): Promise {\n await sqlite.execute({\n sql: \"DELETE FROM sessions WHERE token = ?\",\n args: [token],\n });\n}\n","createdAt",["D",1788403071003],"branchVersion","branchId","f3696943-a273-4717-a367-2529b8699f92","id","7c95e742-1d59-467e-b1f7-289effbf1692","sambkw",["D",1788403044901],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Sambkw sample website with working email+password authentication","imageUrl","c1f94b8c-4441-434e-8b7b-3ee79bd9e8f8","pinnedFileId","89687324-a740-11f1-8395-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0651e-7b41-76ac-a4dd-a5dbdd5a1174","tursoName","7c95e7421d59467eb1f7289effbf1692","tursoHostname","7c95e7421d59467eb1f7289effbf1692-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789533091345],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_105":104,"_112":107},"org",{"_105":104,"_106":107,"_108":107,"_19":60,"_109":110,"_111":30},"branch",{"_13":94,"_37":95,"_48":47,"_96":49,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":50,"_103":104},"isOwned",9,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","ngzvhmcf","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_48":49,"_37":50,"_43":185,"_52":-5,"_53":30,"_54":55,"_56":55,"_57":58,"_59":-5,"_19":60,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":186,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":187,"_89":188,"_91":189,"_93":30},"tree",[163,166],"files",[163,164,165,166],"counts",{"_153":68,"_154":140,"_155":68,"_156":157,"_158":159},"contents",[134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_48":146,"_37":147,"_35":148,"_139":-5,"_46":47,"_45":149,"_141":64,"_43":150,"_13":68,"_39":151,"_41":-5,"_29":30,"_144":-5,"_32":152},{"_48":136,"_37":137,"_35":138,"_139":-5,"_46":47,"_45":140,"_141":30,"_43":142,"_13":68,"_39":40,"_41":143,"_29":30,"_144":-5,"_32":145},"45f053ca-04d6-4947-98c0-b477d1f062b5","main.ts","659eac9c-a740-11f1-a780-1607ee4eb77e","parentId",1,"latest",["D",1788403044959],"// placeholder","label",[137],"cf26488e-ece1-419b-a180-8245494bfab9","lib","33c1a848-fdd3-40ee-89f1-dbfc3d09a30d",2,["D",1788403065948],"directory",[147],"pulls","branches","forks","envVars",{"_160":140,"_162":68},"connections",{"_160":68,"_161":68},"count","unfilledCount","emptyCount",{"_48":146,"_37":147,"_35":148,"_139":-5,"_46":47,"_45":149,"_141":64,"_43":182,"_13":68,"_39":151,"_41":-5,"_29":30,"_144":-5,"_168":183,"_32":184},{"_48":178,"_37":38,"_35":36,"_139":148,"_46":47,"_45":14,"_141":64,"_43":179,"_13":68,"_39":40,"_41":42,"_29":30,"_144":-5,"_168":180,"_32":181},{"_48":171,"_37":172,"_35":173,"_139":148,"_46":47,"_45":149,"_141":64,"_43":174,"_13":68,"_39":40,"_41":175,"_29":30,"_144":-5,"_168":176,"_32":177},{"_48":136,"_37":137,"_35":138,"_139":-5,"_46":47,"_45":140,"_141":30,"_43":167,"_13":68,"_39":40,"_41":143,"_29":30,"_144":-5,"_168":169,"_32":170},["D",1788403044959],"children",[],[137],"aa7922d5-c9d1-4c4a-905a-0a95a437421b","security.ts","72208490-a740-11f1-9639-1607ee4eb77e",["D",1788403065948],"/**\n * Security helpers: password hashing (PBKDF2 via WebCrypto) and\n * HMAC-signed session cookies.\n */\n\nconst encoder = new TextEncoder();\n\n/** Derive a session cookie signing key from a secret. */\nasync function cookieKey(secret: string): Promise {\n return await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"],\n );\n}\n\n/** Hash a plaintext password. Store the returned string in the DB. */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n { name: \"PBKDF2\" },\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n salt,\n iterations: 100_000,\n hash: \"SHA-256\",\n },\n key,\n 256,\n );\n const hash = new Uint8Array(bits);\n const saltB64 = btoa(String.fromCharCode(...salt));\n const hashB64 = btoa(String.fromCharCode(...hash));\n return `pbkdf2$${saltB64}$${hashB64}`;\n}\n\n/** Verify a plaintext password against a stored hash string. */\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n const [scheme, saltB64, hashB64] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\") return false;\n const salt = Uint8Array.from(atob(saltB64), (c) => c.charCodeAt(0));\n const expected = Uint8Array.from(atob(hashB64), (c) => c.charCodeAt(0));\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n { name: \"PBKDF2\" },\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations: 100_000, hash: \"SHA-256\" },\n key,\n 256,\n );\n const actual = new Uint8Array(bits);\n if (actual.length !== expected.length) return false;\n let diff = 0;\n for (let i = 0; i < actual.length; i++) diff |= actual[i] ^ expected[i];\n return diff === 0;\n}\n\n/**\n * Sign an opaque token with the secret. Returns \"payload.signature\".\n * `payload` is base64url of the plaintext value we want to carry.\n */\nexport async function sign(payload: string, secret: string): Promise {\n const key = await cookieKey(secret);\n const sig = new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, encoder.encode(payload)),\n );\n const sigB64 = btoa(String.fromCharCode(...sig))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n return `${payload}.${sigB64}`;\n}\n\n/** Verify a signed token; returns the original payload or null if invalid. */\nexport async function verify(\n token: string,\n secret: string,\n): Promise {\n const lastDot = token.lastIndexOf(\".\");\n if (lastDot === -1) return null;\n const payload = token.slice(0, lastDot);\n const sigB64 = token.slice(lastDot + 1);\n const sig = Uint8Array.from(\n atob(sigB64.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n const key = await cookieKey(secret);\n // timing-safe verify\n try {\n const valid = await crypto.subtle.verify(\n \"HMAC\",\n key,\n sig,\n encoder.encode(payload),\n );\n return valid ? payload : null;\n } catch {\n return null;\n }\n}\n\nexport function base64urlEncode(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n}\n\nexport function base64urlDecode(str: string): Uint8Array {\n return Uint8Array.from(atob(str.replace(/-/g, \"+\").replace(/_/g, \"/\")), (c) =>\n c.charCodeAt(0),\n );\n}\n",[],[147,172],"93c7983a-fd89-49dd-852c-c7a263e8bc2e",["D",1788403071003],[],[147,38],["D",1788403065948],[164,165],[147],["D",1788403044901],["D",1789533091345],{"_105":104,"_112":107},{"_105":104,"_106":107,"_108":107,"_19":60,"_109":110,"_111":30},{"_13":94,"_37":95,"_48":47,"_96":49,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":50,"_103":104},"ctx",{"_87":-5,"_131":223,"_224":225,"_226":227,"_228":30,"_229":30,"_230":30,"_231":64,"_232":-5,"_233":-7,"_234":-7,"_235":68,"_236":30,"_237":30,"_238":-5,"_239":30,"_240":30,"_241":30,"_242":-5},"ENV",{"_194":195,"_196":197,"_198":95,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3