Authorizing...

Authorizing... Click here if not redirected

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n // Explicitly allow all form actions including claude:// scheme\n \"Content-Security-Policy\":\n \"default-src 'self' 'unsafe-inline'; form-action *; frame-ancestors 'none';\",\n ...corsHeaders(),\n },\n });\n}\n\nasync function handleToken(req) {\n // Parse the form-encoded body\n let bodyText = \"\";\n try {\n bodyText = await req.text();\n console.log(\"TOKEN request body:\", bodyText.slice(0, 500));\n } catch (e) {\n console.log(\"TOKEN: could not read body:\", e.message);\n }\n\n const params = new URLSearchParams(bodyText);\n console.log(\n \"TOKEN grant_type:\",\n params.get(\"grant_type\"),\n \"client_id:\",\n params.get(\"client_id\"),\n );\n\n // Validate client credentials\n if (!validateClient(params)) {\n console.log(\"TOKEN: invalid client credentials\");\n return corsJson({ error: \"invalid_client\" }, 401);\n }\n\n // Issue a bearer token\n const token = \"wc_token_\" + crypto.randomUUID().replace(/-/g, \"\");\n const response = {\n access_token: token,\n token_type: \"Bearer\",\n expires_in: 86400,\n scope: \"read write\",\n refresh_token: \"wc_refresh_\" + crypto.randomUUID().replace(/-/g, \"\"),\n };\n console.log(\"TOKEN response:\", JSON.stringify(response));\n return corsJson(response);\n}\n\n// ── HTTP Router ──\n\nexport default async function (req) {\n const url = new URL(req.url);\n const path = url.pathname;\n\n // Log EVERY request for debugging\n console.log(\n `${req.method} ${path} ${url.search ? url.search.slice(0, 80) : \"\"}`,\n );\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders() });\n }\n\n // Force .well-known to 404 — prevents Claude.ai from entering OAuth flow\n if (path.startsWith(\"/.well-known/\")) {\n console.log(\"BLOCKED .well-known:\", path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // MCP endpoint — no auth required\n if (path === \"/mcp\" && req.method === \"POST\") {\n return handleMcp(req);\n }\n\n // OAuth endpoints DISABLED — Claude.ai falls back to these default paths\n // even when .well-known returns 404, triggering a broken OAuth flow.\n // Return 404 to force Claude to use the unauthenticated connection.\n if (\n (path === \"/register\" || path === \"/authorize\" || path === \"/token\") &&\n !url.searchParams.has(\"force_oauth\")\n ) {\n console.log(\"BLOCKED OAuth fallback:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // Seed endpoint (no auth required — called by build.sh)\n if (path === \"/seed\" && req.method === \"POST\") {\n return handleSeed(req);\n }\n\n // Health check\n if (path === \"/\" && req.method === \"GET\") {\n return corsJson({\n name: SERVER_INFO.name,\n version: SERVER_INFO.version,\n status: \"ok\",\n tools: TOOLS.length,\n endpoint: \"/mcp\",\n });\n }\n\n console.log(\"404 UNMATCHED:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n}\n\n// ── Helpers ──\n\nfunction corsHeaders() {\n return {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS, DELETE\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, Accept, Mcp-Session-Id\",\n \"Access-Control-Expose-Headers\": \"Mcp-Session-Id\",\n };\n}\n\nfunction corsJson(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...corsHeaders(),\n },\n });\n}\n\nfunction escapeHtml(str) {\n return str.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nfunction slugify(text) {\n return text\n .toLowerCase()\n .replace(/[^\\w\\s-]/g, \"\")\n .replace(/\\s+/g, \"-\")\n .replace(/-+/g, \"-\")\n .replace(/^-|-$/g, \"\");\n}","deleted","label",[113],"pulls",1,"forks","envVars",{"_136":51,"_138":51},"connections",{"_136":51,"_137":51},"count","unfilledCount","emptyCount",{"_20":112,"_13":113,"_114":115,"_116":-5,"_117":21,"_118":30,"_119":106,"_22":140,"_29":121,"_122":123,"_124":125,"_126":38,"_127":-5,"_141":142,"_87":143},["D",1771914096109],"children",[],[113],["D",1771908274004],{"_11":12,"_85":81},{"_11":12,"_79":-5,"_80":81,"_44":45,"_82":83,"_84":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_74":-5,"_75":-5,"_76":-5,"_77":14,"_78":12},"ctx",{"_67":-5,"_108":181,"_182":183,"_184":185,"_186":38,"_187":38,"_188":38,"_189":106,"_190":-5,"_191":-7,"_192":-7,"_193":51,"_194":38,"_195":38,"_196":-5,"_197":38,"_198":38,"_199":38,"_200":-5},"ENV",{"_152":153,"_154":155,"_156":26,"_157":158,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1