[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_185":186,"_187":188},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_140":-5,"_20":141,"_22":142,"_143":144,"_145":146,"_26":147,"_24":148,"_149":-5,"_150":-5,"_151":66,"_152":153,"_154":60,"_155":-5,"_156":-5,"_157":158},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","orbem","name","airtable-approval-form","branchName","main","version","path","index.ts","project",{"_33":82,"_13":14,"_45":83,"_84":-5,"_85":66,"_86":87,"_88":87,"_89":90,"_91":-5,"_92":93,"_94":38,"_95":60,"_96":-5,"_97":-5,"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_108":-5,"_109":110,"_111":110,"_112":113,"_114":113,"_115":113,"_116":110,"_117":110,"_118":119,"_120":121,"_122":123,"_124":66},"tree",[52,53,54],"file",{"_33":34,"_35":36,"_37":38,"_13":19,"_39":40,"_41":42,"_17":43,"_44":-5,"_45":46,"_47":48,"_49":50,"_18":51},"contents",[],"upstream","pull","ahead","behind","envVars","id","d19b1f89-2bb9-423f-ad25-e3f3d5ec5d77","branchId","9b9abaa1-d920-4c6c-9e30-bb9fac0049e3","fileId","65372a4c-9bc2-11f1-8237-1607ee4eb77e","content","// Airtable-backed approval form, gated behind Airtable OAuth sign-in.\n//\n// URL: /?record=recXXXX (the Airtable record id)\n//\n// Flow:\n// - Anyone not signed in is redirected to /auth/login → Airtable's OAuth.\n// - On return, /auth/callback exchanges the code, verifies via whoami and\n// creates a session (stored in SQLite; id in an httpOnly cookie).\n// - The record is read/written using the AIRTABLE_API_KEY env var (Option B:\n// the user's OAuth token is only used as an identity gate, so sign-in works\n// even if the approver isn't a base collaborator).\n//\n// Env vars required:\n// AIRTABLE_CLIENT_ID Airtable OAuth integration client id (set)\n// AIRTABLE_CLIENT_SECRET optional; omit unless you generate one in Airtable\n// AIRTABLE_API_KEY personal access token (data.records:read + write)\n//\n// OAuth callback URL (register this in the Airtable integration):\n// https://airtable-approval.val.run/auth/callback\n\nimport {\n buildAuthorizeUrl,\n exchangeCode,\n generateCodeChallenge,\n generateCodeVerifier,\n refreshAccessToken,\n whoami,\n} from \"./oauth.ts\";\nimport type { Tokens, WhoAmI } from \"./oauth.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---------- helpers ----------\n\nconst error = (msg: string, status = 500) =>\n new Response(`

Error

${escapeHtml(msg)}

`, {\n status,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n\nconst escapeHtml = (s: string) =>\n s.replace(\n /[&<>\"']/g,\n (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" })[\n c\n ]!,\n );\n\nconst methodNotAllowed = () =>\n new Response(\"Method Not Allowed\", { status: 405 });\n\n// Val Town's Response.redirect is unreliable; use a raw 302.\nconst redirect = (location: string) =>\n new Response(null, { status: 302, headers: { Location: location } });\n\nconst base = \"https://api.airtable.com/v0\";\n\n// All non-secret configuration lives here.\nconst config = {\n baseId: \"appmol7FrK9ONzsv6\", // the Airtable base id\n table: \"tblNwX4Wmd257B9yY\", // the table name or id\n // Field names in the table for the approval workflow:\n approverField: \"Approver\",\n noteField: \"Approver note\",\n statusField: \"Status\",\n // Fields describing what the approval is for (fetched & rendered):\n titleField: \"Title\",\n descriptionField: \"Description\",\n requestedByField: \"Requested by\",\n};\n\n// ---------- cookies ----------\n\nconst SESSION_COOKIE = \"airtable_session\";\nconst STATE_COOKIE = \"oauth_state\";\n\nfunction parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") ?? \"\";\n const out: Record = {};\n for (const part of header.split(\";\")) {\n const i = part.indexOf(\"=\");\n if (i === -1) continue;\n out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());\n }\n return out;\n}\n\nfunction cookieHeader(name: string, value: string, maxAge: number): string {\n return [\n `${name}=${encodeURIComponent(value)}`,\n \"Path=/\",\n \"HttpOnly\",\n \"SameSite=Lax\",\n \"Secure\",\n `Max-Age=${maxAge}`,\n ].join(\"; \");\n}\n\nconst randomId = () => crypto.randomUUID();\n\n// ---------- sessions (SQLite) ----------\n\ntype SessionRow = {\n id: string;\n airtable_id: string;\n email: string;\n access_token: string;\n refresh_token: string;\n expires_at: number;\n};\n\nasync function ensureSessionsTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS oauth_sessions (\n id TEXT PRIMARY KEY,\n airtable_id TEXT,\n email TEXT,\n access_token TEXT NOT NULL,\n refresh_token TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n created_at TEXT DEFAULT CURRENT_TIMESTAMP,\n updated_at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n}\n\nasync function getSession(id: string): Promise {\n const r = await sqlite.execute(\"SELECT * FROM oauth_sessions WHERE id = ?\", [id]);\n return (r.rows[0] as SessionRow | undefined) ?? null;\n}\n\n/** Load a session, refreshing the Airtable access token when it's expired. */\nasync function resolveSession(id: string | undefined): Promise {\n if (!id) return null;\n let row = await getSession(id);\n if (!row) return null;\n\n if (Date.now() >= row.expires_at - 30_000) {\n try {\n const tok = await refreshAccessToken(row.refresh_token);\n const info = await whoami(tok.access_token).catch(() => null);\n const newExp = Date.now() + (tok.expires_in ?? 3600) * 1000;\n const refreshedToken = tok.refresh_token ?? row.refresh_token;\n await sqlite.execute(\n `UPDATE oauth_sessions\n SET access_token = ?, refresh_token = ?, expires_at = ?, email = ?\n WHERE id = ?`,\n [tok.access_token, refreshedToken, newExp, info?.email ?? row.email, id],\n );\n row = {\n ...row,\n access_token: tok.access_token,\n refresh_token: refreshedToken,\n expires_at: newExp,\n email: info?.email ?? row.email,\n };\n } catch (e) {\n console.error(\"Session refresh failed, dropping session:\", (e as Error).message);\n await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [id]);\n return null;\n }\n }\n return row;\n}\n\nasync function createSession(info: WhoAmI, tok: Tokens): Promise {\n await ensureSessionsTable();\n const id = randomId();\n const expiresAt = Date.now() + (tok.expires_in ?? 3600) * 1000;\n await sqlite.execute(\n `INSERT INTO oauth_sessions (id, airtable_id, email, access_token, refresh_token, expires_at)\n VALUES (?, ?, ?, ?, ?, ?)`,\n [id, info.id, info.email ?? \"\", tok.access_token, tok.refresh_token ?? \"\", expiresAt],\n );\n return id;\n}\n\n// ---------- OAuth flow ----------\n\n// Only ever redirect back to a same-origin relative path (no open redirect).\nfunction normalizeRedirect(p: string | null): string {\n return p && p.startsWith(\"/\") && !p.startsWith(\"//\") ? p : \"/\";\n}\n\nfunction decodeRedirect(encoded: string | undefined): string {\n if (!encoded) return \"/\";\n try {\n return normalizeRedirect(atob(encoded));\n } catch {\n return \"/\";\n }\n}\n\nasync function handleLogin(req: Request): Promise {\n const url = new URL(req.url);\n const redirectTo = normalizeRedirect(url.searchParams.get(\"redirect\"));\n const proceed = url.searchParams.get(\"proceed\") === \"1\";\n\n // First visit: show an interstitial sign-in page with a \"Login with Airtable\"\n // button rather than bouncing the user straight into Airtable's OAuth screen.\n if (!proceed) {\n const loginUrl =\n `/auth/login?proceed=1&redirect=${encodeURIComponent(redirectTo)}`;\n return new Response(\n `\n

🔒 Sign in to review this request

This decision needs an approval. To keep it accountable, please sign in with your Airtable account before continuing.

\n Login with Airtable\n

Signing in only verifies who you are — no access to your Airtable bases is granted.

\n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n const state = randomId();\n // PKCE: generate a per-request verifier, send its S256 challenge to Airtable,\n // and keep the verifier (packed in the state cookie) to present on exchange.\n const verifier = generateCodeVerifier();\n const challenge = await generateCodeChallenge(verifier);\n // Pack the return path + PKCE verifier into the state cookie so we know them\n // after authorize. (base64/verifier contain no \".\" so splitting is safe.)\n const stateValue = `${state}.${btoa(redirectTo)}.${verifier}`;\n const authorizeUrl = buildAuthorizeUrl(\n `${url.origin}/auth/callback`,\n state,\n challenge,\n );\n const h = new Headers({ Location: authorizeUrl });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, stateValue, 600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleCallback(req: Request): Promise {\n const url = new URL(req.url);\n const cookies = parseCookies(req);\n const code = url.searchParams.get(\"code\");\n const returnedState = url.searchParams.get(\"state\");\n\n if (!code) {\n return error(\n `Airtable sign-in was cancelled or failed (${escapeHtml(\n url.searchParams.get(\"error_description\") ?? url.searchParams.get(\"error\") ?? \"no code\",\n )}).`,\n 400,\n );\n }\n\n // Verify the CSRF state matches what we set before the authorize redirect.\n const stateValue = cookies[STATE_COOKIE];\n const expectedState = stateValue?.split(\".\")[0];\n if (!expectedState || returnedState !== expectedState) {\n return error(\"Sign-in did not validate (state mismatch). Please try again.\", 400);\n }\n const parts = stateValue.split(\".\");\n const redirectTo = decodeRedirect(parts[1]);\n const verifier = parts[2];\n\n let tokens: Tokens;\n try {\n tokens = await exchangeCode(code, `${url.origin}/auth/callback`, verifier);\n } catch (e) {\n return error(`Could not complete Airtable sign-in: ${escapeHtml((e as Error).message)}`, 502);\n }\n let info: WhoAmI;\n try {\n info = await whoami(tokens.access_token);\n } catch (e) {\n return error(`Could not verify your Airtable account: ${escapeHtml((e as Error).message)}`, 502);\n }\n\n const sessionId = await createSession(info, tokens);\n const h = new Headers({ Location: redirectTo });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, \"\", 0)); // clear state\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, sessionId, 30 * 24 * 3600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleLogout(req: Request): Promise {\n const url = new URL(req.url);\n const sid = parseCookies(req)[SESSION_COOKIE];\n if (sid) await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [sid]);\n const h = new Headers({ Location: normalizeRedirect(url.searchParams.get(\"redirect\")) });\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, \"\", 0));\n return new Response(null, { status: 302, headers: h });\n}\n\n// \"first.last@x.com\" → \"First Last\"\nfunction displayName(email: string): string {\n const local = (email.split(\"@\")[0] ?? \"\").trim();\n if (!local) return \"\";\n return local.replace(/[._-]+/g, \" \").replace(/\\b\\w/g, (c) => c.toUpperCase());\n}\n\n// Minimal kv store for approvals so they're visible in Val Town too.\nasync function writeMeta(\n recordId: string,\n approver: string,\n note: string,\n status: string,\n) {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS approvals (\n record_id TEXT PRIMARY KEY, approver TEXT, note TEXT, status TEXT, at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n await sqlite.execute(\n `INSERT OR REPLACE INTO approvals (record_id, approver, note, status) VALUES (?, ?, ?, ?)`,\n [recordId, approver, note, status],\n );\n}\n\n// ---------- handler ----------\n\nexport default async function handler(req: Request): Promise {\n await ensureSessionsTable();\n\n const key = Deno.env.get(\"AIRTABLE_API_KEY\");\n if (!key) {\n return error(\n \"Missing AIRTABLE_API_KEY env var. Add it in the val's env vars.\",\n );\n }\n\n const url = new URL(req.url);\n const path = url.pathname;\n\n // OAuth plumbing\n if (path === \"/auth/login\") return req.method === \"GET\" ? handleLogin(req) : methodNotAllowed();\n if (path === \"/auth/callback\") return req.method === \"GET\" ? handleCallback(req) : methodNotAllowed();\n if (path === \"/auth/logout\") return req.method === \"POST\" ? handleLogout(req) : methodNotAllowed();\n\n // Everything else requires Airtable sign-in.\n const session = await resolveSession(parseCookies(req)[SESSION_COOKIE]);\n if (!session) {\n return redirect(`/auth/login?redirect=${encodeURIComponent(url.pathname + url.search)}`);\n }\n const signedInAs = session.email || \"an Airtable user\";\n\n const recordId = url.searchParams.get(\"record\");\n if (!recordId) {\n return error(\"Missing ?record= in the URL.\", 400);\n }\n\n const { baseId, table } = config;\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const decision = form.get(\"decision\")?.toString() || \"\";\n const approver = form.get(\"approver\")?.toString() || \"\";\n const note = form.get(\"note\")?.toString() || \"\";\n\n const status = decision === \"approve\" ? \"Approved\" : \"Declined\";\n\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n method: \"PATCH\",\n headers: {\n Authorization: `Bearer ${key}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n typecast: true,\n fields: { [config.statusField]: status },\n }),\n }).catch((e) => null);\n\n if (!res || !res.ok) {\n const body = res ? await res.text() : \"network error\";\n console.error(\"Airtable PATCH failed:\", res?.status, body);\n return error(`Could not update the record. ${body}`, 502);\n }\n\n // Record who approved (verified sign-in email) alongside the note.\n await writeMeta(recordId, approver || signedInAs, note, status).catch(() => {});\n\n return new Response(\n `\n

✅ ${escapeHtml(decision === \"approve\" ? \"Approved\" : \"Declined\")}

Thanks, your decision for this record has been saved to Airtable.

Signed in as ${escapeHtml(signedInAs)}

\n Back\n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n if (req.method !== \"GET\") {\n return methodNotAllowed();\n }\n\n // GET — fetch record and render form\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n headers: { Authorization: `Bearer ${key}` },\n }).catch(() => null);\n\n if (!res || !res.ok) {\n return error(`Could not fetch record ${recordId}. Is the id valid?`, 404);\n }\n const data = await res.json();\n const recordFields = data.fields || {};\n const title = recordFields[config.titleField] ?? \"Approval request\";\n const description = recordFields[config.descriptionField];\n // Collaborator fields come back as an array of { name } objects.\n const rawRequester = recordFields[config.requestedByField];\n const requestedBy = Array.isArray(rawRequester) && rawRequester.length > 0\n ? rawRequester.map((c: { name?: string }) => c.name).filter(Boolean).join(\", \")\n : \"\";\n\n const nameDefault = displayName(signedInAs);\n\n return new Response(\n `\n

\n Signed in as ${escapeHtml(signedInAs)}\n

${escapeHtml(String(title))}

\n ${requestedBy ? `

Requested by: ${escapeHtml(requestedBy)}

` : \"\"}\n ${\n description\n ? `

${\n escapeHtml(String(description))\n }

`\n : \"\"\n }\n

Review this request and submit your decision.

\n \n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n","fileType","http",15,"parentId","createdAt",["D",1787237203893],"branchVersion",22,"label","airtable-approval",[19],{"_33":73,"_13":74,"_37":75,"_44":-5,"_35":36,"_47":76,"_59":60,"_45":77,"_17":78,"_41":24,"_39":79,"_65":66,"_49":-5,"_67":80,"_18":81},{"_33":34,"_13":19,"_37":38,"_44":-5,"_35":36,"_47":48,"_59":60,"_45":70,"_17":43,"_41":42,"_39":40,"_65":66,"_49":50,"_67":71,"_18":72},{"_33":55,"_13":56,"_37":57,"_44":-5,"_35":36,"_47":58,"_59":60,"_45":61,"_17":62,"_41":63,"_39":64,"_65":66,"_49":-5,"_67":68,"_18":69},"5326d53f-8e96-4c9e-80d6-650f3b8ae56b","oauth.ts","dfea9bac-9c71-11f1-bb45-1607ee4eb77e",18,"latest",true,["D",1787232419485],2,"script","// Airtable OAuth helpers (verified sign-in; no data access).\n//\n// We only request `user.email:read` so the user's token is purely an identity\n// guard. All base reads/writes continue to use the AIRTABLE_API_KEY env var.\n//\n// Env vars:\n// AIRTABLE_CLIENT_ID (required) from your Airtable OAuth integration\n// AIRTABLE_CLIENT_SECRET (optional) only if you generate one in Airtable\n\nexport const AUTHORIZE_URL = \"https://airtable.com/oauth2/v1/authorize\";\nexport const TOKEN_URL = \"https://airtable.com/oauth2/v1/token\";\nexport const WHOAMI_URL = \"https://api.airtable.com/v0/meta/whoami\";\nexport const SCOPE = \"user.email:read\";\n\nexport interface Tokens {\n access_token: string;\n refresh_token?: string;\n expires_in?: number;\n token_type?: string;\n}\n\nexport interface WhoAmI {\n id: string;\n email?: string;\n scopes: string[];\n}\n\nconst requiredClientId = () => {\n const clientId = Deno.env.get(\"AIRTABLE_CLIENT_ID\");\n if (!clientId) {\n throw new Error(\n \"Missing AIRTABLE_CLIENT_ID env var. Add it in the val's env vars.\",\n );\n }\n return clientId;\n};\n\n// ---------- PKCE helpers ----------\n// Airtable requires PKCE when the integration has no client secret (public\n// client). We generate a per-request verifier, send its S256 challenge in the\n// authorize request, then present the verifier when exchanging the code.\n\nconst base64Url = (bytes: Uint8Array): string => {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n};\n\n/** High-entropy random verifier (43 chars, URL-safe). */\nexport function generateCodeVerifier(): string {\n const bytes = crypto.getRandomValues(new Uint8Array(32));\n return base64Url(bytes);\n}\n\n/** S256 code_challenge derived from a verifier. */\nexport async function generateCodeChallenge(verifier: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n return base64Url(new Uint8Array(digest));\n}\n\n/** URL to send the user to Airtable to authorize. */\nexport function buildAuthorizeUrl(\n redirectUri: string,\n state: string,\n codeChallenge: string,\n): string {\n const params = new URLSearchParams({\n client_id: requiredClientId(),\n redirect_uri: redirectUri,\n response_type: \"code\",\n scope: SCOPE,\n state,\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n });\n return `${AUTHORIZE_URL}?${params.toString()}`;\n}\n\nasync function tokenRequest(body: URLSearchParams): Promise {\n const clientSecret = Deno.env.get(\"AIRTABLE_CLIENT_SECRET\");\n body.set(\"client_id\", requiredClientId());\n if (clientSecret) body.set(\"client_secret\", clientSecret);\n\n const res = await fetch(TOKEN_URL, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: body.toString(),\n }).catch((e) => {\n throw new Error(`Airtable token endpoint error: ${(e as Error).message}`);\n });\n if (!res.ok) {\n throw new Error(`Airtable token endpoint HTTP ${res.status}: ${await res.text()}`);\n }\n return res.json() as Promise;\n}\n\n/** Exchange the authorization `code` for tokens. */\nexport async function exchangeCode(\n code: string,\n redirectUri: string,\n codeVerifier: string,\n): Promise {\n return tokenRequest(\n new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: redirectUri,\n code_verifier: codeVerifier,\n }),\n );\n}\n\n/** Refresh an expired access token (keeps the session alive up to ~30 days). */\nexport async function refreshAccessToken(refreshToken: string): Promise {\n return tokenRequest(\n new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n );\n}\n\n/** Get the authenticated Airtable user's id + email (needs user.email:read). */\nexport async function whoami(accessToken: string): Promise {\n const res = await fetch(WHOAMI_URL, {\n headers: { Authorization: `Bearer ${accessToken}` },\n }).catch((e) => {\n throw new Error(`Airtable whoami error: ${(e as Error).message}`);\n });\n if (!res.ok) {\n throw new Error(`Airtable whoami HTTP ${res.status}: ${await res.text()}`);\n }\n return res.json() as Promise;\n}\n","deleted",false,"children",[],[56],["D",1787237203893],[],[19],"bca51ec0-87ce-44eb-a7af-23424e3cb0e4","AGENTS.md","66a06bdc-9bc2-11f1-ba34-1607ee4eb77e",23,["D",1787237214804],3,"# Airtable Approval Form\n\nAirtable-backed approval form gated behind **Airtable OAuth sign-in**.\n\n## How auth works (important)\n- Users must sign in with Airtable before the app is usable. Visiting any page\n while logged out redirects to `/auth/login`, which first shows an interstitial\n \"Login with Airtable\" page; clicking the button (`?proceed=1`) then redirects to\n `https://airtable.com/oauth2/v1/authorize`.\n- The OAuth token is **identity-only** (scope `user.email:read`). It is used\n only to verify who signed in and to resolve their email via `/v0/meta/whoami`.\n- All base reads/writes use the **`AIRTABLE_API_KEY`** env var (a personal access\n token), NOT the user's OAuth token. This is intentional — sign-in is a gate,\n and doesn't require approvers to be base collaborators. Don't \"fix\" this by\n switching base calls to the OAuth token.\n- Sessions live in the SQLite `oauth_sessions` table; the session id is an\n httpOnly `airtable_session` cookie. Access tokens are refreshed on demand\n (`refresh_token` grant) so sessions last up to ~30 days.\n\n## Routes\n- `GET /auth/login` — starts OAuth, sets CSRF `oauth_state` cookie\n- `GET /auth/callback` — exchanges code, verifies state + whoami, creates session\n- `POST /auth/logout` — deletes session, clears cookie\n- everything else — gated behind a valid session; reads/writes the record\n\n## Env vars\n- `AIRTABLE_CLIENT_ID` — required; from the Airtable OAuth integration\n- `AIRTABLE_CLIENT_SECRET` — optional; only if one was generated\n- `AIRTABLE_API_KEY` — required; personal access token for the base\n\n## One-time Airtable setup\nRegister the OAuth callback URL in the integration (in Airtable → Builder Hub →\nOAuth integrations):\n`https://airtable-approval.val.run/auth/callback`\n\nA full sign-in round trip (Airtable login → callback → session redirect) must be\ntested in a real browser; `fetch_val_endpoint` cannot complete it.\n",[],[74],"4d61816f-152b-42a1-8139-861fa01332f5",["D",1787139453377],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Airtable-backed approval form (approve/decline)","imageUrl","userId","45088755-762b-4822-a602-c6427fb13a1a","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a019cc-24df-7478-82d7-5b520124f432","tursoName","4d61816f152b42a18139861fa01332f5","tursoHostname","4d61816f152b42a18139861fa01332f5-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789476648181],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_139":-5},"org",{"_11":12,"_133":134,"_135":-5,"_92":-5,"_136":137,"_138":66},"branch",{"_17":76,"_13":16,"_33":36,"_125":82,"_126":-5,"_127":-5,"_128":-5,"_129":-5,"_130":-5,"_131":14,"_132":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Orbem","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":82,"_13":14,"_45":180,"_84":-5,"_85":66,"_86":87,"_88":87,"_89":90,"_91":-5,"_92":93,"_94":38,"_95":60,"_96":-5,"_97":-5,"_98":99,"_100":101,"_102":103,"_104":105,"_106":181,"_108":-5,"_109":110,"_111":110,"_112":113,"_114":113,"_115":113,"_116":110,"_117":110,"_118":182,"_120":183,"_122":184,"_124":66},[171,172,173],"files",[171,172,173],"counts",{"_161":99,"_162":163,"_164":99,"_32":165,"_166":167},[],{"_33":34,"_35":36,"_37":38,"_13":19,"_39":40,"_41":42,"_17":43,"_44":-5,"_45":159,"_47":48,"_49":50,"_18":160},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787237203893],[19],"pulls","branches",1,"forks",{"_168":62,"_170":99},"connections",{"_168":99,"_169":99},"count","unfilledCount","emptyCount",{"_33":73,"_13":74,"_37":75,"_44":-5,"_35":36,"_47":76,"_59":60,"_45":77,"_17":78,"_41":24,"_39":79,"_65":66,"_49":-5,"_67":178,"_18":179},{"_33":34,"_13":19,"_37":38,"_44":-5,"_35":36,"_47":48,"_59":60,"_45":70,"_17":43,"_41":42,"_39":40,"_65":66,"_49":50,"_67":176,"_18":177},{"_33":55,"_13":56,"_37":57,"_44":-5,"_35":36,"_47":58,"_59":60,"_45":61,"_17":62,"_41":63,"_39":64,"_65":66,"_49":-5,"_67":174,"_18":175},[],[56],[],[19],[],[74],["D",1787139453377],["D",1789476648181],{"_11":12,"_139":-5},{"_11":12,"_133":134,"_135":-5,"_92":-5,"_136":137,"_138":66},{"_17":76,"_13":16,"_33":36,"_125":82,"_126":-5,"_127":-5,"_128":-5,"_129":-5,"_130":-5,"_131":14,"_132":12},"ctx",{"_118":-5,"_156":218,"_219":220,"_221":222,"_223":66,"_224":66,"_225":66,"_226":60,"_227":-5,"_228":-7,"_229":-7,"_230":99,"_231":66,"_232":66,"_233":-5,"_234":66,"_235":66,"_236":66,"_237":-5},"ENV",{"_189":190,"_191":192,"_193":16,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]