Error

${escapeHtml(msg)}

`, {\n status,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n\nconst escapeHtml = (s: string) =>\n s.replace(\n /[&<>\"']/g,\n (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" })[\n c\n ]!,\n );\n\nconst methodNotAllowed = () =>\n new Response(\"Method Not Allowed\", { status: 405 });\n\n// Val Town's Response.redirect is unreliable; use a raw 302.\nconst redirect = (location: string) =>\n new Response(null, { status: 302, headers: { Location: location } });\n\nconst base = \"https://api.airtable.com/v0\";\n\n// All non-secret configuration lives here.\nconst config = {\n baseId: \"appmol7FrK9ONzsv6\", // the Airtable base id\n table: \"tblNwX4Wmd257B9yY\", // the table name or id\n // Field names in the table for the approval workflow:\n approverField: \"Approver\",\n noteField: \"Approver note\",\n statusField: \"Status\",\n // Fields describing what the approval is for (fetched & rendered):\n titleField: \"Title\",\n descriptionField: \"Description\",\n requestedByField: \"Requested by\",\n};\n\n// ---------- cookies ----------\n\nconst SESSION_COOKIE = \"airtable_session\";\nconst STATE_COOKIE = \"oauth_state\";\n\nfunction parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") ?? \"\";\n const out: Record = {};\n for (const part of header.split(\";\")) {\n const i = part.indexOf(\"=\");\n if (i === -1) continue;\n out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());\n }\n return out;\n}\n\nfunction cookieHeader(name: string, value: string, maxAge: number): string {\n return [\n `${name}=${encodeURIComponent(value)}`,\n \"Path=/\",\n \"HttpOnly\",\n \"SameSite=Lax\",\n \"Secure\",\n `Max-Age=${maxAge}`,\n ].join(\"; \");\n}\n\nconst randomId = () => crypto.randomUUID();\n\n// ---------- sessions (SQLite) ----------\n\ntype SessionRow = {\n id: string;\n airtable_id: string;\n email: string;\n access_token: string;\n refresh_token: string;\n expires_at: number;\n};\n\nasync function ensureSessionsTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS oauth_sessions (\n id TEXT PRIMARY KEY,\n airtable_id TEXT,\n email TEXT,\n access_token TEXT NOT NULL,\n refresh_token TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n created_at TEXT DEFAULT CURRENT_TIMESTAMP,\n updated_at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n}\n\nasync function getSession(id: string): Promise {\n const r = await sqlite.execute(\"SELECT * FROM oauth_sessions WHERE id = ?\", [id]);\n return (r.rows[0] as SessionRow | undefined) ?? null;\n}\n\n/** Load a session, refreshing the Airtable access token when it's expired. */\nasync function resolveSession(id: string | undefined): Promise {\n if (!id) return null;\n let row = await getSession(id);\n if (!row) return null;\n\n if (Date.now() >= row.expires_at - 30_000) {\n try {\n const tok = await refreshAccessToken(row.refresh_token);\n const info = await whoami(tok.access_token).catch(() => null);\n const newExp = Date.now() + (tok.expires_in ?? 3600) * 1000;\n const refreshedToken = tok.refresh_token ?? row.refresh_token;\n await sqlite.execute(\n `UPDATE oauth_sessions\n SET access_token = ?, refresh_token = ?, expires_at = ?, email = ?\n WHERE id = ?`,\n [tok.access_token, refreshedToken, newExp, info?.email ?? row.email, id],\n );\n row = {\n ...row,\n access_token: tok.access_token,\n refresh_token: refreshedToken,\n expires_at: newExp,\n email: info?.email ?? row.email,\n };\n } catch (e) {\n console.error(\"Session refresh failed, dropping session:\", (e as Error).message);\n await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [id]);\n return null;\n }\n }\n return row;\n}\n\nasync function createSession(info: WhoAmI, tok: Tokens): Promise {\n await ensureSessionsTable();\n const id = randomId();\n const expiresAt = Date.now() + (tok.expires_in ?? 3600) * 1000;\n await sqlite.execute(\n `INSERT INTO oauth_sessions (id, airtable_id, email, access_token, refresh_token, expires_at)\n VALUES (?, ?, ?, ?, ?, ?)`,\n [id, info.id, info.email ?? \"\", tok.access_token, tok.refresh_token ?? \"\", expiresAt],\n );\n return id;\n}\n\n// ---------- OAuth flow ----------\n\n// Only ever redirect back to a same-origin relative path (no open redirect).\nfunction normalizeRedirect(p: string | null): string {\n return p && p.startsWith(\"/\") && !p.startsWith(\"//\") ? p : \"/\";\n}\n\nfunction decodeRedirect(encoded: string | undefined): string {\n if (!encoded) return \"/\";\n try {\n return normalizeRedirect(atob(encoded));\n } catch {\n return \"/\";\n }\n}\n\nasync function handleLogin(req: Request): Promise {\n const url = new URL(req.url);\n const redirectTo = normalizeRedirect(url.searchParams.get(\"redirect\"));\n const proceed = url.searchParams.get(\"proceed\") === \"1\";\n\n // First visit: show an interstitial sign-in page with a \"Login with Airtable\"\n // button rather than bouncing the user straight into Airtable's OAuth screen.\n if (!proceed) {\n const loginUrl =\n `/auth/login?proceed=1&redirect=${encodeURIComponent(redirectTo)}`;\n return new Response(\n `\n

🔒 Sign in to review this request

This decision needs an approval. To keep it accountable, please sign in with your Airtable account before continuing.

\n Login with Airtable\n

Signing in only verifies who you are — no access to your Airtable bases is granted.

\n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n const state = randomId();\n // PKCE: generate a per-request verifier, send its S256 challenge to Airtable,\n // and keep the verifier (packed in the state cookie) to present on exchange.\n const verifier = generateCodeVerifier();\n const challenge = await generateCodeChallenge(verifier);\n // Pack the return path + PKCE verifier into the state cookie so we know them\n // after authorize. (base64/verifier contain no \".\" so splitting is safe.)\n const stateValue = `${state}.${btoa(redirectTo)}.${verifier}`;\n const authorizeUrl = buildAuthorizeUrl(\n `${url.origin}/auth/callback`,\n state,\n challenge,\n );\n const h = new Headers({ Location: authorizeUrl });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, stateValue, 600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleCallback(req: Request): Promise {\n const url = new URL(req.url);\n const cookies = parseCookies(req);\n const code = url.searchParams.get(\"code\");\n const returnedState = url.searchParams.get(\"state\");\n\n if (!code) {\n return error(\n `Airtable sign-in was cancelled or failed (${escapeHtml(\n url.searchParams.get(\"error_description\") ?? url.searchParams.get(\"error\") ?? \"no code\",\n )}).`,\n 400,\n );\n }\n\n // Verify the CSRF state matches what we set before the authorize redirect.\n const stateValue = cookies[STATE_COOKIE];\n const expectedState = stateValue?.split(\".\")[0];\n if (!expectedState || returnedState !== expectedState) {\n return error(\"Sign-in did not validate (state mismatch). Please try again.\", 400);\n }\n const parts = stateValue.split(\".\");\n const redirectTo = decodeRedirect(parts[1]);\n const verifier = parts[2];\n\n let tokens: Tokens;\n try {\n tokens = await exchangeCode(code, `${url.origin}/auth/callback`, verifier);\n } catch (e) {\n return error(`Could not complete Airtable sign-in: ${escapeHtml((e as Error).message)}`, 502);\n }\n let info: WhoAmI;\n try {\n info = await whoami(tokens.access_token);\n } catch (e) {\n return error(`Could not verify your Airtable account: ${escapeHtml((e as Error).message)}`, 502);\n }\n\n const sessionId = await createSession(info, tokens);\n const h = new Headers({ Location: redirectTo });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, \"\", 0)); // clear state\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, sessionId, 30 * 24 * 3600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleLogout(req: Request): Promise {\n const url = new URL(req.url);\n const sid = parseCookies(req)[SESSION_COOKIE];\n if (sid) await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [sid]);\n const h = new Headers({ Location: normalizeRedirect(url.searchParams.get(\"redirect\")) });\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, \"\", 0));\n return new Response(null, { status: 302, headers: h });\n}\n\n// \"first.last@x.com\" → \"First Last\"\nfunction displayName(email: string): string {\n const local = (email.split(\"@\")[0] ?? \"\").trim();\n if (!local) return \"\";\n return local.replace(/[._-]+/g, \" \").replace(/\\b\\w/g, (c) => c.toUpperCase());\n}\n\n// Minimal kv store for approvals so they're visible in Val Town too.\nasync function writeMeta(\n recordId: string,\n approver: string,\n note: string,\n status: string,\n) {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS approvals (\n record_id TEXT PRIMARY KEY, approver TEXT, note TEXT, status TEXT, at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n await sqlite.execute(\n `INSERT OR REPLACE INTO approvals (record_id, approver, note, status) VALUES (?, ?, ?, ?)`,\n [recordId, approver, note, status],\n );\n}\n\n// ---------- handler ----------\n\nexport default async function handler(req: Request): Promise {\n await ensureSessionsTable();\n\n const key = Deno.env.get(\"AIRTABLE_API_KEY\");\n if (!key) {\n return error(\n \"Missing AIRTABLE_API_KEY env var. Add it in the val's env vars.\",\n );\n }\n\n const url = new URL(req.url);\n const path = url.pathname;\n\n // OAuth plumbing\n if (path === \"/auth/login\") return req.method === \"GET\" ? handleLogin(req) : methodNotAllowed();\n if (path === \"/auth/callback\") return req.method === \"GET\" ? handleCallback(req) : methodNotAllowed();\n if (path === \"/auth/logout\") return req.method === \"POST\" ? handleLogout(req) : methodNotAllowed();\n\n // Everything else requires Airtable sign-in.\n const session = await resolveSession(parseCookies(req)[SESSION_COOKIE]);\n if (!session) {\n return redirect(`/auth/login?redirect=${encodeURIComponent(url.pathname + url.search)}`);\n }\n const signedInAs = session.email || \"an Airtable user\";\n\n const recordId = url.searchParams.get(\"record\");\n if (!recordId) {\n return error(\"Missing ?record= in the URL.\", 400);\n }\n\n const { baseId, table } = config;\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const decision = form.get(\"decision\")?.toString() || \"\";\n const approver = form.get(\"approver\")?.toString() || \"\";\n const note = form.get(\"note\")?.toString() || \"\";\n\n const status = decision === \"approve\" ? \"Approved\" : \"Declined\";\n\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n method: \"PATCH\",\n headers: {\n Authorization: `Bearer ${key}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n typecast: true,\n fields: { [config.statusField]: status },\n }),\n }).catch((e) => null);\n\n if (!res || !res.ok) {\n const body = res ? await res.text() : \"network error\";\n console.error(\"Airtable PATCH failed:\", res?.status, body);\n return error(`Could not update the record. ${body}`, 502);\n }\n\n // Record who approved (verified sign-in email) alongside the note.\n await writeMeta(recordId, approver || signedInAs, note, status).catch(() => {});\n\n return new Response(\n `\n

✅ ${escapeHtml(decision === \"approve\" ? \"Approved\" : \"Declined\")}

Thanks, your decision for this record has been saved to Airtable.

Signed in as ${escapeHtml(signedInAs)}

\n Back\n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n if (req.method !== \"GET\") {\n return methodNotAllowed();\n }\n\n // GET — fetch record and render form\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n headers: { Authorization: `Bearer ${key}` },\n }).catch(() => null);\n\n if (!res || !res.ok) {\n return error(`Could not fetch record ${recordId}. Is the id valid?`, 404);\n }\n const data = await res.json();\n const recordFields = data.fields || {};\n const title = recordFields[config.titleField] ?? \"Approval request\";\n const description = recordFields[config.descriptionField];\n // Collaborator fields come back as an array of { name } objects.\n const rawRequester = recordFields[config.requestedByField];\n const requestedBy = Array.isArray(rawRequester) && rawRequester.length > 0\n ? rawRequester.map((c: { name?: string }) => c.name).filter(Boolean).join(\", \")\n : \"\";\n\n const nameDefault = displayName(signedInAs);\n\n return new Response(\n `\n

\n Signed in as ${escapeHtml(signedInAs)}\n

${escapeHtml(String(title))}

\n ${requestedBy ? `

Requested by: ${escapeHtml(requestedBy)}

` : \"\"}\n ${\n description\n ? `

${\n escapeHtml(String(description))\n }

`\n : \"\"\n }\n

Review this request and submit your decision.

\n \n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n","airtable-approval",[],[194],"bca51ec0-87ce-44eb-a7af-23424e3cb0e4","AGENTS.md","66a06bdc-9bc2-11f1-ba34-1607ee4eb77e",["D",1787237214804],3,"# Airtable Approval Form\n\nAirtable-backed approval form gated behind **Airtable OAuth sign-in**.\n\n## How auth works (important)\n- Users must sign in with Airtable before the app is usable. Visiting any page\n while logged out redirects to `/auth/login`, which first shows an interstitial\n \"Login with Airtable\" page; clicking the button (`?proceed=1`) then redirects to\n `https://airtable.com/oauth2/v1/authorize`.\n- The OAuth token is **identity-only** (scope `user.email:read`). It is used\n only to verify who signed in and to resolve their email via `/v0/meta/whoami`.\n- All base reads/writes use the **`AIRTABLE_API_KEY`** env var (a personal access\n token), NOT the user's OAuth token. This is intentional — sign-in is a gate,\n and doesn't require approvers to be base collaborators. Don't \"fix\" this by\n switching base calls to the OAuth token.\n- Sessions live in the SQLite `oauth_sessions` table; the session id is an\n httpOnly `airtable_session` cookie. Access tokens are refreshed on demand\n (`refresh_token` grant) so sessions last up to ~30 days.\n\n## Routes\n- `GET /auth/login` — starts OAuth, sets CSRF `oauth_state` cookie\n- `GET /auth/callback` — exchanges code, verifies state + whoami, creates session\n- `POST /auth/logout` — deletes session, clears cookie\n- everything else — gated behind a valid session; reads/writes the record\n\n## Env vars\n- `AIRTABLE_CLIENT_ID` — required; from the Airtable OAuth integration\n- `AIRTABLE_CLIENT_SECRET` — optional; only if one was generated\n- `AIRTABLE_API_KEY` — required; personal access token for the base\n\n## One-time Airtable setup\nRegister the OAuth callback URL in the integration (in Airtable → Builder Hub →\nOAuth integrations):\n`https://airtable-approval.val.run/auth/callback`\n\nA full sign-in round trip (Airtable login → callback → session redirect) must be\ntested in a real browser; `fetch_val_endpoint` cannot complete it.\n",[],[204],["D",1787139453377],["D",1789476648181],{"_11":12,"_144":-5},{"_11":12,"_139":140,"_71":-5,"_30":-5,"_141":142,"_143":24},{"_40":130,"_13":16,"_34":37,"_131":90,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":14,"_138":12},"ctx",{"_54":-5,"_163":249,"_250":251,"_252":253,"_254":24,"_255":24,"_256":24,"_257":103,"_258":-5,"_259":-7,"_260":-7,"_261":26,"_262":24,"_263":24,"_264":-5,"_265":24,"_266":24,"_267":24,"_268":-5},"ENV",{"_220":221,"_222":223,"_224":16,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · oauth.ts