[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_191":192,"_193":194},"routes/_app.x.$handle.$name",{"_106":105,"_38":51,"_114":96,"_33":115,"_13":14,"_116":-5,"_11":117,"_118":119,"_120":121,"_122":123,"_124":125,"_26":-5,"_126":-5,"_127":-5,"_128":31,"_129":130,"_131":65,"_132":-5,"_133":-5,"_134":135},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_49":50,"_38":51,"_44":52,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":89,"_90":91,"_92":93,"_94":31},"version",17,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","208603ad-f50d-4e7d-a8df-88a30c5db594","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",false,"deletedHere","path","oauth.ts","latestPath","fileId","dfea9bac-9c71-11f1-bb45-1607ee4eb77e","name","fileType","script","content","// Airtable OAuth helpers (verified sign-in; no data access).\n//\n// We only request `user.email:read` so the user's token is purely an identity\n// guard. All base reads/writes continue to use the AIRTABLE_API_KEY env var.\n//\n// Env vars:\n// AIRTABLE_CLIENT_ID (required) from your Airtable OAuth integration\n// AIRTABLE_CLIENT_SECRET (optional) only if you generate one in Airtable\n\nexport const AUTHORIZE_URL = \"https://airtable.com/oauth2/v1/authorize\";\nexport const TOKEN_URL = \"https://airtable.com/oauth2/v1/token\";\nexport const WHOAMI_URL = \"https://api.airtable.com/v0/meta/whoami\";\nexport const SCOPE = \"user.email:read\";\n\nexport interface Tokens {\n access_token: string;\n refresh_token?: string;\n expires_in?: number;\n token_type?: string;\n}\n\nexport interface WhoAmI {\n id: string;\n email?: string;\n scopes: string[];\n}\n\nconst requiredClientId = () => {\n const clientId = Deno.env.get(\"AIRTABLE_CLIENT_ID\");\n if (!clientId) {\n throw new Error(\n \"Missing AIRTABLE_CLIENT_ID env var. Add it in the val's env vars.\",\n );\n }\n return clientId;\n};\n\n/** URL to send the user to Airtable to authorize. */\nexport function buildAuthorizeUrl(redirectUri: string, state: string): string {\n const params = new URLSearchParams({\n client_id: requiredClientId(),\n redirect_uri: redirectUri,\n response_type: \"code\",\n scope: SCOPE,\n state,\n });\n return `${AUTHORIZE_URL}?${params.toString()}`;\n}\n\nasync function tokenRequest(body: URLSearchParams): Promise {\n const clientSecret = Deno.env.get(\"AIRTABLE_CLIENT_SECRET\");\n body.set(\"client_id\", requiredClientId());\n if (clientSecret) body.set(\"client_secret\", clientSecret);\n\n const res = await fetch(TOKEN_URL, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: body.toString(),\n }).catch((e) => {\n throw new Error(`Airtable token endpoint error: ${(e as Error).message}`);\n });\n if (!res.ok) {\n throw new Error(`Airtable token endpoint HTTP ${res.status}: ${await res.text()}`);\n }\n return res.json() as Promise;\n}\n\n/** Exchange the authorization `code` for tokens. */\nexport async function exchangeCode(code: string, redirectUri: string): Promise {\n return tokenRequest(\n new URLSearchParams({ grant_type: \"authorization_code\", code, redirect_uri: redirectUri }),\n );\n}\n\n/** Refresh an expired access token (keeps the session alive up to ~30 days). */\nexport async function refreshAccessToken(refreshToken: string): Promise {\n return tokenRequest(\n new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n );\n}\n\n/** Get the authenticated Airtable user's id + email (needs user.email:read). */\nexport async function whoami(accessToken: string): Promise {\n const res = await fetch(WHOAMI_URL, {\n headers: { Authorization: `Bearer ${accessToken}` },\n }).catch((e) => {\n throw new Error(`Airtable whoami error: ${(e as Error).message}`);\n });\n if (!res.ok) {\n throw new Error(`Airtable whoami HTTP ${res.status}: ${await res.text()}`);\n }\n return res.json() as Promise;\n}\n","// Airtable OAuth helpers (verified sign-in; no data access).\n//\n// We only request `user.email:read` so the user's token is purely an identity\n// guard. All base reads/writes continue to use the AIRTABLE_API_KEY env var.\n//\n// Env vars:\n// AIRTABLE_CLIENT_ID (required) from your Airtable OAuth integration\n// AIRTABLE_CLIENT_SECRET (optional) only if you generate one in Airtable\n\nexport const AUTHORIZE_URL = \"https://airtable.com/oauth2/v1/authorize\";\nexport const TOKEN_URL = \"https://airtable.com/oauth2/v1/token\";\nexport const WHOAMI_URL = \"https://api.airtable.com/v0/meta/whoami\";\nexport const SCOPE = \"user.email:read\";\n\nexport interface Tokens {\n access_token: string;\n refresh_token?: string;\n expires_in?: number;\n token_type?: string;\n}\n\nexport interface WhoAmI {\n id: string;\n email?: string;\n scopes: string[];\n}\n\nconst requiredClientId = () => {\n const clientId = Deno.env.get(\"AIRTABLE_CLIENT_ID\");\n if (!clientId) {\n throw new Error(\n \"Missing AIRTABLE_CLIENT_ID env var. Add it in the val's env vars.\",\n );\n }\n return clientId;\n};\n\n// ---------- PKCE helpers ----------\n// Airtable requires PKCE when the integration has no client secret (public\n// client). We generate a per-request verifier, send its S256 challenge in the\n// authorize request, then present the verifier when exchanging the code.\n\nconst base64Url = (bytes: Uint8Array): string => {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n};\n\n/** High-entropy random verifier (43 chars, URL-safe). */\nexport function generateCodeVerifier(): string {\n const bytes = crypto.getRandomValues(new Uint8Array(32));\n return base64Url(bytes);\n}\n\n/** S256 code_challenge derived from a verifier. */\nexport async function generateCodeChallenge(verifier: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(verifier),\n );\n return base64Url(new Uint8Array(digest));\n}\n\n/** URL to send the user to Airtable to authorize. */\nexport function buildAuthorizeUrl(\n redirectUri: string,\n state: string,\n codeChallenge: string,\n): string {\n const params = new URLSearchParams({\n client_id: requiredClientId(),\n redirect_uri: redirectUri,\n response_type: \"code\",\n scope: SCOPE,\n state,\n code_challenge: codeChallenge,\n code_challenge_method: \"S256\",\n });\n return `${AUTHORIZE_URL}?${params.toString()}`;\n}\n\nasync function tokenRequest(body: URLSearchParams): Promise {\n const clientSecret = Deno.env.get(\"AIRTABLE_CLIENT_SECRET\");\n body.set(\"client_id\", requiredClientId());\n if (clientSecret) body.set(\"client_secret\", clientSecret);\n\n const res = await fetch(TOKEN_URL, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: body.toString(),\n }).catch((e) => {\n throw new Error(`Airtable token endpoint error: ${(e as Error).message}`);\n });\n if (!res.ok) {\n throw new Error(`Airtable token endpoint HTTP ${res.status}: ${await res.text()}`);\n }\n return res.json() as Promise;\n}\n\n/** Exchange the authorization `code` for tokens. */\nexport async function exchangeCode(code: string, redirectUri: string): Promise {\n return tokenRequest(\n new URLSearchParams({ grant_type: \"authorization_code\", code, redirect_uri: redirectUri }),\n );\n}\n\n/** Refresh an expired access token (keeps the session alive up to ~30 days). */\nexport async function refreshAccessToken(refreshToken: string): Promise {\n return tokenRequest(\n new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n );\n}\n\n/** Get the authenticated Airtable user's id + email (needs user.email:read). */\nexport async function whoami(accessToken: string): Promise {\n const res = await fetch(WHOAMI_URL, {\n headers: { Authorization: `Bearer ${accessToken}` },\n }).catch((e) => {\n throw new Error(`Airtable whoami error: ${(e as Error).message}`);\n });\n if (!res.ok) {\n throw new Error(`Airtable whoami HTTP ${res.status}: ${await res.text()}`);\n }\n return res.json() as Promise;\n}\n","createdAt",["D",1787232419423],"branchVersion","branchId","9b9abaa1-d920-4c6c-9e30-bb9fac0049e3","id","4d61816f-152b-42a1-8139-861fa01332f5","airtable-approval-form",["D",1787139453377],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Airtable-backed approval form (approve/decline)","imageUrl","45088755-762b-4822-a602-c6427fb13a1a","pinnedFileId","65372a4c-9bc2-11f1-8237-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a019cc-24df-7478-82d7-5b520124f432","tursoName","4d61816f152b42a18139861fa01332f5","tursoHostname","4d61816f152b42a18139861fa01332f5-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789476648181],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_106":105,"_113":-5},"org",{"_106":105,"_107":108,"_109":-5,"_19":-5,"_110":111,"_112":31},"branch",{"_13":95,"_38":96,"_49":48,"_97":50,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":51,"_104":105},"isOwned",23,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","orbem","handle","displayName","Orbem","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_49":50,"_38":51,"_44":186,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":187,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":188,"_90":189,"_92":190,"_94":31},"tree",[173,174,175],"files",[173,174,175],"counts",{"_163":69,"_164":143,"_165":69,"_166":167,"_168":169},"contents",[136,137,138],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_49":155,"_38":156,"_36":157,"_140":-5,"_47":48,"_46":158,"_141":31,"_44":159,"_13":160,"_39":26,"_41":161,"_30":31,"_144":-5,"_33":162},{"_49":146,"_38":147,"_36":63,"_140":-5,"_47":48,"_46":148,"_141":31,"_44":149,"_13":150,"_39":151,"_41":152,"_30":31,"_144":153,"_33":154},{"_49":139,"_38":34,"_36":37,"_140":-5,"_47":48,"_46":14,"_141":31,"_44":142,"_13":143,"_39":40,"_41":43,"_30":31,"_144":-5,"_33":145},"c9079692-614b-494e-ae85-d8450d25225a","parentId","latest",["D",1787232419423],1,"label",[34],"d1857fda-126e-4c86-b13a-5447a952f8b9","index.ts",15,["D",1787214888497],11,"http","// Airtable-backed approval form, gated behind Airtable OAuth sign-in.\n//\n// URL: /?record=recXXXX (the Airtable record id)\n//\n// Flow:\n// - Anyone not signed in is redirected to /auth/login → Airtable's OAuth.\n// - On return, /auth/callback exchanges the code, verifies via whoami and\n// creates a session (stored in SQLite; id in an httpOnly cookie).\n// - The record is read/written using the AIRTABLE_API_KEY env var (Option B:\n// the user's OAuth token is only used as an identity gate, so sign-in works\n// even if the approver isn't a base collaborator).\n//\n// Env vars required:\n// AIRTABLE_CLIENT_ID Airtable OAuth integration client id (set)\n// AIRTABLE_CLIENT_SECRET optional; omit unless you generate one in Airtable\n// AIRTABLE_API_KEY personal access token (data.records:read + write)\n//\n// OAuth callback URL (register this in the Airtable integration):\n// https://airtable-approval.val.run/auth/callback\n\nimport {\n buildAuthorizeUrl,\n exchangeCode,\n refreshAccessToken,\n whoami,\n} from \"./oauth.ts\";\nimport type { Tokens, WhoAmI } from \"./oauth.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ---------- helpers ----------\n\nconst error = (msg: string, status = 500) =>\n new Response(`

Error

${escapeHtml(msg)}

`, {\n status,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n\nconst escapeHtml = (s: string) =>\n s.replace(\n /[&<>\"']/g,\n (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" })[\n c\n ]!,\n );\n\nconst methodNotAllowed = () =>\n new Response(\"Method Not Allowed\", { status: 405 });\n\n// Val Town's Response.redirect is unreliable; use a raw 302.\nconst redirect = (location: string) =>\n new Response(null, { status: 302, headers: { Location: location } });\n\nconst base = \"https://api.airtable.com/v0\";\n\n// All non-secret configuration lives here.\nconst config = {\n baseId: \"appmol7FrK9ONzsv6\", // the Airtable base id\n table: \"tblNwX4Wmd257B9yY\", // the table name or id\n // Field names in the table for the approval workflow:\n approverField: \"Approver\",\n noteField: \"Approver note\",\n statusField: \"Status\",\n // Fields describing what the approval is for (fetched & rendered):\n titleField: \"Title\",\n descriptionField: \"Description\",\n requestedByField: \"Requested by\",\n};\n\n// ---------- cookies ----------\n\nconst SESSION_COOKIE = \"airtable_session\";\nconst STATE_COOKIE = \"oauth_state\";\n\nfunction parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") ?? \"\";\n const out: Record = {};\n for (const part of header.split(\";\")) {\n const i = part.indexOf(\"=\");\n if (i === -1) continue;\n out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());\n }\n return out;\n}\n\nfunction cookieHeader(name: string, value: string, maxAge: number): string {\n return [\n `${name}=${encodeURIComponent(value)}`,\n \"Path=/\",\n \"HttpOnly\",\n \"SameSite=Lax\",\n \"Secure\",\n `Max-Age=${maxAge}`,\n ].join(\"; \");\n}\n\nconst randomId = () => crypto.randomUUID();\n\n// ---------- sessions (SQLite) ----------\n\ntype SessionRow = {\n id: string;\n airtable_id: string;\n email: string;\n access_token: string;\n refresh_token: string;\n expires_at: number;\n};\n\nasync function ensureSessionsTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS oauth_sessions (\n id TEXT PRIMARY KEY,\n airtable_id TEXT,\n email TEXT,\n access_token TEXT NOT NULL,\n refresh_token TEXT NOT NULL,\n expires_at INTEGER NOT NULL,\n created_at TEXT DEFAULT CURRENT_TIMESTAMP,\n updated_at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n}\n\nasync function getSession(id: string): Promise {\n const r = await sqlite.execute(\"SELECT * FROM oauth_sessions WHERE id = ?\", [id]);\n return (r.rows[0] as SessionRow | undefined) ?? null;\n}\n\n/** Load a session, refreshing the Airtable access token when it's expired. */\nasync function resolveSession(id: string | undefined): Promise {\n if (!id) return null;\n let row = await getSession(id);\n if (!row) return null;\n\n if (Date.now() >= row.expires_at - 30_000) {\n try {\n const tok = await refreshAccessToken(row.refresh_token);\n const info = await whoami(tok.access_token).catch(() => null);\n const newExp = Date.now() + (tok.expires_in ?? 3600) * 1000;\n const refreshedToken = tok.refresh_token ?? row.refresh_token;\n await sqlite.execute(\n `UPDATE oauth_sessions\n SET access_token = ?, refresh_token = ?, expires_at = ?, email = ?\n WHERE id = ?`,\n [tok.access_token, refreshedToken, newExp, info?.email ?? row.email, id],\n );\n row = {\n ...row,\n access_token: tok.access_token,\n refresh_token: refreshedToken,\n expires_at: newExp,\n email: info?.email ?? row.email,\n };\n } catch (e) {\n console.error(\"Session refresh failed, dropping session:\", (e as Error).message);\n await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [id]);\n return null;\n }\n }\n return row;\n}\n\nasync function createSession(info: WhoAmI, tok: Tokens): Promise {\n await ensureSessionsTable();\n const id = randomId();\n const expiresAt = Date.now() + (tok.expires_in ?? 3600) * 1000;\n await sqlite.execute(\n `INSERT INTO oauth_sessions (id, airtable_id, email, access_token, refresh_token, expires_at)\n VALUES (?, ?, ?, ?, ?, ?)`,\n [id, info.id, info.email ?? \"\", tok.access_token, tok.refresh_token ?? \"\", expiresAt],\n );\n return id;\n}\n\n// ---------- OAuth flow ----------\n\n// Only ever redirect back to a same-origin relative path (no open redirect).\nfunction normalizeRedirect(p: string | null): string {\n return p && p.startsWith(\"/\") && !p.startsWith(\"//\") ? p : \"/\";\n}\n\nfunction decodeRedirect(encoded: string | undefined): string {\n if (!encoded) return \"/\";\n try {\n return normalizeRedirect(atob(encoded));\n } catch {\n return \"/\";\n }\n}\n\nasync function handleLogin(req: Request): Promise {\n const url = new URL(req.url);\n const redirectTo = normalizeRedirect(url.searchParams.get(\"redirect\"));\n const state = randomId();\n // Pack the return path into the state cookie so we know it after authorize.\n const stateValue = `${state}.${btoa(redirectTo)}`;\n const authorizeUrl = buildAuthorizeUrl(`${url.origin}/auth/callback`, state);\n const h = new Headers({ Location: authorizeUrl });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, stateValue, 600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleCallback(req: Request): Promise {\n const url = new URL(req.url);\n const cookies = parseCookies(req);\n const code = url.searchParams.get(\"code\");\n const returnedState = url.searchParams.get(\"state\");\n\n if (!code) {\n return error(\n `Airtable sign-in was cancelled or failed (${escapeHtml(\n url.searchParams.get(\"error_description\") ?? url.searchParams.get(\"error\") ?? \"no code\",\n )}).`,\n 400,\n );\n }\n\n // Verify the CSRF state matches what we set before the authorize redirect.\n const stateValue = cookies[STATE_COOKIE];\n const expectedState = stateValue?.split(\".\")[0];\n if (!expectedState || returnedState !== expectedState) {\n return error(\"Sign-in did not validate (state mismatch). Please try again.\", 400);\n }\n const redirectTo = decodeRedirect(stateValue.split(\".\")[1]);\n\n let tokens: Tokens;\n try {\n tokens = await exchangeCode(code, `${url.origin}/auth/callback`);\n } catch (e) {\n return error(`Could not complete Airtable sign-in: ${escapeHtml((e as Error).message)}`, 502);\n }\n let info: WhoAmI;\n try {\n info = await whoami(tokens.access_token);\n } catch (e) {\n return error(`Could not verify your Airtable account: ${escapeHtml((e as Error).message)}`, 502);\n }\n\n const sessionId = await createSession(info, tokens);\n const h = new Headers({ Location: redirectTo });\n h.append(\"Set-Cookie\", cookieHeader(STATE_COOKIE, \"\", 0)); // clear state\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, sessionId, 30 * 24 * 3600));\n return new Response(null, { status: 302, headers: h });\n}\n\nasync function handleLogout(req: Request): Promise {\n const url = new URL(req.url);\n const sid = parseCookies(req)[SESSION_COOKIE];\n if (sid) await sqlite.execute(`DELETE FROM oauth_sessions WHERE id = ?`, [sid]);\n const h = new Headers({ Location: normalizeRedirect(url.searchParams.get(\"redirect\")) });\n h.append(\"Set-Cookie\", cookieHeader(SESSION_COOKIE, \"\", 0));\n return new Response(null, { status: 302, headers: h });\n}\n\n// \"first.last@x.com\" → \"First Last\"\nfunction displayName(email: string): string {\n const local = (email.split(\"@\")[0] ?? \"\").trim();\n if (!local) return \"\";\n return local.replace(/[._-]+/g, \" \").replace(/\\b\\w/g, (c) => c.toUpperCase());\n}\n\n// Minimal kv store for approvals so they're visible in Val Town too.\nasync function writeMeta(\n recordId: string,\n approver: string,\n note: string,\n status: string,\n) {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS approvals (\n record_id TEXT PRIMARY KEY, approver TEXT, note TEXT, status TEXT, at TEXT DEFAULT CURRENT_TIMESTAMP\n )`,\n );\n await sqlite.execute(\n `INSERT OR REPLACE INTO approvals (record_id, approver, note, status) VALUES (?, ?, ?, ?)`,\n [recordId, approver, note, status],\n );\n}\n\n// ---------- handler ----------\n\nexport default async function handler(req: Request): Promise {\n await ensureSessionsTable();\n\n const key = Deno.env.get(\"AIRTABLE_API_KEY\");\n if (!key) {\n return error(\n \"Missing AIRTABLE_API_KEY env var. Add it in the val's env vars.\",\n );\n }\n\n const url = new URL(req.url);\n const path = url.pathname;\n\n // OAuth plumbing\n if (path === \"/auth/login\") return req.method === \"GET\" ? handleLogin(req) : methodNotAllowed();\n if (path === \"/auth/callback\") return req.method === \"GET\" ? handleCallback(req) : methodNotAllowed();\n if (path === \"/auth/logout\") return req.method === \"POST\" ? handleLogout(req) : methodNotAllowed();\n\n // Everything else requires Airtable sign-in.\n const session = await resolveSession(parseCookies(req)[SESSION_COOKIE]);\n if (!session) {\n return redirect(`/auth/login?redirect=${encodeURIComponent(url.pathname + url.search)}`);\n }\n const signedInAs = session.email || \"an Airtable user\";\n\n const recordId = url.searchParams.get(\"record\");\n if (!recordId) {\n return error(\"Missing ?record= in the URL.\", 400);\n }\n\n const { baseId, table } = config;\n\n if (req.method === \"POST\") {\n const form = await req.formData();\n const decision = form.get(\"decision\")?.toString() || \"\";\n const approver = form.get(\"approver\")?.toString() || \"\";\n const note = form.get(\"note\")?.toString() || \"\";\n\n const status = decision === \"approve\" ? \"Approved\" : \"Declined\";\n\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n method: \"PATCH\",\n headers: {\n Authorization: `Bearer ${key}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n typecast: true,\n fields: { [config.statusField]: status },\n }),\n }).catch((e) => null);\n\n if (!res || !res.ok) {\n const body = res ? await res.text() : \"network error\";\n console.error(\"Airtable PATCH failed:\", res?.status, body);\n return error(`Could not update the record. ${body}`, 502);\n }\n\n // Record who approved (verified sign-in email) alongside the note.\n await writeMeta(recordId, approver || signedInAs, note, status).catch(() => {});\n\n return new Response(\n `\n

✅ ${escapeHtml(decision === \"approve\" ? \"Approved\" : \"Declined\")}

Thanks, your decision for this record has been saved to Airtable.

Signed in as ${escapeHtml(signedInAs)}

\n Back\n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n }\n\n if (req.method !== \"GET\") {\n return methodNotAllowed();\n }\n\n // GET — fetch record and render form\n const res = await fetch(`${base}/${baseId}/${table}/${recordId}`, {\n headers: { Authorization: `Bearer ${key}` },\n }).catch(() => null);\n\n if (!res || !res.ok) {\n return error(`Could not fetch record ${recordId}. Is the id valid?`, 404);\n }\n const data = await res.json();\n const recordFields = data.fields || {};\n const title = recordFields[config.titleField] ?? \"Approval request\";\n const description = recordFields[config.descriptionField];\n // Collaborator fields come back as an array of { name } objects.\n const rawRequester = recordFields[config.requestedByField];\n const requestedBy = Array.isArray(rawRequester) && rawRequester.length > 0\n ? rawRequester.map((c: { name?: string }) => c.name).filter(Boolean).join(\", \")\n : \"\";\n\n const nameDefault = displayName(signedInAs);\n\n return new Response(\n `\n

\n Signed in as ${escapeHtml(signedInAs)}\n

${escapeHtml(String(title))}

\n ${requestedBy ? `

Requested by: ${escapeHtml(requestedBy)}

` : \"\"}\n ${\n description\n ? `

${\n escapeHtml(String(description))\n }

`\n : \"\"\n }\n

Review this request and submit your decision.

\n \n `,\n { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n","airtable-approval",[147],"45e20fc9-8b74-478e-800d-e0cad935e236","AGENTS.md","66a06bdc-9bc2-11f1-ba34-1607ee4eb77e",16,["D",1787214914594],2,"# Airtable Approval Form\n\nAirtable-backed approval form gated behind **Airtable OAuth sign-in**.\n\n## How auth works (important)\n- Users must sign in with Airtable before the app is usable. Visiting any page\n while logged out redirects to `/auth/login` → `https://airtable.com/oauth2/v1/authorize`.\n- The OAuth token is **identity-only** (scope `user.email:read`). It is used\n only to verify who signed in and to resolve their email via `/v0/meta/whoami`.\n- All base reads/writes use the **`AIRTABLE_API_KEY`** env var (a personal access\n token), NOT the user's OAuth token. This is intentional — sign-in is a gate,\n and doesn't require approvers to be base collaborators. Don't \"fix\" this by\n switching base calls to the OAuth token.\n- Sessions live in the SQLite `oauth_sessions` table; the session id is an\n httpOnly `airtable_session` cookie. Access tokens are refreshed on demand\n (`refresh_token` grant) so sessions last up to ~30 days.\n\n## Routes\n- `GET /auth/login` — starts OAuth, sets CSRF `oauth_state` cookie\n- `GET /auth/callback` — exchanges code, verifies state + whoami, creates session\n- `POST /auth/logout` — deletes session, clears cookie\n- everything else — gated behind a valid session; reads/writes the record\n\n## Env vars\n- `AIRTABLE_CLIENT_ID` — required; from the Airtable OAuth integration\n- `AIRTABLE_CLIENT_SECRET` — optional; only if one was generated\n- `AIRTABLE_API_KEY` — required; personal access token for the base\n\n## One-time Airtable setup\nRegister the OAuth callback URL in the integration (in Airtable → Builder Hub →\nOAuth integrations):\n`https://airtable-approval.val.run/auth/callback`\n\nA full sign-in round trip (Airtable login → callback → session redirect) must be\ntested in a real browser; `fetch_val_endpoint` cannot complete it.\n",[156],"pulls","branches","forks","envVars",{"_170":160,"_172":69},"connections",{"_170":69,"_171":69},"count","unfilledCount","emptyCount",{"_49":155,"_38":156,"_36":157,"_140":-5,"_47":48,"_46":158,"_141":31,"_44":183,"_13":160,"_39":26,"_41":161,"_30":31,"_144":-5,"_177":184,"_33":185},{"_49":146,"_38":147,"_36":63,"_140":-5,"_47":48,"_46":148,"_141":31,"_44":180,"_13":150,"_39":151,"_41":152,"_30":31,"_144":153,"_177":181,"_33":182},{"_49":139,"_38":34,"_36":37,"_140":-5,"_47":48,"_46":14,"_141":31,"_44":176,"_13":143,"_39":40,"_41":43,"_30":31,"_144":-5,"_177":178,"_33":179},["D",1787232419423],"children",[],[34],["D",1787214888497],[],[147],["D",1787214914594],[],[156],["D",1787139453377],["D",1789476648181],{"_106":105,"_113":-5},{"_106":105,"_107":108,"_109":-5,"_19":-5,"_110":111,"_112":31},{"_13":95,"_38":96,"_49":48,"_97":50,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":51,"_104":105},"ctx",{"_88":-5,"_133":224,"_225":226,"_227":228,"_229":31,"_230":31,"_231":31,"_232":65,"_233":-5,"_234":-7,"_235":-7,"_236":69,"_237":31,"_238":31,"_239":-5,"_240":31,"_241":31,"_242":31,"_243":-5},"ENV",{"_195":196,"_197":198,"_199":96,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v17