${_title}

\n ${content}\n `;\n },\n }).toString(),\n {\n ...init,\n headers: {\n ...init?.headers,\n \"Content-Type\": \"text/html\",\n },\n },\n );\n },\n ...options,\n };\n const HANDLER_NAME = `@${handle}/${name}`;\n const ENDPOINT = getValEndpointFromName(HANDLER_NAME);\n\n const rootPath = (_rootPath.startsWith(\"/\")\n ? _rootPath\n : `/${_rootPath}`).replace(/\\/+$/, \"\");\n\n const templates = {\n ...defaultTemplates,\n ...options.templates,\n };\n\n function verifyAuthToken(token: string, req: Request) {\n return verifyThirdParty(token, {\n issuer: `@${handle}/authId`,\n audience: HANDLER_NAME,\n async custom(payload) {\n const author = payload.iss.split(\"/\")[0];\n return {\n scope: [`${author}/authId/id`],\n };\n },\n ...verify,\n });\n }\n\n return async (context: Context, next: () => void) => {\n const req = getRequestContextRequest(context);\n let { pathname, searchParams: qs } = new URL(req.url);\n pathname = pathname.replace(/\\/+$/, \"\").slice(rootPath.length);\n\n const cookie = getAuthCookie(req);\n\n let payload;\n try {\n payload = cookie && await verifyAuthToken(cookie, req);\n } catch (e) {\n console.log(\"cookie token validation failed\", e);\n }\n\n if (payload && pathname === \"/login\") {\n return Response.redirect(ENDPOINT + rootPath);\n }\n\n if (pathname === \"/login\" || (pathname === \"/logout\" && req.method === \"POST\")) {\n if (req.method === \"GET\") {\n const token = qs.get(\"token\");\n const clientToken = qs.get(\"clientToken\");\n qs.delete(\"token\");\n qs.delete(\"clientToken\");\n\n let failReason: RawHTML | undefined;\n\n const tokenDecoded = token && await decode(token);\n\n const [tokenPayload, clientTokenPayload] = await Promise.all([\n token && verifyAuthToken(token, req).catch((e) => {\n console.log(\"error while parsing token qs\", e);\n failReason = html`token validation failed: ${e.message}`;\n }),\n tokenDecoded && clientToken && verifyThirdParty(clientToken, {\n audience: [HANDLER_NAME, tokenDecoded.iss],\n issuer: HANDLER_NAME,\n custom: {\n scope: `${HANDLER_NAME}/requestAuth`,\n maxUses: 1,\n },\n }).catch((e) => {\n console.log(\"error validating clientToken\", e, clientToken);\n failReason = html`clientToken validation failed: ${e.message}`;\n }),\n ]);\n\n if (tokenPayload && clientTokenPayload) {\n if (tokenPayload.clientTokenId === clientTokenPayload.jti) {\n const { searchParams } = new URL(ENDPOINT + clientTokenPayload.returnTo.slice(HANDLER_NAME.length));\n const res = new Response(undefined, {\n status: 302,\n headers: {\n Location: ENDPOINT + (searchParams.get(\"returnTo\") || rootPath),\n },\n });\n setAuthCookie(res, token);\n return res;\n }\n failReason = html`clientToken validation failed: client token id mismatch`;\n }\n\n if (token || clientToken) {\n return createResponse(context, templates.failedLogin(failReason), {\n status: 403,\n });\n }\n return createResponse(context, templates.signInForm);\n } else if (req.method === \"POST\") {\n const formData = await req.formData();\n\n const username = formData.get(\"username\")?.trim().replace(/^\\@/, \"\").match(/^\\w+$/)?.[0];\n const val = \"authId\"; // formData.get(\"val\")?.trim().match(/^\\w+$/)?.[0];\n\n if (!(username && val)) {\n return createResponse(context, templates.signInForm, {\n status: 400,\n });\n }\n\n const name = `@${username}/${val}`;\n const authEndpoint = getValEndpointFromName(name);\n const returnToPath = (qs.get(\"returnTo\") || \"\").replace(/\\/*(login|logout)\\/*$/, \"\");\n const returnQS = new URLSearchParams();\n\n if (returnToPath.slice(1)) {\n returnQS.set(\"returnTo\", rootPath + returnToPath);\n }\n\n const newPayload = {\n iss: HANDLER_NAME,\n scope: `${HANDLER_NAME}/requestAuth`,\n aud: [name, HANDLER_NAME],\n returnTo: HANDLER_NAME + rootPath + \"/login\" + (returnQS.size ? `?${returnQS}` : \"\"),\n };\n\n newPayload.requestScope = requestScope instanceof Function\n ? await requestScope(req, name)\n : requestScope;\n\n const token = await generate(newPayload, \"15m\");\n\n const authQS = new URLSearchParams();\n authQS.set(\"clientToken\", token);\n\n return Response.redirect(`${authEndpoint}?${authQS}`);\n }\n } else if (pathname === \"/logout\" && req.method !== \"POST\") {\n const res = await createResponse(context, templates.loggedOut);\n setAuthCookie(res, undefined);\n return res;\n }\n\n if (!payload && !optional) {\n const qs = new URLSearchParams();\n pathname && qs.set(\"returnTo\", pathname);\n return Response.redirect(`${ENDPOINT}${rootPath}/login${qs.size ? `?${qs}` : \"\"}`);\n }\n\n context.set(\"token\", cookie);\n context.set(\"auth\", payload);\n\n return next();\n };\n}\n\nexport const signInFormBase = html`\n \n`;\n\nexport const signInForm = html`\n ${signInFormBase}\n \n

\n If you haven't set up the required Vals jwks and authId yet, there is a guide at\n \n @postpostscript/authIdUserGuide\n \n

\n`;\n\nexport const defaultTemplates = {\n signInForm,\n\n loggedOut: html`\n

\n You are now logged out! You can close this tab.\n

\n\n ${signInForm}\n `,\n\n failedLogin: (reason: unknown) =>\n html`\n \n\n ${signInForm}\n `,\n};\n\nexport function userDisplay(payload: JWTPayload) {\n return payload.sub.replace(/\\/.*/, \"\");\n}\n\nexport function userActionsDisplay(\n payload: JWTPayload,\n {\n order = [\"language\", \"profile\", \"username\", \"logout\"],\n parts = {} as Record,\n } = {},\n) {\n const username = userDisplay(payload);\n\n const _parts: Record = {\n language: html`\n \n Signed in as\n \n `,\n profile: html`\n \n \n ${Profile(username)}\n \n \n `,\n username: html`\n \n \n ${username}\n \n \n `,\n logout: html`\n \n \n Log Out\n \n \n `,\n ...parts,\n };\n\n return html`\n \n ${order.map(key => _parts[key])}\n \n `;\n}\n\nexport type AuthContextVariables = {\n token: string;\n auth: JWTPayload;\n};\nexport type HonoEnv = {\n Variables: AuthContextVariables;\n};\nexport type HonoEnvOptional = {\n Variables: Partial;\n};","label","children",[69],"contentHash","0702b5ee493d612b6ee225b9b557a777ca13608d6654b311fc9a09b0f531b71b","README.md",{"_32":92,"_13":90,"_74":93,"_76":-5,"_77":54,"_78":20,"_79":26,"_34":94,"_40":56,"_81":95,"_83":96,"_62":46,"_85":-5,"_86":-7,"_68":97,"_88":98},"7be78b3c-277f-11f0-b46e-569c3dd06744","7be78bdc-277f-11f0-b46e-569c3dd06744",["D",1709802258692],"file","# authMiddleware: middleware to protect your HTTP val\n\n## Todo\n- [ ] Human readable JWT claim validation errors",[90],"aa5d20b429d975ca107755deb8f437affd33f3143429d404d54d0a3f3f226c67",["D",1746208894126],"legacyEnvVars","httpPrivacy","description","imageUrl","userId","8a86e3e7-cae8-48ea-a1d8-c8cf7b30d88c","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","4b933fb9-e150-4558-9d0a-845e595c8c78","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_136":132},"org",{"_11":12,"_130":-5,"_131":132,"_104":105,"_133":134,"_135":46},"branch","displayName","avatar","https://images.clerk.dev/oauth_github/img_2RCoAITJZH1QencEgtVjh4Qirj4.jpeg","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_32":55,"_13":14,"_34":186,"_44":-5,"_100":26,"_47":48,"_101":48,"_102":-5,"_103":-5,"_104":105,"_106":-5,"_107":26,"_108":-5,"_109":-5,"_110":56,"_51":111,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":117,"_118":117,"_119":120,"_121":120,"_122":120,"_123":117,"_124":117,"_125":187,"_127":188,"_129":189,"_45":46},"tree",[180,181],"files",[180,181],"counts",{"_170":56,"_171":20,"_172":56,"_173":174,"_175":176},"contents",[164,165],"upstreamProject",{"_32":39,"_13":14,"_102":-5,"_103":-5,"_47":48,"_125":162},"upstreamBranch",{"_32":33,"_34":160,"_36":161,"_13":16,"_38":39,"_40":22,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":52,"_53":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1746195577072],["D",1709775728746],{"_11":50,"_136":163},"https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJjdlhaRXl0WXVNSlhZcWU0ckI2c1BOMjNhQSJ9",{"_32":92,"_13":90,"_74":93,"_76":-5,"_77":54,"_78":20,"_79":26,"_34":168,"_40":56,"_81":95,"_83":96,"_62":46,"_85":-5,"_68":169},{"_32":73,"_13":69,"_74":75,"_76":-5,"_77":54,"_78":20,"_79":26,"_34":166,"_40":56,"_81":82,"_83":84,"_62":46,"_85":-5,"_68":167},["D",1709802258692],[69],["D",1709802258692],[90],"pulls","branches","forks","envVars",{"_177":56,"_179":56},"connections",{"_177":56,"_178":56},"count","unfilledCount","emptyCount",{"_32":92,"_13":90,"_74":93,"_76":-5,"_77":54,"_78":20,"_79":26,"_34":94,"_40":56,"_81":95,"_83":96,"_62":46,"_85":-5,"_86":184,"_68":185},{"_32":73,"_13":69,"_74":75,"_76":-5,"_77":54,"_78":20,"_79":26,"_34":80,"_40":56,"_81":82,"_83":84,"_62":46,"_85":-5,"_86":182,"_68":183},[],[69],[],[90],["D",1746208894126],{"_11":12,"_136":132},{"_11":12,"_130":-5,"_131":132,"_104":105,"_133":134,"_135":46},{"_40":20,"_13":16,"_32":54,"_38":55,"_41":33,"_42":56,"_57":48,"_58":39,"_59":52,"_53":14,"_49":12},"ctx",{"_125":-5,"_157":223,"_224":225,"_226":227,"_228":46,"_229":46,"_230":46,"_231":26,"_232":-5,"_233":-7,"_234":-7,"_235":56,"_236":46,"_237":46,"_238":-5,"_239":46,"_240":46,"_241":46,"_242":-5},"ENV",{"_194":195,"_196":197,"_198":16,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Compare

Mergepomdtr/mainintopostpostscript/main

README.md+4-0

main.tsx+514-0