[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_175":176,"_177":178},"routes/_app.x.$handle.$name",{"_101":100,"_32":45,"_109":91,"_27":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":25,"_124":125,"_126":60,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":55,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",20,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","proxy.ts","latestPath","fileId","0ba6467c-32d9-11f1-8e75-42b51c65c3df","name","fileType","http","content","// Val Town HTTP Proxy\n// Deploy: paste this entire file into a new Val Town HTTP val\n// Your proxy URL will be: https://USERNAME-VALNAME.web.val.run\n//\n// Usage:\n// https://USERNAME-VALNAME.web.val.run/ → landing page\n// https://USERNAME-VALNAME.web.val.run/https://example.com → proxied page\n\nconst FEATURED_SITES = [\n { name: \"Wikipedia\", url: \"https://en.wikipedia.org\", icon: \"\\u{1F4DA}\" },\n {\n name: \"Pokemon Showdown\",\n url: \"https://play.pokemonshowdown.com\",\n icon: \"\\u26A1\",\n },\n { name: \"GN Math\", url: \"https://gn-math.github.io\", icon: \"\\u{1F522}\" },\n {\n name: \"Cool Math Games\",\n url: \"https://www.coolmathgames.com\",\n icon: \"\\u{1F3B2}\",\n },\n { name: \"Smash Karts\", url: \"https://smashkarts.io\", icon: \"\\u{1F3CE}\" },\n];\n\nconst REWRITABLE_TYPES = [\n \"text/html\",\n \"text/css\",\n \"application/javascript\",\n \"text/javascript\",\n];\n\nexport default async function server(request: Request): Promise {\n const url = new URL(request.url);\n const workerOrigin = url.origin;\n\n let targetUrl = extractTargetUrl(url.pathname, url.search);\n\n if (!targetUrl) {\n return new Response(landingPage(workerOrigin), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n try {\n new URL(targetUrl);\n } catch {\n return new Response(\"Invalid URL: \" + targetUrl, { status: 400 });\n }\n\n try {\n const targetResponse = await fetch(targetUrl, {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\",\n \"Accept\": request.headers.get(\"Accept\") || \"*/*\",\n \"Accept-Language\": \"en-US,en;q=0.9\",\n },\n redirect: \"follow\",\n });\n\n const contentType = targetResponse.headers.get(\"Content-Type\") || \"\";\n const shouldRewrite = REWRITABLE_TYPES.some((t) => contentType.includes(t));\n\n if (shouldRewrite && contentType.includes(\"text/html\")) {\n let html = await targetResponse.text();\n html = rewriteHtml(html, targetUrl, workerOrigin);\n return new Response(html, {\n status: targetResponse.status,\n headers: buildHeaders(contentType),\n });\n }\n\n if (shouldRewrite) {\n let text = await targetResponse.text();\n text = rewriteAssetUrls(text, targetUrl, workerOrigin);\n return new Response(text, {\n status: targetResponse.status,\n headers: buildHeaders(contentType),\n });\n }\n\n return new Response(targetResponse.body, {\n status: targetResponse.status,\n headers: buildHeaders(contentType),\n });\n } catch (err: any) {\n return new Response(\"Proxy error: \" + err.message, { status: 502 });\n }\n}\n\nfunction extractTargetUrl(pathname: string, search: string): string | null {\n let path = pathname;\n if (path.startsWith(\"/browse/\")) path = \"/\" + path.slice(8);\n path = path.slice(1);\n if (!path || (!path.startsWith(\"http://\") && !path.startsWith(\"https://\"))) {\n return null;\n }\n return path + (search || \"\");\n}\n\nfunction rewriteHtml(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n\n html = html.replace(\n /((?:href|src|action|poster|data-src)\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, rawUrl, suffix) =>\n prefix + resolveAndProxy(rawUrl, targetBase, workerOrigin) + suffix,\n );\n\n html = html.replace(\n /(srcset\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, srcset, suffix) => {\n const rewritten = srcset.split(\",\").map((entry: string) => {\n const parts = entry.trim().split(/\\s+/);\n if (parts.length >= 1) {\n parts[0] = resolveAndProxy(parts[0], targetBase, workerOrigin);\n }\n return parts.join(\" \");\n }).join(\", \");\n return prefix + rewritten + suffix;\n },\n );\n\n html = html.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n\n const baseTag = ``;\n html = html.replace(/]*>/i, (m) => m + baseTag);\n\n return html;\n}\n\nfunction resolveAndProxy(\n rawUrl: string,\n targetBase: URL,\n workerOrigin: string,\n): string {\n if (\n !rawUrl || rawUrl.startsWith(\"data:\") || rawUrl.startsWith(\"#\") ||\n rawUrl.startsWith(\"javascript:\") || rawUrl.startsWith(\"mailto:\") ||\n rawUrl.startsWith(\"tel:\")\n ) return rawUrl;\n try {\n const resolved = new URL(rawUrl, targetBase);\n return workerOrigin + \"/\" + resolved.href;\n } catch {\n return rawUrl;\n }\n}\n\nfunction rewriteAssetUrls(\n text: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n return text.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n}\n\nfunction buildHeaders(contentType: string): Headers {\n const headers = new Headers();\n headers.set(\"Content-Type\", contentType);\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\n return headers;\n}\n\nfunction landingPage(workerOrigin: string): string {\n const links = FEATURED_SITES.map((s) =>\n `${s.icon} ${s.name}`\n ).join(\"\\n \");\n\n return `\n\n\n \n \n Web Proxy\n \n\n\n

Web Proxy

Enter a URL to browse through this proxy

\n \n

\n ${links}\n

\n\n`;\n}","// Val Town HTTP Proxy\n// Deploy: paste this entire file into a new Val Town HTTP val\n// Your proxy URL will be: https://USERNAME-VALNAME.web.val.run\n//\n// Usage:\n// https://USERNAME-VALNAME.web.val.run/ → landing page\n// https://USERNAME-VALNAME.web.val.run/https://example.com → proxied page\n\nconst FEATURED_SITES = [\n { name: \"Wikipedia\", url: \"https://en.wikipedia.org\", icon: \"\\u{1F4DA}\" },\n {\n name: \"Pokemon Showdown\",\n url: \"https://play.pokemonshowdown.com\",\n icon: \"\\u26A1\",\n },\n { name: \"GN Math\", url: \"https://gn-math.github.io\", icon: \"\\u{1F522}\" },\n {\n name: \"Cool Math Games\",\n url: \"https://www.coolmathgames.com\",\n icon: \"\\u{1F3B2}\",\n },\n { name: \"Smash Karts\", url: \"https://smashkarts.io\", icon: \"\\u{1F3CE}\" },\n];\n\nconst REWRITABLE_TYPES = [\n \"text/html\",\n \"text/css\",\n \"application/javascript\",\n \"text/javascript\",\n];\n\nexport default async function server(request: Request): Promise {\n const url = new URL(request.url);\n const workerOrigin = url.origin;\n\n let targetUrl = extractTargetUrl(url.pathname, url.search);\n\n if (!targetUrl) {\n return new Response(landingPage(workerOrigin), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n try {\n new URL(targetUrl);\n } catch {\n return new Response(\"Invalid URL: \" + targetUrl, { status: 400 });\n }\n\n try {\n // Follow redirects manually so we can track the final URL\n let currentUrl = targetUrl;\n let targetResponse: Response;\n let redirectCount = 0;\n const MAX_REDIRECTS = 10;\n\n while (true) {\n targetResponse = await fetch(currentUrl, {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\",\n \"Accept\": request.headers.get(\"Accept\") || \"*/*\",\n \"Accept-Language\": \"en-US,en;q=0.9\",\n \"Referer\": currentUrl,\n },\n redirect: \"manual\",\n });\n\n // Follow 3xx redirects server-side\n if (targetResponse.status >= 300 && targetResponse.status < 400) {\n const location = targetResponse.headers.get(\"Location\");\n if (!location || ++redirectCount > MAX_REDIRECTS) break;\n try {\n currentUrl = new URL(location, currentUrl).href;\n } catch {\n break;\n }\n continue;\n }\n break;\n }\n\n // Use the final URL (after redirects) for resolving relative paths\n const finalUrl = currentUrl;\n\n const contentType = targetResponse!.headers.get(\"Content-Type\") || \"\";\n const shouldRewrite = REWRITABLE_TYPES.some((t) => contentType.includes(t));\n\n if (shouldRewrite && contentType.includes(\"text/html\")) {\n let html = await targetResponse!.text();\n // Rewrite meta refresh redirects to stay in proxy\n html = rewriteMetaRefresh(html, finalUrl, workerOrigin);\n html = rewriteHtml(html, finalUrl, workerOrigin);\n return new Response(html, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n }\n\n if (shouldRewrite) {\n let text = await targetResponse!.text();\n text = rewriteAssetUrls(text, finalUrl, workerOrigin);\n return new Response(text, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n }\n\n return new Response(targetResponse!.body, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n } catch (err: any) {\n return new Response(\"Proxy error: \" + err.message, { status: 502 });\n }\n}\n\nfunction extractTargetUrl(pathname: string, search: string): string | null {\n let path = pathname;\n if (path.startsWith(\"/browse/\")) path = \"/\" + path.slice(8);\n path = path.slice(1);\n if (!path || (!path.startsWith(\"http://\") && !path.startsWith(\"https://\"))) {\n return null;\n }\n return path + (search || \"\");\n}\n\nfunction rewriteMetaRefresh(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n // Rewrite to stay in proxy\n return html.replace(\n /(]*>)/gi,\n (_match, prefix, delay, rawUrl, suffix) => {\n return prefix + delay +\n resolveAndProxy(rawUrl.trim(), targetBase, workerOrigin) + suffix;\n },\n );\n}\n\nfunction rewriteHtml(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n\n html = html.replace(\n /((?:href|src|action|poster|data-src)\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, rawUrl, suffix) =>\n prefix + resolveAndProxy(rawUrl, targetBase, workerOrigin) + suffix,\n );\n\n html = html.replace(\n /(srcset\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, srcset, suffix) => {\n const rewritten = srcset.split(\",\").map((entry: string) => {\n const parts = entry.trim().split(/\\s+/);\n if (parts.length >= 1) {\n parts[0] = resolveAndProxy(parts[0], targetBase, workerOrigin);\n }\n return parts.join(\" \");\n }).join(\", \");\n return prefix + rewritten + suffix;\n },\n );\n\n html = html.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n\n const baseTag = ``;\n html = html.replace(/]*>/i, (m) => m + baseTag);\n\n // Inject navigation interceptor: window.open, location, fetch, XHR, location.href\n const navInterceptor =\n ``;\n html = html.replace(/]*>/i, (m) => m + navInterceptor);\n\n // Inject minimizable URL bar banner\n const currentPageUrl = targetBase.href;\n const urlBar =\n `

`;\n html = html.replace(/]*>/i, (m) => m + urlBar);\n\n return html;\n}\n\nfunction resolveAndProxy(\n rawUrl: string,\n targetBase: URL,\n workerOrigin: string,\n): string {\n if (\n !rawUrl || rawUrl.startsWith(\"data:\") || rawUrl.startsWith(\"#\") ||\n rawUrl.startsWith(\"javascript:\") || rawUrl.startsWith(\"mailto:\") ||\n rawUrl.startsWith(\"tel:\")\n ) return rawUrl;\n try {\n const resolved = new URL(rawUrl, targetBase);\n return workerOrigin + \"/\" + resolved.href;\n } catch {\n return rawUrl;\n }\n}\n\nfunction rewriteAssetUrls(\n text: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n return text.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n}\n\nfunction buildHeaders(contentType: string): Headers {\n const headers = new Headers();\n headers.set(\"Content-Type\", contentType);\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\n return headers;\n}\n\nfunction landingPage(workerOrigin: string): string {\n const links = FEATURED_SITES.map((s) =>\n `${s.icon} ${s.name}`\n ).join(\"\\n \");\n\n return `\n\n\n \n \n Web Proxy\n \n\n\n

Web Proxy

Enter a URL to browse through this proxy

\n \n

\n ${links}\n

\n\n`;\n}","createdAt",["D",1776035478977],"branchVersion","branchId","32fceb1c-3208-11f1-8a4a-42dde27851f2","id","32fc1ab6-3208-11f1-8a4a-42dde27851f2","study-resources",["D",1775514622169],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Helps me study (I love Wikipedia!)","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/c1d6fc2c-ffb0-47e2-10ae-a4fdf1ff0000/square512?exp=1789556399&sig=ea37e9fc199573a341f327d06f8e45ec4bbf2458c32b25992250a54a3f1c4bac","019d275b-d06b-734f-8e50-762c85009c4d","pinnedFileId","f92f31dc-3d16-11f1-89e2-42b51c65c3df","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019d275b-d06b-734f-8e50-7b6137063a35","tursoName","32fc1ab6320811f18a4a42dde27851f2","tursoHostname","32fc1ab6320811f18a4a42dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789538451310],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_108":104},"org",{"_101":100,"_102":-5,"_103":104,"_18":56,"_105":106,"_107":25},"branch",{"_13":90,"_32":91,"_43":42,"_92":44,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":45,"_99":100},"isOwned",33,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pycoder42","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zQlNVQUVMTkx3QmljWDhIOVVPZjIwbVRSYjkifQ","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":170,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":55,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":171,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":172,"_85":173,"_87":174,"_89":25},"tree",[161,162],"files",[161,162],"counts",{"_149":64,"_150":151,"_152":64,"_153":154,"_155":156},"contents",[131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":141,"_32":142,"_30":143,"_134":-5,"_41":42,"_40":144,"_135":25,"_38":145,"_13":137,"_33":34,"_35":146,"_24":25,"_138":147,"_27":148},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":136,"_13":137,"_33":34,"_35":37,"_24":25,"_138":139,"_27":140},"e9d78502-36c4-11f1-9edc-42b51c65c3df","parentId","latest",["D",1776035478977],9,"label","aab",[28],"352a6766-32df-11f1-ab6f-42b51c65c3df","auth.ts","330273ca-3208-11f1-8a4a-42dde27851f2",18,["D",1775606967617],"// Val Town Game Auth Server\n//\n// This is the security backbone. It stores all secrets server-side.\n// The secure HTML files contain NOTHING sensitive — no repo URLs,\n// no encryption keys, no config URLs. Just a password prompt and\n// this endpoint's URL.\n//\n// Deploy: Paste into a new Val Town HTTP val.\n// Then set these environment variables in Val Town:\n// GITHUB_PAT — GitHub personal access token (repo read/write)\n// GITHUB_REPO — e.g. \"username/repo-name\"\n// GAME_KEYS_JSON — JSON: { \"drive-mad\": \"hex-key\", \"mr-mine\": \"hex-key\", ... }\n// (copy from .game-keys file)\n// AUTH_SECRET — A password for admin panel access (optional extra layer)\n//\n// Endpoints:\n// POST /auth — Authenticate a game session\n// GET /config — Read config (admin panel)\n// POST /config — Write config (admin panel)\n// POST /block-all — Invalidate all current file versions\n// POST /block-ip — Block an IP address (globally)\n// POST /unblock-ip — Remove a global IP block\n// POST /block-ip-game — Block an IP for a specific game only\n// POST /unblock-ip-game — Remove a per-game IP block\n// GET /ip-log — Read the IP access log (requires x-auth-secret header)\n// POST /track — Log a panel access beacon (no auth required)\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, x-auth-secret\",\n};\n\n// ─── Types ───────────────────────────────────────────────────\n\ntype IpLogEntry = { ip: string; gameId: string; at: string };\ntype PanelLogEntry = { p: string; r: string; ts: number; at: string };\n\nexport default async function server(request: Request): Promise {\n if (request.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n\n const url = new URL(request.url);\n const path = url.pathname;\n\n try {\n if (path === \"/auth\" && request.method === \"POST\") {\n return handleAuth(request);\n }\n if (path === \"/config\" && request.method === \"GET\") {\n return handleReadConfig(request);\n }\n if (path === \"/config\" && request.method === \"POST\") {\n return handleWriteConfig(request);\n }\n if (path === \"/block-all\" && request.method === \"POST\") {\n return handleBlockAll(request);\n }\n if (path === \"/block-ip\" && request.method === \"POST\") {\n return handleBlockIp(request);\n }\n if (path === \"/unblock-ip\" && request.method === \"POST\") {\n return handleUnblockIp(request);\n }\n if (path === \"/block-ip-game\" && request.method === \"POST\") {\n return handleBlockIpGame(request);\n }\n if (path === \"/unblock-ip-game\" && request.method === \"POST\") {\n return handleUnblockIpGame(request);\n }\n if (path === \"/ip-log\" && request.method === \"GET\") {\n return handleReadIpLog(request);\n }\n if (path === \"/track\" && request.method === \"POST\") {\n return handleTrack(request);\n }\n return jsonResponse({ error: \"not_found\" }, 404);\n } catch (err: any) {\n return jsonResponse({ error: \"server_error\", message: err.message }, 500);\n }\n}\n\n// ─── Auth: The core endpoint ─────────────────────────────────\n// Called by secure HTML files when user enters password.\n// Returns encrypted game data + key if approved.\n// Returns error if denied. No secrets leak on denial.\n\nasync function handleAuth(request: Request): Promise {\n const body = await request.json() as {\n gameId?: string;\n password?: string;\n ip?: string;\n fileVersion?: number;\n };\n\n const gameId = normalizeGameId(body.gameId || \"\");\n const password = (body.password || \"\").trim();\n const clientIp = (body.ip || \"\").trim();\n const fileVersion = body.fileVersion || 0;\n\n if (!gameId) {\n return jsonResponse({ error: \"denied\", reason: \"Invalid game ID\" });\n }\n if (!password) {\n return jsonResponse({ error: \"denied\", reason: \"No password\" });\n }\n\n // Fetch current config from GitHub\n const config = await fetchConfig();\n if (!config) {\n return jsonResponse({ error: \"denied\", reason: \"Config unavailable\" });\n }\n\n // Check password\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"denied\", reason: \"Wrong password\" });\n }\n\n // Check if game is blocked\n const blocked = config.blocked || {};\n const blockVal = blocked[gameId];\n if (\n blockVal === true ||\n (typeof blockVal === \"string\" && new Date(blockVal) > new Date())\n ) {\n // Check if IP is in allowedIps (override block for permitted IPs)\n const allowedIps = normalizeAllowedIps(config.allowedIps);\n if (!clientIp || !allowedIps[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"Game is blocked\" });\n }\n }\n\n // Check if IP is blocked globally\n const blockedIps = config.blockedIps || {};\n if (clientIp && blockedIps[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"IP is blocked\" });\n }\n\n // Check if IP is blocked for this specific game\n const perGameBlocked = config.perGameBlockedIps || {};\n const gameBlocked = perGameBlocked[gameId] || {};\n if (clientIp && gameBlocked[clientIp]) {\n return jsonResponse({\n error: \"denied\",\n reason: \"IP is blocked for this game\",\n });\n }\n\n // Check minimum file version (version invalidation)\n const minFileVersion = config.minFileVersion || 0;\n if (fileVersion > 0 && fileVersion < minFileVersion) {\n return jsonResponse({\n error: \"denied\",\n reason: \"Outdated version. Get the latest files.\",\n });\n }\n\n // All checks passed — return the game data + decryption key\n const gameKeys = getGameKeys();\n const gameKey = gameKeys[gameId];\n if (!gameKey) {\n return jsonResponse({ error: \"denied\", reason: \"Game not configured\" });\n }\n\n // Fetch encrypted game data from GitHub (server-side, client never sees repo URL)\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const gameDataUrl =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/game-data/${gameId}.enc.json`;\n\n const gameDataResp = await fetch(gameDataUrl, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!gameDataResp.ok) {\n return jsonResponse({ error: \"denied\", reason: \"Game data unavailable\" });\n }\n\n const gameData = await gameDataResp.json();\n\n // Fire-and-forget: log this access (don't await, don't fail auth if it errors)\n if (clientIp) {\n appendToIpLog({ ip: clientIp, gameId, at: new Date().toISOString() }).catch(\n () => {},\n );\n }\n\n return jsonResponse({\n ok: true,\n gameData: gameData, // { iv, authTag, ciphertext }\n key: gameKey, // hex-encoded AES-256 key\n });\n}\n\n// ─── Config read/write (admin panel) ─────────────────────────\n\nasync function handleReadConfig(request: Request): Promise {\n const url = new URL(request.url);\n const password = url.searchParams.get(\"password\") || \"\";\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n return jsonResponse(config);\n}\n\nasync function handleWriteConfig(request: Request): Promise {\n const body = await request.json() as { password?: string; config?: any };\n const password = (body.password || \"\").trim();\n\n const currentConfig = await fetchConfig();\n if (!currentConfig) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(currentConfig);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n const newConfig = body.config;\n if (!newConfig || typeof newConfig !== \"object\") {\n return jsonResponse({ error: \"Invalid config\" }, 400);\n }\n\n await writeConfigToGitHub(newConfig);\n return jsonResponse({ ok: true });\n}\n\n// ─── Block all versions ──────────────────────────────────────\n\nasync function handleBlockAll(request: Request): Promise {\n const body = await request.json() as { password?: string };\n const password = (body.password || \"\").trim();\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Set minFileVersion to current timestamp — all older files are blocked\n config.minFileVersion = Date.now();\n await writeConfigToGitHub(config);\n\n return jsonResponse({\n ok: true,\n minFileVersion: config.minFileVersion,\n message:\n \"All current versions blocked. Regenerate files to create valid versions.\",\n });\n}\n\n// ─── Global IP blocking ──────────────────────────────────────\n\nasync function handleBlockIp(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.blockedIps) config.blockedIps = {};\n config.blockedIps[ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps });\n}\n\nasync function handleUnblockIp(request: Request): Promise {\n const body = await request.json() as { password?: string; ip?: string };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.blockedIps) {\n delete config.blockedIps[ip];\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps || {} });\n}\n\n// ─── Per-game IP blocking ─────────────────────────────────────\n\nasync function handleBlockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.perGameBlockedIps) config.perGameBlockedIps = {};\n if (!config.perGameBlockedIps[gameId]) config.perGameBlockedIps[gameId] = {};\n config.perGameBlockedIps[gameId][ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps,\n });\n}\n\nasync function handleUnblockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.perGameBlockedIps && config.perGameBlockedIps[gameId]) {\n delete config.perGameBlockedIps[gameId][ip];\n // Clean up empty game entry\n if (Object.keys(config.perGameBlockedIps[gameId]).length === 0) {\n delete config.perGameBlockedIps[gameId];\n }\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps || {},\n });\n}\n\n// ─── IP log read ──────────────────────────────────────────────\n\nasync function handleReadIpLog(request: Request): Promise {\n const secret = request.headers.get(\"x-auth-secret\") || \"\";\n const expectedSecret = getEnv(\"AUTH_SECRET\");\n if (!expectedSecret || secret !== expectedSecret) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n const log = await fetchIpLog();\n return jsonResponse({ ok: true, entries: log });\n}\n\n// ─── Panel access tracking beacon ─────────────────────────────\n\nasync function handleTrack(request: Request): Promise {\n // Fire-and-forget — always return 200, never fail the caller\n try {\n const body = await request.json() as {\n p?: string;\n r?: string;\n ts?: number;\n };\n const entry: PanelLogEntry = {\n p: (body.p || \"\").trim(),\n r: (body.r || \"\").trim(),\n ts: body.ts || 0,\n at: new Date().toISOString(),\n };\n appendToPanelLog(entry).catch(() => {});\n } catch {\n // Ignore parse errors — always 200\n }\n return jsonResponse({ ok: true });\n}\n\n// ─── GitHub API helpers ──────────────────────────────────────\n\nasync function fetchConfig(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/config.json?t=${Date.now()}`;\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!resp.ok) return null;\n return resp.json();\n}\n\nasync function writeConfigToGitHub(config: any): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) throw new Error(\"GITHUB_REPO and GITHUB_PAT required\");\n\n // Get current file SHA\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/config.json`;\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n }\n\n // Write updated config\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(config, null, 2) + \"\\n\")),\n );\n const putResp = await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Update config via auth server\",\n content: content,\n sha: sha || undefined,\n }),\n });\n\n if (!putResp.ok) {\n const err = await putResp.text();\n throw new Error(\"GitHub write failed: \" + err);\n }\n}\n\n// ─── IP log helpers ───────────────────────────────────────────\n\nasync function fetchIpLog(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/ip-log.json?t=${Date.now()}`;\n try {\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n if (!resp.ok) return [];\n return resp.json();\n } catch {\n return [];\n }\n}\n\nasync function appendToIpLog(entry: IpLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/ip-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: IpLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log game access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Panel log helpers ────────────────────────────────────────\n\nasync function appendToPanelLog(entry: PanelLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/panel-access-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: PanelLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log panel access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────\n\nfunction getEnv(key: string): string {\n return (Deno.env.get(key) || \"\").trim();\n}\n\nfunction getGameKeys(): Record {\n try {\n return JSON.parse(getEnv(\"GAME_KEYS_JSON\"));\n } catch {\n return {};\n }\n}\n\nfunction normalizeGameId(value: string): string {\n let normalized = value.trim().toLowerCase();\n if (!normalized) return \"\";\n normalized = normalized.replace(/\\.html$/i, \"\");\n normalized = normalized.replace(/eaglrcraft/g, \"eaglercraft\");\n normalized = normalized.replace(/open[-\\s]*in[-\\s]*new[-\\s]*tab/g, \" \");\n normalized = normalized.replace(\n /-(regular|locked|locked-b64|secure|base)/g,\n \" \",\n );\n normalized = normalized.replace(/[-_\\s]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n return normalized;\n}\n\nfunction normalizePasswordList(config: any): string[] {\n if (!config) return [];\n const passwords: string[] = [];\n if (config.password) passwords.push(config.password.trim());\n if (Array.isArray(config.passwords)) {\n config.passwords.forEach((p: string) => {\n const trimmed = (p || \"\").trim();\n if (trimmed && !passwords.includes(trimmed)) passwords.push(trimmed);\n });\n }\n return passwords;\n}\n\nfunction normalizeAllowedIps(raw: any): Record {\n if (!raw || typeof raw !== \"object\") return {};\n const result: Record = {};\n Object.keys(raw).forEach((ip) => {\n const trimmed = ip.trim();\n if (trimmed) result[trimmed] = raw[ip];\n });\n return result;\n}\n\nfunction jsonResponse(data: any, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n });\n}","pythoncoderauth",[142],"pulls","branches",1,"forks","envVars",{"_157":159,"_160":64},"connections",{"_157":64,"_158":64},"count","unfilledCount",4,"emptyCount",{"_43":141,"_32":142,"_30":143,"_134":-5,"_41":42,"_40":144,"_135":25,"_38":167,"_13":137,"_33":34,"_35":146,"_24":25,"_138":147,"_164":168,"_27":169},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":163,"_13":137,"_33":34,"_35":37,"_24":25,"_138":139,"_164":165,"_27":166},["D",1776035478977],"children",[],[28],["D",1775606967617],[],[142],["D",1775514622169],["D",1789538451310],{"_101":100,"_108":104},{"_101":100,"_102":-5,"_103":104,"_18":56,"_105":106,"_107":25},{"_13":90,"_32":91,"_43":42,"_92":44,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":45,"_99":100},"ctx",{"_83":-5,"_128":208,"_209":210,"_211":212,"_213":25,"_214":25,"_215":25,"_216":60,"_217":-5,"_218":-7,"_219":-7,"_220":64,"_221":25,"_222":25,"_223":-5,"_224":25,"_225":25,"_226":25,"_227":-5},"ENV",{"_179":180,"_181":182,"_183":91,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v20