`;\n html = html.replace(/]*>/i, (m) => m + urlBar);\n\n return html;\n}\n\nfunction resolveAndProxy(\n rawUrl: string,\n targetBase: URL,\n workerOrigin: string,\n): string {\n if (\n !rawUrl || rawUrl.startsWith(\"data:\") || rawUrl.startsWith(\"#\") ||\n rawUrl.startsWith(\"javascript:\") || rawUrl.startsWith(\"mailto:\") ||\n rawUrl.startsWith(\"tel:\")\n ) return rawUrl;\n try {\n const resolved = new URL(rawUrl, targetBase);\n return workerOrigin + \"/\" + resolved.href;\n } catch {\n return rawUrl;\n }\n}\n\nfunction rewriteAssetUrls(\n text: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n return text.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n}\n\nfunction buildHeaders(contentType: string): Headers {\n const headers = new Headers();\n headers.set(\"Content-Type\", contentType);\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\n return headers;\n}\n\nfunction landingPage(workerOrigin: string): string {\n const links = FEATURED_SITES.map((s) =>\n `${s.icon} ${s.name}`\n ).join(\"\\n \");\n\n return `\n\n\n \n \n Web Proxy\n \n\n\n

Web Proxy

Enter a URL to browse through this proxy

\n \n

\n ${links}\n

\n\n`;\n}","quizlet",[150],"c0c4f87c-3d16-11f1-a24c-42b51c65c3df","auth.ts","330273ca-3208-11f1-8a4a-42dde27851f2",24,["D",1776730335772],12,"// Val Town Game Auth Server\n//\n// This is the security backbone. It stores all secrets server-side.\n// The secure HTML files contain NOTHING sensitive — no repo URLs,\n// no encryption keys, no config URLs. Just a password prompt and\n// this endpoint's URL.\n//\n// Deploy: Paste into a new Val Town HTTP val.\n// Then set these environment variables in Val Town:\n// GITHUB_PAT — GitHub personal access token (repo read/write)\n// GITHUB_REPO — e.g. \"username/repo-name\"\n// GAME_KEYS_JSON — JSON: { \"drive-mad\": \"hex-key\", \"mr-mine\": \"hex-key\", ... }\n// (copy from .game-keys file)\n// AUTH_SECRET — A password for admin panel access (optional extra layer)\n//\n// Endpoints:\n// POST /auth — Authenticate a game session\n// GET /config — Read config (admin panel)\n// POST /config — Write config (admin panel)\n// POST /block-all — Invalidate all current file versions\n// POST /block-ip — Block an IP address (globally)\n// POST /unblock-ip — Remove a global IP block\n// POST /block-ip-game — Block an IP for a specific game only\n// POST /unblock-ip-game — Remove a per-game IP block\n// POST /allow-ip-game — Allow an IP for a specific game (overrides global blocklist)\n// POST /unallow-ip-game — Remove a per-game IP allow\n// GET /ip-log — Read the IP access log (requires x-auth-secret header)\n// POST /visit — Log a game page visit (no auth required, fire-and-forget)\n// POST /track — Log a panel access beacon (no auth required)\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, x-auth-secret\",\n};\n\n// ─── Types ───────────────────────────────────────────────────\n\ntype IpLogEntry = {\n ip: string;\n gameId: string;\n at: string;\n type?: \"auth\" | \"visit\";\n};\ntype PanelLogEntry = { p: string; r: string; ts: number; at: string };\n\n// ─── Rate Limiter (in-memory, resets on cold start) ──────────\n// 5 failed password attempts in 5 minutes → 429 for 15 minutes\n\nconst RATE_LIMIT_WINDOW = 5 * 60 * 1000; // 5 minutes\nconst RATE_LIMIT_MAX = 5; // max failures in window\nconst RATE_LIMIT_BLOCK = 15 * 60 * 1000; // 15-minute lockout\n\ntype RateLimitEntry = { failures: number[]; blockedUntil: number };\nconst rateLimitMap = new Map();\n\nfunction checkRateLimit(ip: string): { blocked: boolean; retryAfter?: number } {\n if (!ip) return { blocked: false };\n\n const now = Date.now();\n const entry = rateLimitMap.get(ip);\n\n if (entry) {\n // Currently blocked?\n if (entry.blockedUntil > now) {\n return {\n blocked: true,\n retryAfter: Math.ceil((entry.blockedUntil - now) / 1000),\n };\n }\n // Prune old failures outside the window\n entry.failures = entry.failures.filter((t) => now - t < RATE_LIMIT_WINDOW);\n }\n\n return { blocked: false };\n}\n\nfunction recordFailure(ip: string): void {\n if (!ip) return;\n\n const now = Date.now();\n let entry = rateLimitMap.get(ip);\n\n if (!entry) {\n entry = { failures: [], blockedUntil: 0 };\n rateLimitMap.set(ip, entry);\n }\n\n // Prune old failures\n entry.failures = entry.failures.filter((t) => now - t < RATE_LIMIT_WINDOW);\n entry.failures.push(now);\n\n // Trigger lockout if threshold reached\n if (entry.failures.length >= RATE_LIMIT_MAX) {\n entry.blockedUntil = now + RATE_LIMIT_BLOCK;\n entry.failures = []; // reset counter for after lockout\n }\n\n // Housekeeping: prune stale IPs every 100 calls\n if (rateLimitMap.size > 500) {\n for (const [key, val] of rateLimitMap) {\n if (val.blockedUntil < now && val.failures.length === 0) {\n rateLimitMap.delete(key);\n }\n }\n }\n}\n\nexport default async function server(request: Request): Promise {\n if (request.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n\n const url = new URL(request.url);\n const path = url.pathname;\n\n try {\n if (path === \"/auth\" && request.method === \"POST\") {\n return handleAuth(request);\n }\n if (path === \"/config\" && request.method === \"GET\") {\n return handleReadConfig(request);\n }\n if (path === \"/config\" && request.method === \"POST\") {\n return handleWriteConfig(request);\n }\n if (path === \"/block-all\" && request.method === \"POST\") {\n return handleBlockAll(request);\n }\n if (path === \"/block-ip\" && request.method === \"POST\") {\n return handleBlockIp(request);\n }\n if (path === \"/unblock-ip\" && request.method === \"POST\") {\n return handleUnblockIp(request);\n }\n if (path === \"/block-ip-game\" && request.method === \"POST\") {\n return handleBlockIpGame(request);\n }\n if (path === \"/unblock-ip-game\" && request.method === \"POST\") {\n return handleUnblockIpGame(request);\n }\n if (path === \"/allow-ip-game\" && request.method === \"POST\") {\n return handleAllowIpGame(request);\n }\n if (path === \"/unallow-ip-game\" && request.method === \"POST\") {\n return handleUnallowIpGame(request);\n }\n if (path === \"/ip-log\" && request.method === \"GET\") {\n return handleReadIpLog(request);\n }\n if (path === \"/visit\" && request.method === \"POST\") {\n return handleVisit(request);\n }\n if (path === \"/track\" && request.method === \"POST\") {\n return handleTrack(request);\n }\n if (path === \"/proxy-url\" && request.method === \"GET\") {\n return handleProxyUrl();\n }\n if (path === \"/proxy-url\" && request.method === \"POST\") {\n return handleSetProxyUrl(request);\n }\n if (path === \"/announcement\" && request.method === \"GET\") {\n return handleGetAnnouncement();\n }\n if (path === \"/announcement\" && request.method === \"POST\") {\n return handleSetAnnouncement(request);\n }\n if (path === \"/nuclear\" && request.method === \"POST\") {\n return handleNuclear(request);\n }\n return jsonResponse({ error: \"not_found\" }, 404);\n } catch (err: any) {\n return jsonResponse({ error: \"server_error\", message: err.message }, 500);\n }\n}\n\n// ─── Auth: The core endpoint ─────────────────────────────────\n// Called by secure HTML files when user enters password.\n// Returns encrypted game data + key if approved.\n// Returns error if denied. No secrets leak on denial.\n\nasync function handleAuth(request: Request): Promise {\n const body = await request.json() as {\n gameId?: string;\n password?: string;\n ip?: string;\n fileVersion?: number;\n };\n\n const gameId = normalizeGameId(body.gameId || \"\");\n const password = (body.password || \"\").trim();\n const clientIp = (body.ip || \"\").trim();\n const fileVersion = body.fileVersion || 0;\n\n // Rate limit check (before any expensive work)\n const rateCheck = checkRateLimit(clientIp);\n if (rateCheck.blocked) {\n return jsonResponse(\n { error: \"denied\", reason: \"Too many attempts. Try again later.\" },\n 429,\n );\n }\n\n if (!gameId) {\n return jsonResponse({ error: \"denied\", reason: \"Invalid game ID\" });\n }\n if (!password) {\n return jsonResponse({ error: \"denied\", reason: \"No password\" });\n }\n\n // Fetch current config from GitHub\n const config = await fetchConfig();\n if (!config) {\n return jsonResponse({ error: \"denied\", reason: \"Config unavailable\" });\n }\n\n // Check password\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n recordFailure(clientIp);\n return jsonResponse({ error: \"denied\", reason: \"Wrong password\" });\n }\n\n // ── IP override logic ──────────────────────────────────────\n // Per-game IP rules override global rules:\n // perGameAllowedIps set → those IPs + global allowedIps are OK; global blockedIps ignored\n // perGameBlockedIps set → those IPs + global blockedIps are blocked; global allowedIps ignored\n // Neither set → fall back to global allowedIps/blockedIps as normal\n\n const globalAllowed = normalizeAllowedIps(config.allowedIps);\n const globalBlocked = config.blockedIps || {};\n const perGameAllowed = (config.perGameAllowedIps || {})[gameId] || {};\n const perGameBlocked = (config.perGameBlockedIps || {})[gameId] || {};\n const hasPerGameAllow = Object.keys(perGameAllowed).length > 0;\n const hasPerGameBlock = Object.keys(perGameBlocked).length > 0;\n\n if (clientIp) {\n if (hasPerGameAllow) {\n // Per-game allow mode: only per-game allowed + global allowed can access\n // Global blocklist is overridden (ignored)\n if (!perGameAllowed[clientIp] && !globalAllowed[clientIp]) {\n return jsonResponse({\n error: \"denied\",\n reason: \"IP not allowed for this game\",\n });\n }\n } else if (hasPerGameBlock) {\n // Per-game block mode: per-game blocked + global blocked are denied\n // Global allowlist is overridden (ignored)\n if (perGameBlocked[clientIp] || globalBlocked[clientIp]) {\n return jsonResponse({\n error: \"denied\",\n reason: \"IP is blocked for this game\",\n });\n }\n } else {\n // No per-game rules — use global lists normally\n if (globalBlocked[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"IP is blocked\" });\n }\n }\n }\n\n // Check if game is blocked\n const blocked = config.blocked || {};\n const blockVal = blocked[gameId];\n if (\n blockVal === true ||\n (typeof blockVal === \"string\" && new Date(blockVal) > new Date())\n ) {\n // Check if IP is in effective allow list (per-game or global depending on mode)\n const effectiveAllowed = hasPerGameAllow\n ? { ...globalAllowed, ...perGameAllowed }\n : globalAllowed;\n if (!clientIp || !effectiveAllowed[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"Game is blocked\" });\n }\n }\n\n // Check minimum file version (version invalidation)\n const minFileVersion = config.minFileVersion || 0;\n if (fileVersion > 0 && fileVersion < minFileVersion) {\n return jsonResponse({\n error: \"denied\",\n reason: \"Outdated version. Get the latest files.\",\n });\n }\n\n // All checks passed — return the game data + decryption key\n const gameKeys = getGameKeys();\n const gameKey = gameKeys[gameId];\n if (!gameKey) {\n return jsonResponse({ error: \"denied\", reason: \"Game not configured\" });\n }\n\n // Fetch encrypted game data from GitHub (server-side, client never sees repo URL)\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const gameDataUrl =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/game-data/${gameId}.enc.json`;\n\n const gameDataResp = await fetch(gameDataUrl, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!gameDataResp.ok) {\n return jsonResponse({ error: \"denied\", reason: \"Game data unavailable\" });\n }\n\n const gameData = await gameDataResp.json();\n\n // Fire-and-forget: log this access (don't await, don't fail auth if it errors)\n if (clientIp) {\n appendToIpLog({\n ip: clientIp,\n gameId,\n at: new Date().toISOString(),\n type: \"auth\",\n }).catch(() => {});\n }\n\n return jsonResponse({\n ok: true,\n gameData: gameData, // { iv, authTag, ciphertext }\n key: gameKey, // hex-encoded AES-256 key\n });\n}\n\n// ─── Config read/write (admin panel) ─────────────────────────\n\nasync function handleReadConfig(request: Request): Promise {\n const url = new URL(request.url);\n const password = url.searchParams.get(\"password\") || \"\";\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n return jsonResponse(config);\n}\n\nasync function handleWriteConfig(request: Request): Promise {\n const body = await request.json() as { password?: string; config?: any };\n const password = (body.password || \"\").trim();\n\n const currentConfig = await fetchConfig();\n if (!currentConfig) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(currentConfig);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n const newConfig = body.config;\n if (!newConfig || typeof newConfig !== \"object\") {\n return jsonResponse({ error: \"Invalid config\" }, 400);\n }\n\n await writeConfigToGitHub(newConfig);\n return jsonResponse({ ok: true });\n}\n\n// ─── Block all versions ──────────────────────────────────────\n\nasync function handleBlockAll(request: Request): Promise {\n const body = await request.json() as { password?: string };\n const password = (body.password || \"\").trim();\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Set minFileVersion to current timestamp — all older files are blocked\n config.minFileVersion = Date.now();\n await writeConfigToGitHub(config);\n\n return jsonResponse({\n ok: true,\n minFileVersion: config.minFileVersion,\n message:\n \"All current versions blocked. Regenerate files to create valid versions.\",\n });\n}\n\n// ─── Global IP blocking ──────────────────────────────────────\n\nasync function handleBlockIp(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.blockedIps) config.blockedIps = {};\n config.blockedIps[ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps });\n}\n\nasync function handleUnblockIp(request: Request): Promise {\n const body = await request.json() as { password?: string; ip?: string };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.blockedIps) {\n delete config.blockedIps[ip];\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps || {} });\n}\n\n// ─── Per-game IP blocking ─────────────────────────────────────\n\nasync function handleBlockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.perGameBlockedIps) config.perGameBlockedIps = {};\n if (!config.perGameBlockedIps[gameId]) config.perGameBlockedIps[gameId] = {};\n config.perGameBlockedIps[gameId][ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps,\n });\n}\n\nasync function handleUnblockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.perGameBlockedIps && config.perGameBlockedIps[gameId]) {\n delete config.perGameBlockedIps[gameId][ip];\n // Clean up empty game entry\n if (Object.keys(config.perGameBlockedIps[gameId]).length === 0) {\n delete config.perGameBlockedIps[gameId];\n }\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps || {},\n });\n}\n\n// ─── Per-game IP allowing ────────────────────────────────────────\n\nasync function handleAllowIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.perGameAllowedIps) config.perGameAllowedIps = {};\n if (!config.perGameAllowedIps[gameId]) config.perGameAllowedIps[gameId] = {};\n config.perGameAllowedIps[gameId][ip] = {\n label: label || ip,\n addedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameAllowedIps: config.perGameAllowedIps,\n });\n}\n\nasync function handleUnallowIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.perGameAllowedIps && config.perGameAllowedIps[gameId]) {\n delete config.perGameAllowedIps[gameId][ip];\n if (Object.keys(config.perGameAllowedIps[gameId]).length === 0) {\n delete config.perGameAllowedIps[gameId];\n }\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameAllowedIps: config.perGameAllowedIps || {},\n });\n}\n\n// ─── IP log read ──────────────────────────────────────────────\n\nasync function handleReadIpLog(request: Request): Promise {\n const secret = request.headers.get(\"x-auth-secret\") || \"\";\n const expectedSecret = getEnv(\"AUTH_SECRET\");\n if (!expectedSecret || secret !== expectedSecret) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n const log = await fetchIpLog();\n return jsonResponse({ ok: true, entries: log });\n}\n\n// ─── Game visit beacon (fires on page open, before auth) ─────\n\nasync function handleVisit(request: Request): Promise {\n // Fire-and-forget — always return 200, never fail the caller\n try {\n const body = await request.json() as { gameId?: string; ip?: string };\n const gameId = normalizeGameId(body.gameId || \"\");\n const ip = (body.ip || \"\").trim();\n if (gameId && ip) {\n appendToIpLog({ ip, gameId, at: new Date().toISOString(), type: \"visit\" })\n .catch(() => {});\n }\n } catch {\n // Ignore parse errors — always 200\n }\n return jsonResponse({ ok: true });\n}\n\n// ─── Panel access tracking beacon ─────────────────────────────\n\nasync function handleTrack(request: Request): Promise {\n // Fire-and-forget — always return 200, never fail the caller\n try {\n const body = await request.json() as {\n p?: string;\n r?: string;\n ts?: number;\n };\n const entry: PanelLogEntry = {\n p: (body.p || \"\").trim(),\n r: (body.r || \"\").trim(),\n ts: body.ts || 0,\n at: new Date().toISOString(),\n };\n appendToPanelLog(entry).catch(() => {});\n } catch {\n // Ignore parse errors — always 200\n }\n return jsonResponse({ ok: true });\n}\n\n// ─── Proxy URL (public, no auth — games call this) ──────────\n\nasync function handleProxyUrl(): Promise {\n const config = await fetchConfig();\n const proxyUrl = config?.proxyUrl || \"\";\n return jsonResponse({ proxyUrl });\n}\n\nasync function handleSetProxyUrl(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n proxyUrl?: string;\n tier?: number;\n };\n const password = (body.password || \"\").trim();\n const tier = body.tier || 3;\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Tier 2 and above can update proxy URL (it needs to be fast — school blocks in ~30min)\n if (tier > 2) {\n return jsonResponse({ error: \"Tier 3 cannot update proxy URL\" }, 403);\n }\n\n config.proxyUrl = (body.proxyUrl || \"\").trim();\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, proxyUrl: config.proxyUrl });\n}\n\n// ─── Announcements ──────────────────────────────────────────\n\nasync function handleGetAnnouncement(): Promise {\n const config = await fetchConfig();\n const ann = config?.announcement || { text: \"\", tier2CanEdit: false };\n return jsonResponse({\n text: ann.text || \"\",\n tier2CanEdit: !!ann.tier2CanEdit,\n });\n}\n\nasync function handleSetAnnouncement(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n text?: string;\n tier2CanEdit?: boolean;\n tier?: number;\n };\n const password = (body.password || \"\").trim();\n const tier = body.tier || 3;\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.announcement) {\n config.announcement = { text: \"\", tier2CanEdit: false };\n }\n\n // Tier 2 can only edit text, and only if tier1 allows it\n if (tier === 2) {\n if (!config.announcement.tier2CanEdit) {\n return jsonResponse({\n error: \"Tier 2 not authorized to edit announcements\",\n }, 403);\n }\n if (typeof body.text === \"string\") config.announcement.text = body.text;\n // Tier 2 cannot change tier2CanEdit\n } else if (tier === 1) {\n // Tier 1 can do everything\n if (typeof body.text === \"string\") config.announcement.text = body.text;\n if (typeof body.tier2CanEdit === \"boolean\") {\n config.announcement.tier2CanEdit = body.tier2CanEdit;\n }\n } else {\n return jsonResponse({ error: \"Tier 3 cannot edit announcements\" }, 403);\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, announcement: config.announcement });\n}\n\n// ─── Nuclear: Tier 1 full reset ─────────────────────────────\n\nasync function handleNuclear(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n authSecret?: string;\n };\n const password = (body.password || \"\").trim();\n const authSecret = (body.authSecret || \"\").trim();\n\n // Require BOTH password AND auth secret for nuclear option\n const expectedSecret = getEnv(\"AUTH_SECRET\");\n if (!expectedSecret || authSecret !== expectedSecret) {\n return jsonResponse(\n { error: \"Auth secret required for nuclear option\" },\n 403,\n );\n }\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Nuclear: invalidate all files, rotate keys concept\n config.minFileVersion = Date.now();\n // Clear all sessions — blocked IPs reset, per-game blocks reset\n config.blockedIps = {};\n config.perGameBlockedIps = {};\n // Force new password requirement\n config.nuclearAt = new Date().toISOString();\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n message:\n \"Nuclear activated. All current secure files invalidated. Regenerate files with new keys to restore access.\",\n minFileVersion: config.minFileVersion,\n nuclearAt: config.nuclearAt,\n });\n}\n\n// ─── GitHub API helpers ──────────────────────────────────────\n\nasync function fetchConfig(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/config.json?t=${Date.now()}`;\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!resp.ok) return null;\n return resp.json();\n}\n\nasync function writeConfigToGitHub(config: any): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) throw new Error(\"GITHUB_REPO and GITHUB_PAT required\");\n\n // Get current file SHA\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/config.json`;\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n }\n\n // Write updated config\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(config, null, 2) + \"\\n\")),\n );\n const putResp = await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Update config via auth server\",\n content: content,\n sha: sha || undefined,\n }),\n });\n\n if (!putResp.ok) {\n const err = await putResp.text();\n throw new Error(\"GitHub write failed: \" + err);\n }\n}\n\n// ─── IP log helpers ───────────────────────────────────────────\n\nasync function fetchIpLog(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/ip-log.json?t=${Date.now()}`;\n try {\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n if (!resp.ok) return [];\n return resp.json();\n } catch {\n return [];\n }\n}\n\nasync function appendToIpLog(entry: IpLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/ip-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: IpLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log game access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Panel log helpers ────────────────────────────────────────\n\nasync function appendToPanelLog(entry: PanelLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/panel-access-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: PanelLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log panel access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────\n\nfunction getEnv(key: string): string {\n return (Deno.env.get(key) || \"\").trim();\n}\n\nfunction getGameKeys(): Record {\n try {\n return JSON.parse(getEnv(\"GAME_KEYS_JSON\"));\n } catch {\n return {};\n }\n}\n\nfunction normalizeGameId(value: string): string {\n let normalized = value.trim().toLowerCase();\n if (!normalized) return \"\";\n normalized = normalized.replace(/\\.html$/i, \"\");\n normalized = normalized.replace(/eaglrcraft/g, \"eaglercraft\");\n normalized = normalized.replace(/open[-\\s]*in[-\\s]*new[-\\s]*tab/g, \" \");\n normalized = normalized.replace(\n /-(regular|locked|locked-b64|secure|base)/g,\n \" \",\n );\n normalized = normalized.replace(/[-_\\s]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n return normalized;\n}\n\nfunction normalizePasswordList(config: any): string[] {\n if (!config) return [];\n const passwords: string[] = [];\n if (config.password) passwords.push(config.password.trim());\n if (Array.isArray(config.passwords)) {\n config.passwords.forEach((p: string) => {\n const trimmed = (p || \"\").trim();\n if (trimmed && !passwords.includes(trimmed)) passwords.push(trimmed);\n });\n }\n return passwords;\n}\n\nfunction normalizeAllowedIps(raw: any): Record {\n if (!raw || typeof raw !== \"object\") return {};\n const result: Record = {};\n Object.keys(raw).forEach((ip) => {\n const trimmed = ip.trim();\n if (trimmed) result[trimmed] = raw[ip];\n });\n return result;\n}\n\nfunction jsonResponse(data: any, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n });\n}","pythoncoderauth",[158],"pulls","branches",1,"forks","envVars",{"_174":176,"_177":63},"connections",{"_174":63,"_175":63},"count","unfilledCount",4,"emptyCount",{"_42":157,"_32":158,"_30":159,"_136":-5,"_40":41,"_39":160,"_138":59,"_37":192,"_13":162,"_33":141,"_35":163,"_23":24,"_143":164,"_183":193,"_26":194},{"_42":149,"_32":150,"_30":57,"_136":-5,"_40":41,"_39":151,"_138":59,"_37":189,"_13":153,"_33":141,"_35":154,"_23":24,"_143":155,"_183":190,"_26":191},{"_42":146,"_32":27,"_30":31,"_136":-5,"_40":41,"_39":14,"_138":24,"_37":186,"_13":63,"_33":34,"_35":36,"_23":24,"_143":-5,"_183":187,"_26":188},{"_42":133,"_32":134,"_30":135,"_136":-5,"_40":41,"_39":137,"_138":59,"_37":182,"_13":140,"_33":141,"_35":142,"_23":24,"_143":144,"_183":184,"_26":185},["D",1776730323901],"children",[],[134],["D",1778373423107],[],[27],["D",1776730451940],[],[150],["D",1776730335772],[],[158],["D",1775514622169],["D",1789538451310],{"_100":99,"_107":103},{"_100":99,"_101":-5,"_102":103,"_18":55,"_104":105,"_106":24},{"_13":89,"_32":90,"_42":41,"_91":43,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":44,"_98":99},"ctx",{"_82":-5,"_126":233,"_234":235,"_236":237,"_238":24,"_239":24,"_240":24,"_241":59,"_242":-5,"_243":-7,"_244":-7,"_245":63,"_246":24,"_247":24,"_248":-5,"_249":24,"_250":24,"_251":24,"_252":-5},"ENV",{"_204":205,"_206":207,"_208":90,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v29