[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_200":201,"_202":203},"routes/_app.x.$handle.$name",{"_100":99,"_32":45,"_108":90,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":60,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":55,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",33,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","wisp.ts","latestPath","fileId","5d21a10c-4c08-11f1-a553-ee650bb23af1","name","fileType","http","content","// Val Town wisp server.\n//\n// Deploy as an HTTP val. Returns a 200 page on plain GET; on WebSocket\n// upgrade it routes the connection through the wisp protocol implementation\n// from @mercuryworkshop/wisp-js (the same protocol Galaxy / Lunar / Scramjet\n// expect).\n//\n// Why Val Town: val.run domains are reachable on your school network\n// per Unblock Games CDN-tester results, and the free tier is permanent\n// (no trial, no credit card). The wisp protocol multiplexes TCP/UDP\n// streams over a single WebSocket, so the client (browser) never makes\n// outbound connections itself — every fetch the proxy issues comes from\n// THIS val, satisfying your \"any access to anura.pro is from the place\n// running wisp\" requirement (anura.pro can be left out entirely).\n//\n// Once deployed you'll have a URL like:\n// https://USERNAME-wispval.web.val.run/\n// Use the wss:// form when configuring clients:\n// wss://USERNAME-wispval.web.val.run/\n//\n// Caveats Val Town imposes that you should know before relying on this:\n// - HTTP val timeouts: free tier requests are capped at ~60s. WebSocket\n// connections aren't HTTP requests in the usual sense, but if Val Town\n// enforces the cap on the upgrade response or the duration of the WS,\n// you'll get periodic disconnects. bare-mux reconnects automatically,\n// so browsing usually still works — pages just need a moment to recover\n// when a long-running stream gets killed.\n// - Outbound TCP: Val Town runs Deno with most node compat enabled.\n// Deno.connect() / node:net Socket should work to public IPs, but if\n// Val Town's sandbox blocks raw TCP the streams will fail with\n// \"NetworkError\" (close_reason 3). In that case fall back to Render\n// free tier (see docs/Wisp-Hosting-Free.md).\n// - UDP streams (close_reason \"InvalidInfo\" if blocked): node:dgram may\n// not be allowed. Most browsers can fall back to TCP-only, so this is\n// usually fine — just won't work for QUIC/HTTP3 sites.\n\nimport { ServerConnection } from \"npm:@mercuryworkshop/wisp-js@^0.3/server\";\n\n// Optional: allowlist hosts. Leave null to allow anything.\n// import { options } from \"npm:@mercuryworkshop/wisp-js@^0.3/server\";\n// options.hostname_blacklist = [/example\\.com/];\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // WebSocket upgrade → wisp connection\n if (req.headers.get(\"upgrade\")?.toLowerCase() === \"websocket\") {\n const { socket, response } = Deno.upgradeWebSocket(req);\n socket.binaryType = \"arraybuffer\";\n\n // wisp-js expects path to end in \"/\" for a wisp connection (vs wsproxy)\n const path = url.pathname.endsWith(\"/\") ? url.pathname : url.pathname + \"/\";\n\n socket.addEventListener(\"open\", async () => {\n try {\n const conn = new ServerConnection(socket, path, {});\n await conn.setup();\n await conn.run();\n } catch (e) {\n console.error(\"wisp connection error:\", e);\n try {\n socket.close();\n } catch {}\n }\n });\n\n socket.addEventListener(\"error\", (e) => {\n console.error(\"ws error:\", e);\n });\n\n return response;\n }\n\n // Plain GET: status page so you can sanity-check the deploy.\n return new Response(\n `Wisp endpoint\n\n

Wisp endpoint

This val is a wisp protocol server. Connect a wisp client (Galaxy,\nLunar, Scramjet, bare-mux) via WebSocket:

wss://${url.host}/

Plain HTTP GETs hit this status page. Logs go to the val's run log.

\n`,\n { status: 200, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}","// Val Town wisp server.\n//\n// Deploy as an HTTP val. Returns a 200 page on plain GET; on WebSocket\n// upgrade it routes the connection through the wisp protocol implementation\n// from @mercuryworkshop/wisp-js (the same protocol Galaxy / Lunar / Scramjet\n// expect).\n//\n// Why Val Town: val.run domains are reachable on your school network\n// per Unblock Games CDN-tester results, and the free tier is permanent\n// (no trial, no credit card). The wisp protocol multiplexes TCP/UDP\n// streams over a single WebSocket, so the client (browser) never makes\n// outbound connections itself — every fetch the proxy issues comes from\n// THIS val, satisfying your \"any access to anura.pro is from the place\n// running wisp\" requirement (anura.pro can be left out entirely).\n//\n// Once deployed you'll have a URL like:\n// https://USERNAME-wispval.web.val.run/\n// Use the wss:// form when configuring clients:\n// wss://USERNAME-wispval.web.val.run/\n//\n// Caveats Val Town imposes that you should know before relying on this:\n// - HTTP val timeouts: free tier requests are capped at ~60s. WebSocket\n// connections aren't HTTP requests in the usual sense, but if Val Town\n// enforces the cap on the upgrade response or the duration of the WS,\n// you'll get periodic disconnects. bare-mux reconnects automatically,\n// so browsing usually still works — pages just need a moment to recover\n// when a long-running stream gets killed.\n// - Outbound TCP: Val Town runs Deno with most node compat enabled.\n// Deno.connect() / node:net Socket should work to public IPs, but if\n// Val Town's sandbox blocks raw TCP the streams will fail with\n// \"NetworkError\" (close_reason 3). In that case fall back to Render\n// free tier (see docs/Wisp-Hosting-Free.md).\n// - UDP streams (close_reason \"InvalidInfo\" if blocked): node:dgram may\n// not be allowed. Most browsers can fall back to TCP-only, so this is\n// usually fine — just won't work for QUIC/HTTP3 sites.\n\n// wisp-js's \"/server\" entrypoint re-exports as a `server` namespace\n// (export * as server from \"../server/index.mjs\"), not as named exports —\n// `import { ServerConnection }` fails. Pull the namespace and reach in.\nimport { server } from \"npm:@mercuryworkshop/wisp-js@^0.3/server\";\nconst { ServerConnection, options } = server;\n\n// Optional: allowlist hosts. Leave null to allow anything.\n// options.hostname_blacklist = [/example\\.com/];\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // WebSocket upgrade → wisp connection\n if (req.headers.get(\"upgrade\")?.toLowerCase() === \"websocket\") {\n const { socket, response } = Deno.upgradeWebSocket(req);\n socket.binaryType = \"arraybuffer\";\n\n // wisp-js expects path to end in \"/\" for a wisp connection (vs wsproxy)\n const path = url.pathname.endsWith(\"/\") ? url.pathname : url.pathname + \"/\";\n\n socket.addEventListener(\"open\", async () => {\n try {\n const conn = new ServerConnection(socket, path, {});\n await conn.setup();\n await conn.run();\n } catch (e) {\n console.error(\"wisp connection error:\", e);\n try {\n socket.close();\n } catch {}\n }\n });\n\n socket.addEventListener(\"error\", (e) => {\n console.error(\"ws error:\", e);\n });\n\n return response;\n }\n\n // Plain GET: status page so you can sanity-check the deploy.\n return new Response(\n `Wisp endpoint\n\n

Wisp endpoint

This val is a wisp protocol server. Connect a wisp client (Galaxy,\nLunar, Scramjet, bare-mux) via WebSocket:

wss://${url.host}/

Plain HTTP GETs hit this status page. Logs go to the val's run log.

\n`,\n { status: 200, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}","createdAt",["D",1778431317838],"branchVersion","branchId","32fceb1c-3208-11f1-8a4a-42dde27851f2","id","32fc1ab6-3208-11f1-8a4a-42dde27851f2","study-resources",["D",1775514622169],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Helps me study (I love Wikipedia!)","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/c1d6fc2c-ffb0-47e2-10ae-a4fdf1ff0000/square512?exp=1789556399&sig=ea37e9fc199573a341f327d06f8e45ec4bbf2458c32b25992250a54a3f1c4bac","019d275b-d06b-734f-8e50-762c85009c4d","pinnedFileId","f92f31dc-3d16-11f1-89e2-42b51c65c3df","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019d275b-d06b-734f-8e50-7b6137063a35","tursoName","32fc1ab6320811f18a4a42dde27851f2","tursoHostname","32fc1ab6320811f18a4a42dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789538451310],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_107":103},"org",{"_100":99,"_101":-5,"_102":103,"_18":56,"_104":105,"_106":25},"branch",{"_13":14,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pycoder42","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zQlNVQUVMTkx3QmljWDhIOVVPZjIwbVRSYjkifQ","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":195,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":55,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":196,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":197,"_85":198,"_87":199,"_89":25},"tree",[178,179,180,181],"files",[178,179,180,181],"counts",{"_167":64,"_168":169,"_170":64,"_171":172,"_173":174},"contents",[130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":158,"_32":159,"_30":160,"_135":-5,"_41":42,"_40":161,"_136":60,"_38":162,"_13":163,"_33":34,"_35":164,"_24":25,"_139":165,"_27":166},{"_43":150,"_32":151,"_30":58,"_135":-5,"_41":42,"_40":152,"_136":60,"_38":153,"_13":154,"_33":34,"_35":155,"_24":25,"_139":156,"_27":157},{"_43":141,"_32":142,"_30":143,"_135":-5,"_41":42,"_40":144,"_136":60,"_38":145,"_13":146,"_33":34,"_35":147,"_24":25,"_139":148,"_27":149},{"_43":134,"_32":28,"_30":31,"_135":-5,"_41":42,"_40":14,"_136":60,"_38":137,"_13":138,"_33":34,"_35":37,"_24":25,"_139":-5,"_27":140},"2915b826-4c8f-11f1-ae1a-ee650bb23af1","parentId","latest",["D",1778431317838],4,"label",[28],"b9b245e4-3d16-11f1-8261-42b51c65c3df","proxy.ts","0ba6467c-32d9-11f1-8e75-42b51c65c3df",23,["D",1776730323901],10,"// Val Town HTTP Proxy — Pure API\n// Deploy: paste this entire file into a new Val Town HTTP val\n// Your proxy URL will be: https://USERNAME-VALNAME.web.val.run\n//\n// Usage:\n// GET /https://example.com → proxied page (HTML rewritten, assets resolved)\n// GET / → 200 JSON { ok: true } (health check)\n// OPTIONS /* → CORS preflight\n\nconst REWRITABLE_TYPES = [\n \"text/html\",\n \"text/css\",\n \"application/javascript\",\n \"text/javascript\",\n];\n\nexport default async function server(request: Request): Promise {\n const url = new URL(request.url);\n const workerOrigin = url.origin;\n\n // CORS preflight\n if (request.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\":\n \"GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n request.headers.get(\"Access-Control-Request-Headers\") || \"*\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n const targetUrl = extractTargetUrl(url.pathname, url.search);\n\n // Health check — no landing page\n if (!targetUrl) {\n return new Response(JSON.stringify({ ok: true }), {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n\n try {\n new URL(targetUrl);\n } catch {\n return new Response(\"Invalid URL: \" + targetUrl, { status: 400 });\n }\n\n try {\n let currentUrl = targetUrl;\n let targetResponse: Response;\n let redirectCount = 0;\n const MAX_REDIRECTS = 10;\n\n const upstreamHeaders: Record = {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\",\n \"Accept\": request.headers.get(\"Accept\") || \"*/*\",\n \"Accept-Language\": \"en-US,en;q=0.9\",\n };\n\n const cookie = request.headers.get(\"Cookie\");\n if (cookie) upstreamHeaders[\"Cookie\"] = cookie;\n\n const ct = request.headers.get(\"Content-Type\");\n if (ct) upstreamHeaders[\"Content-Type\"] = ct;\n\n let requestBody: ArrayBuffer | null = null;\n if (request.method !== \"GET\" && request.method !== \"HEAD\") {\n requestBody = await request.arrayBuffer();\n }\n\n while (true) {\n upstreamHeaders[\"Referer\"] = currentUrl;\n const fetchOpts: RequestInit = {\n method: request.method,\n headers: upstreamHeaders,\n redirect: \"manual\",\n };\n if (\n requestBody && request.method !== \"GET\" && request.method !== \"HEAD\"\n ) {\n fetchOpts.body = requestBody;\n }\n\n targetResponse = await fetch(currentUrl, fetchOpts);\n\n if (targetResponse.status >= 300 && targetResponse.status < 400) {\n const location = targetResponse.headers.get(\"Location\");\n if (!location || ++redirectCount > MAX_REDIRECTS) break;\n try {\n currentUrl = new URL(location, currentUrl).href;\n } catch {\n break;\n }\n requestBody = null;\n continue;\n }\n break;\n }\n\n const finalUrl = currentUrl;\n const contentType = targetResponse!.headers.get(\"Content-Type\") || \"\";\n const shouldRewrite = REWRITABLE_TYPES.some((t) => contentType.includes(t));\n const respHeaders = buildHeaders(contentType, targetResponse!);\n\n if (shouldRewrite && contentType.includes(\"text/html\")) {\n let html = await targetResponse!.text();\n html = rewriteMetaRefresh(html, finalUrl, workerOrigin);\n html = rewriteHtml(html, finalUrl, workerOrigin);\n return new Response(html, {\n status: targetResponse!.status,\n headers: respHeaders,\n });\n }\n\n if (shouldRewrite) {\n let text = await targetResponse!.text();\n text = rewriteAssetUrls(text, finalUrl, workerOrigin);\n return new Response(text, {\n status: targetResponse!.status,\n headers: respHeaders,\n });\n }\n\n return new Response(targetResponse!.body, {\n status: targetResponse!.status,\n headers: respHeaders,\n });\n } catch (err: any) {\n return new Response(\"Proxy error: \" + err.message, { status: 502 });\n }\n}\n\nfunction extractTargetUrl(pathname: string, search: string): string | null {\n let path = pathname;\n if (path.startsWith(\"/browse/\")) path = \"/\" + path.slice(8);\n path = path.slice(1);\n if (!path || (!path.startsWith(\"http://\") && !path.startsWith(\"https://\"))) {\n return null;\n }\n return path + (search || \"\");\n}\n\nfunction rewriteMetaRefresh(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n return html.replace(\n /(]*>)/gi,\n (_match, prefix, delay, rawUrl, suffix) => {\n return prefix + delay +\n resolveAndProxy(rawUrl.trim(), targetBase, workerOrigin) + suffix;\n },\n );\n}\n\nfunction rewriteHtml(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n\n // Rewrite HTML attributes with URLs\n html = html.replace(\n /((?:href|src|action|poster|data-src)\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, rawUrl, suffix) =>\n prefix + resolveAndProxy(rawUrl, targetBase, workerOrigin) + suffix,\n );\n\n html = html.replace(\n /(srcset\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, srcset, suffix) => {\n const rewritten = srcset.split(\",\").map((entry: string) => {\n const parts = entry.trim().split(/\\s+/);\n if (parts.length >= 1) {\n parts[0] = resolveAndProxy(parts[0], targetBase, workerOrigin);\n }\n return parts.join(\" \");\n }).join(\", \");\n return prefix + rewritten + suffix;\n },\n );\n\n // Rewrite CSS url() references\n html = html.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n\n // Base href for relative URL resolution\n const basePath = targetBase.pathname.replace(/[^/]*$/, \"\");\n const baseTag =\n ``;\n html = html.replace(/]*>/gi, \"\");\n html = html.replace(/]*>/i, (m) => m + baseTag);\n\n // Navigation interceptor: window.open, location, fetch, XHR, WebSocket\n const navInterceptor =\n ``;\n html = html.replace(/]*>/i, (m) => m + navInterceptor);\n\n // No URL bar, no landing page UI — this is a pure proxy API\n\n return html;\n}\n\nfunction resolveAndProxy(\n rawUrl: string,\n targetBase: URL,\n workerOrigin: string,\n): string {\n if (\n !rawUrl || rawUrl.startsWith(\"data:\") || rawUrl.startsWith(\"#\") ||\n rawUrl.startsWith(\"javascript:\") || rawUrl.startsWith(\"mailto:\") ||\n rawUrl.startsWith(\"tel:\")\n ) return rawUrl;\n try {\n const resolved = new URL(rawUrl, targetBase);\n return workerOrigin + \"/\" + resolved.href;\n } catch {\n return rawUrl;\n }\n}\n\nfunction rewriteAssetUrls(\n text: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n text = text.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n text = text.replace(\n /@import\\s+[\"']([^\"']+)[\"']/gi,\n (_match, rawUrl) =>\n `@import \"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\"`,\n );\n return text;\n}\n\nconst STRIP_HEADERS = new Set([\n \"content-security-policy\",\n \"content-security-policy-report-only\",\n \"x-frame-options\",\n \"x-content-type-options\",\n \"strict-transport-security\",\n \"permissions-policy\",\n \"cross-origin-opener-policy\",\n \"cross-origin-embedder-policy\",\n \"cross-origin-resource-policy\",\n]);\n\nfunction buildHeaders(contentType: string, targetResponse: Response): Headers {\n const headers = new Headers();\n headers.set(\"Content-Type\", contentType);\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\n headers.set(\"Access-Control-Expose-Headers\", \"*\");\n\n const cc = targetResponse.headers.get(\"Cache-Control\");\n if (cc) headers.set(\"Cache-Control\", cc);\n\n targetResponse.headers.forEach((value, key) => {\n if (key.toLowerCase() === \"set-cookie\") {\n const cleaned = value\n .replace(/;\\s*domain=[^;]*/gi, \"\")\n .replace(/;\\s*secure/gi, \"\")\n .replace(/;\\s*samesite=[^;]*/gi, \"; SameSite=Lax\");\n headers.append(\"Set-Cookie\", cleaned);\n }\n });\n\n return headers;\n}","aab",[142],"0602c00e-3d17-11f1-b3e8-42b51c65c3df","browser-thingy.ts",28,["D",1776730451940],3,"// Val Town HTTP Proxy\n// Deploy: paste this entire file into a new Val Town HTTP val\n// Your proxy URL will be: https://USERNAME-VALNAME.web.val.run\n//\n// Usage:\n// https://USERNAME-VALNAME.web.val.run/ → landing page\n// https://USERNAME-VALNAME.web.val.run/https://example.com → proxied page\n\nconst FEATURED_SITES = [\n { name: \"Wikipedia\", url: \"https://en.wikipedia.org\", icon: \"\\u{1F4DA}\" },\n {\n name: \"Pokemon Showdown\",\n url: \"https://play.pokemonshowdown.com\",\n icon: \"\\u26A1\",\n },\n { name: \"GN Math\", url: \"https://gn-math.github.io\", icon: \"\\u{1F522}\" },\n {\n name: \"Cool Math Games\",\n url: \"https://www.coolmathgames.com\",\n icon: \"\\u{1F3B2}\",\n },\n { name: \"Smash Karts\", url: \"https://smashkarts.io\", icon: \"\\u{1F3CE}\" },\n];\n\nconst REWRITABLE_TYPES = [\n \"text/html\",\n \"text/css\",\n \"application/javascript\",\n \"text/javascript\",\n];\n\nexport default async function server(request: Request): Promise {\n const url = new URL(request.url);\n const workerOrigin = url.origin;\n\n let targetUrl = extractTargetUrl(url.pathname, url.search);\n\n if (!targetUrl) {\n return new Response(landingPage(workerOrigin), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n try {\n new URL(targetUrl);\n } catch {\n return new Response(\"Invalid URL: \" + targetUrl, { status: 400 });\n }\n\n try {\n // Follow redirects manually so we can track the final URL\n let currentUrl = targetUrl;\n let targetResponse: Response;\n let redirectCount = 0;\n const MAX_REDIRECTS = 10;\n\n while (true) {\n targetResponse = await fetch(currentUrl, {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\",\n \"Accept\": request.headers.get(\"Accept\") || \"*/*\",\n \"Accept-Language\": \"en-US,en;q=0.9\",\n \"Referer\": currentUrl,\n },\n redirect: \"manual\",\n });\n\n // Follow 3xx redirects server-side\n if (targetResponse.status >= 300 && targetResponse.status < 400) {\n const location = targetResponse.headers.get(\"Location\");\n if (!location || ++redirectCount > MAX_REDIRECTS) break;\n try {\n currentUrl = new URL(location, currentUrl).href;\n } catch {\n break;\n }\n continue;\n }\n break;\n }\n\n // Use the final URL (after redirects) for resolving relative paths\n const finalUrl = currentUrl;\n\n const contentType = targetResponse!.headers.get(\"Content-Type\") || \"\";\n const shouldRewrite = REWRITABLE_TYPES.some((t) => contentType.includes(t));\n\n if (shouldRewrite && contentType.includes(\"text/html\")) {\n let html = await targetResponse!.text();\n // Rewrite meta refresh redirects to stay in proxy\n html = rewriteMetaRefresh(html, finalUrl, workerOrigin);\n html = rewriteHtml(html, finalUrl, workerOrigin);\n return new Response(html, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n }\n\n if (shouldRewrite) {\n let text = await targetResponse!.text();\n text = rewriteAssetUrls(text, finalUrl, workerOrigin);\n return new Response(text, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n }\n\n return new Response(targetResponse!.body, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n } catch (err: any) {\n return new Response(\"Proxy error: \" + err.message, { status: 502 });\n }\n}\n\nfunction extractTargetUrl(pathname: string, search: string): string | null {\n let path = pathname;\n if (path.startsWith(\"/browse/\")) path = \"/\" + path.slice(8);\n path = path.slice(1);\n if (!path || (!path.startsWith(\"http://\") && !path.startsWith(\"https://\"))) {\n return null;\n }\n return path + (search || \"\");\n}\n\nfunction rewriteMetaRefresh(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n // Rewrite to stay in proxy\n return html.replace(\n /(]*>)/gi,\n (_match, prefix, delay, rawUrl, suffix) => {\n return prefix + delay +\n resolveAndProxy(rawUrl.trim(), targetBase, workerOrigin) + suffix;\n },\n );\n}\n\nfunction rewriteHtml(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n\n html = html.replace(\n /((?:href|src|action|poster|data-src)\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, rawUrl, suffix) =>\n prefix + resolveAndProxy(rawUrl, targetBase, workerOrigin) + suffix,\n );\n\n html = html.replace(\n /(srcset\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, srcset, suffix) => {\n const rewritten = srcset.split(\",\").map((entry: string) => {\n const parts = entry.trim().split(/\\s+/);\n if (parts.length >= 1) {\n parts[0] = resolveAndProxy(parts[0], targetBase, workerOrigin);\n }\n return parts.join(\" \");\n }).join(\", \");\n return prefix + rewritten + suffix;\n },\n );\n\n html = html.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n\n const baseTag = ``;\n html = html.replace(/]*>/i, (m) => m + baseTag);\n\n // Inject navigation interceptor: window.open, location, fetch, XHR, location.href\n const navInterceptor =\n ``;\n html = html.replace(/]*>/i, (m) => m + navInterceptor);\n\n // Inject minimizable URL bar banner\n const currentPageUrl = targetBase.href;\n const urlBar =\n `

`;\n html = html.replace(/]*>/i, (m) => m + urlBar);\n\n return html;\n}\n\nfunction resolveAndProxy(\n rawUrl: string,\n targetBase: URL,\n workerOrigin: string,\n): string {\n if (\n !rawUrl || rawUrl.startsWith(\"data:\") || rawUrl.startsWith(\"#\") ||\n rawUrl.startsWith(\"javascript:\") || rawUrl.startsWith(\"mailto:\") ||\n rawUrl.startsWith(\"tel:\")\n ) return rawUrl;\n try {\n const resolved = new URL(rawUrl, targetBase);\n return workerOrigin + \"/\" + resolved.href;\n } catch {\n return rawUrl;\n }\n}\n\nfunction rewriteAssetUrls(\n text: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n return text.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n}\n\nfunction buildHeaders(contentType: string): Headers {\n const headers = new Headers();\n headers.set(\"Content-Type\", contentType);\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\n return headers;\n}\n\nfunction landingPage(workerOrigin: string): string {\n const links = FEATURED_SITES.map((s) =>\n `${s.icon} ${s.name}`\n ).join(\"\\n \");\n\n return `\n\n\n \n \n Web Proxy\n \n\n\n

Web Proxy

Enter a URL to browse through this proxy

\n \n

\n ${links}\n

\n\n`;\n}","quizlet",[151],"c0c4f87c-3d16-11f1-a24c-42b51c65c3df","auth.ts","330273ca-3208-11f1-8a4a-42dde27851f2",24,["D",1776730335772],12,"// Val Town Game Auth Server\n//\n// This is the security backbone. It stores all secrets server-side.\n// The secure HTML files contain NOTHING sensitive — no repo URLs,\n// no encryption keys, no config URLs. Just a password prompt and\n// this endpoint's URL.\n//\n// Deploy: Paste into a new Val Town HTTP val.\n// Then set these environment variables in Val Town:\n// GITHUB_PAT — GitHub personal access token (repo read/write)\n// GITHUB_REPO — e.g. \"username/repo-name\"\n// GAME_KEYS_JSON — JSON: { \"drive-mad\": \"hex-key\", \"mr-mine\": \"hex-key\", ... }\n// (copy from .game-keys file)\n// AUTH_SECRET — A password for admin panel access (optional extra layer)\n//\n// Endpoints:\n// POST /auth — Authenticate a game session\n// GET /config — Read config (admin panel)\n// POST /config — Write config (admin panel)\n// POST /block-all — Invalidate all current file versions\n// POST /block-ip — Block an IP address (globally)\n// POST /unblock-ip — Remove a global IP block\n// POST /block-ip-game — Block an IP for a specific game only\n// POST /unblock-ip-game — Remove a per-game IP block\n// POST /allow-ip-game — Allow an IP for a specific game (overrides global blocklist)\n// POST /unallow-ip-game — Remove a per-game IP allow\n// GET /ip-log — Read the IP access log (requires x-auth-secret header)\n// POST /visit — Log a game page visit (no auth required, fire-and-forget)\n// POST /track — Log a panel access beacon (no auth required)\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, x-auth-secret\",\n};\n\n// ─── Types ───────────────────────────────────────────────────\n\ntype IpLogEntry = {\n ip: string;\n gameId: string;\n at: string;\n type?: \"auth\" | \"visit\";\n};\ntype PanelLogEntry = { p: string; r: string; ts: number; at: string };\n\n// ─── Rate Limiter (in-memory, resets on cold start) ──────────\n// 5 failed password attempts in 5 minutes → 429 for 15 minutes\n\nconst RATE_LIMIT_WINDOW = 5 * 60 * 1000; // 5 minutes\nconst RATE_LIMIT_MAX = 5; // max failures in window\nconst RATE_LIMIT_BLOCK = 15 * 60 * 1000; // 15-minute lockout\n\ntype RateLimitEntry = { failures: number[]; blockedUntil: number };\nconst rateLimitMap = new Map();\n\nfunction checkRateLimit(ip: string): { blocked: boolean; retryAfter?: number } {\n if (!ip) return { blocked: false };\n\n const now = Date.now();\n const entry = rateLimitMap.get(ip);\n\n if (entry) {\n // Currently blocked?\n if (entry.blockedUntil > now) {\n return {\n blocked: true,\n retryAfter: Math.ceil((entry.blockedUntil - now) / 1000),\n };\n }\n // Prune old failures outside the window\n entry.failures = entry.failures.filter((t) => now - t < RATE_LIMIT_WINDOW);\n }\n\n return { blocked: false };\n}\n\nfunction recordFailure(ip: string): void {\n if (!ip) return;\n\n const now = Date.now();\n let entry = rateLimitMap.get(ip);\n\n if (!entry) {\n entry = { failures: [], blockedUntil: 0 };\n rateLimitMap.set(ip, entry);\n }\n\n // Prune old failures\n entry.failures = entry.failures.filter((t) => now - t < RATE_LIMIT_WINDOW);\n entry.failures.push(now);\n\n // Trigger lockout if threshold reached\n if (entry.failures.length >= RATE_LIMIT_MAX) {\n entry.blockedUntil = now + RATE_LIMIT_BLOCK;\n entry.failures = []; // reset counter for after lockout\n }\n\n // Housekeeping: prune stale IPs every 100 calls\n if (rateLimitMap.size > 500) {\n for (const [key, val] of rateLimitMap) {\n if (val.blockedUntil < now && val.failures.length === 0) {\n rateLimitMap.delete(key);\n }\n }\n }\n}\n\nexport default async function server(request: Request): Promise {\n if (request.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n\n const url = new URL(request.url);\n const path = url.pathname;\n\n try {\n if (path === \"/auth\" && request.method === \"POST\") {\n return handleAuth(request);\n }\n if (path === \"/config\" && request.method === \"GET\") {\n return handleReadConfig(request);\n }\n if (path === \"/config\" && request.method === \"POST\") {\n return handleWriteConfig(request);\n }\n if (path === \"/block-all\" && request.method === \"POST\") {\n return handleBlockAll(request);\n }\n if (path === \"/block-ip\" && request.method === \"POST\") {\n return handleBlockIp(request);\n }\n if (path === \"/unblock-ip\" && request.method === \"POST\") {\n return handleUnblockIp(request);\n }\n if (path === \"/block-ip-game\" && request.method === \"POST\") {\n return handleBlockIpGame(request);\n }\n if (path === \"/unblock-ip-game\" && request.method === \"POST\") {\n return handleUnblockIpGame(request);\n }\n if (path === \"/allow-ip-game\" && request.method === \"POST\") {\n return handleAllowIpGame(request);\n }\n if (path === \"/unallow-ip-game\" && request.method === \"POST\") {\n return handleUnallowIpGame(request);\n }\n if (path === \"/ip-log\" && request.method === \"GET\") {\n return handleReadIpLog(request);\n }\n if (path === \"/visit\" && request.method === \"POST\") {\n return handleVisit(request);\n }\n if (path === \"/track\" && request.method === \"POST\") {\n return handleTrack(request);\n }\n if (path === \"/proxy-url\" && request.method === \"GET\") {\n return handleProxyUrl();\n }\n if (path === \"/proxy-url\" && request.method === \"POST\") {\n return handleSetProxyUrl(request);\n }\n if (path === \"/announcement\" && request.method === \"GET\") {\n return handleGetAnnouncement();\n }\n if (path === \"/announcement\" && request.method === \"POST\") {\n return handleSetAnnouncement(request);\n }\n if (path === \"/nuclear\" && request.method === \"POST\") {\n return handleNuclear(request);\n }\n return jsonResponse({ error: \"not_found\" }, 404);\n } catch (err: any) {\n return jsonResponse({ error: \"server_error\", message: err.message }, 500);\n }\n}\n\n// ─── Auth: The core endpoint ─────────────────────────────────\n// Called by secure HTML files when user enters password.\n// Returns encrypted game data + key if approved.\n// Returns error if denied. No secrets leak on denial.\n\nasync function handleAuth(request: Request): Promise {\n const body = await request.json() as {\n gameId?: string;\n password?: string;\n ip?: string;\n fileVersion?: number;\n };\n\n const gameId = normalizeGameId(body.gameId || \"\");\n const password = (body.password || \"\").trim();\n const clientIp = (body.ip || \"\").trim();\n const fileVersion = body.fileVersion || 0;\n\n // Rate limit check (before any expensive work)\n const rateCheck = checkRateLimit(clientIp);\n if (rateCheck.blocked) {\n return jsonResponse(\n { error: \"denied\", reason: \"Too many attempts. Try again later.\" },\n 429,\n );\n }\n\n if (!gameId) {\n return jsonResponse({ error: \"denied\", reason: \"Invalid game ID\" });\n }\n if (!password) {\n return jsonResponse({ error: \"denied\", reason: \"No password\" });\n }\n\n // Fetch current config from GitHub\n const config = await fetchConfig();\n if (!config) {\n return jsonResponse({ error: \"denied\", reason: \"Config unavailable\" });\n }\n\n // Check password\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n recordFailure(clientIp);\n return jsonResponse({ error: \"denied\", reason: \"Wrong password\" });\n }\n\n // ── IP override logic ──────────────────────────────────────\n // Per-game IP rules override global rules:\n // perGameAllowedIps set → those IPs + global allowedIps are OK; global blockedIps ignored\n // perGameBlockedIps set → those IPs + global blockedIps are blocked; global allowedIps ignored\n // Neither set → fall back to global allowedIps/blockedIps as normal\n\n const globalAllowed = normalizeAllowedIps(config.allowedIps);\n const globalBlocked = config.blockedIps || {};\n const perGameAllowed = (config.perGameAllowedIps || {})[gameId] || {};\n const perGameBlocked = (config.perGameBlockedIps || {})[gameId] || {};\n const hasPerGameAllow = Object.keys(perGameAllowed).length > 0;\n const hasPerGameBlock = Object.keys(perGameBlocked).length > 0;\n\n if (clientIp) {\n if (hasPerGameAllow) {\n // Per-game allow mode: only per-game allowed + global allowed can access\n // Global blocklist is overridden (ignored)\n if (!perGameAllowed[clientIp] && !globalAllowed[clientIp]) {\n return jsonResponse({\n error: \"denied\",\n reason: \"IP not allowed for this game\",\n });\n }\n } else if (hasPerGameBlock) {\n // Per-game block mode: per-game blocked + global blocked are denied\n // Global allowlist is overridden (ignored)\n if (perGameBlocked[clientIp] || globalBlocked[clientIp]) {\n return jsonResponse({\n error: \"denied\",\n reason: \"IP is blocked for this game\",\n });\n }\n } else {\n // No per-game rules — use global lists normally\n if (globalBlocked[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"IP is blocked\" });\n }\n }\n }\n\n // Check if game is blocked\n const blocked = config.blocked || {};\n const blockVal = blocked[gameId];\n if (\n blockVal === true ||\n (typeof blockVal === \"string\" && new Date(blockVal) > new Date())\n ) {\n // Check if IP is in effective allow list (per-game or global depending on mode)\n const effectiveAllowed = hasPerGameAllow\n ? { ...globalAllowed, ...perGameAllowed }\n : globalAllowed;\n if (!clientIp || !effectiveAllowed[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"Game is blocked\" });\n }\n }\n\n // Check minimum file version (version invalidation)\n const minFileVersion = config.minFileVersion || 0;\n if (fileVersion > 0 && fileVersion < minFileVersion) {\n return jsonResponse({\n error: \"denied\",\n reason: \"Outdated version. Get the latest files.\",\n });\n }\n\n // All checks passed — return the game data + decryption key\n const gameKeys = getGameKeys();\n const gameKey = gameKeys[gameId];\n if (!gameKey) {\n return jsonResponse({ error: \"denied\", reason: \"Game not configured\" });\n }\n\n // Fetch encrypted game data from GitHub (server-side, client never sees repo URL)\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const gameDataUrl =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/game-data/${gameId}.enc.json`;\n\n const gameDataResp = await fetch(gameDataUrl, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!gameDataResp.ok) {\n return jsonResponse({ error: \"denied\", reason: \"Game data unavailable\" });\n }\n\n const gameData = await gameDataResp.json();\n\n // Fire-and-forget: log this access (don't await, don't fail auth if it errors)\n if (clientIp) {\n appendToIpLog({\n ip: clientIp,\n gameId,\n at: new Date().toISOString(),\n type: \"auth\",\n }).catch(() => {});\n }\n\n return jsonResponse({\n ok: true,\n gameData: gameData, // { iv, authTag, ciphertext }\n key: gameKey, // hex-encoded AES-256 key\n });\n}\n\n// ─── Config read/write (admin panel) ─────────────────────────\n\nasync function handleReadConfig(request: Request): Promise {\n const url = new URL(request.url);\n const password = url.searchParams.get(\"password\") || \"\";\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n return jsonResponse(config);\n}\n\nasync function handleWriteConfig(request: Request): Promise {\n const body = await request.json() as { password?: string; config?: any };\n const password = (body.password || \"\").trim();\n\n const currentConfig = await fetchConfig();\n if (!currentConfig) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(currentConfig);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n const newConfig = body.config;\n if (!newConfig || typeof newConfig !== \"object\") {\n return jsonResponse({ error: \"Invalid config\" }, 400);\n }\n\n await writeConfigToGitHub(newConfig);\n return jsonResponse({ ok: true });\n}\n\n// ─── Block all versions ──────────────────────────────────────\n\nasync function handleBlockAll(request: Request): Promise {\n const body = await request.json() as { password?: string };\n const password = (body.password || \"\").trim();\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Set minFileVersion to current timestamp — all older files are blocked\n config.minFileVersion = Date.now();\n await writeConfigToGitHub(config);\n\n return jsonResponse({\n ok: true,\n minFileVersion: config.minFileVersion,\n message:\n \"All current versions blocked. Regenerate files to create valid versions.\",\n });\n}\n\n// ─── Global IP blocking ──────────────────────────────────────\n\nasync function handleBlockIp(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.blockedIps) config.blockedIps = {};\n config.blockedIps[ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps });\n}\n\nasync function handleUnblockIp(request: Request): Promise {\n const body = await request.json() as { password?: string; ip?: string };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.blockedIps) {\n delete config.blockedIps[ip];\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps || {} });\n}\n\n// ─── Per-game IP blocking ─────────────────────────────────────\n\nasync function handleBlockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.perGameBlockedIps) config.perGameBlockedIps = {};\n if (!config.perGameBlockedIps[gameId]) config.perGameBlockedIps[gameId] = {};\n config.perGameBlockedIps[gameId][ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps,\n });\n}\n\nasync function handleUnblockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.perGameBlockedIps && config.perGameBlockedIps[gameId]) {\n delete config.perGameBlockedIps[gameId][ip];\n // Clean up empty game entry\n if (Object.keys(config.perGameBlockedIps[gameId]).length === 0) {\n delete config.perGameBlockedIps[gameId];\n }\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps || {},\n });\n}\n\n// ─── Per-game IP allowing ────────────────────────────────────────\n\nasync function handleAllowIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.perGameAllowedIps) config.perGameAllowedIps = {};\n if (!config.perGameAllowedIps[gameId]) config.perGameAllowedIps[gameId] = {};\n config.perGameAllowedIps[gameId][ip] = {\n label: label || ip,\n addedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameAllowedIps: config.perGameAllowedIps,\n });\n}\n\nasync function handleUnallowIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.perGameAllowedIps && config.perGameAllowedIps[gameId]) {\n delete config.perGameAllowedIps[gameId][ip];\n if (Object.keys(config.perGameAllowedIps[gameId]).length === 0) {\n delete config.perGameAllowedIps[gameId];\n }\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameAllowedIps: config.perGameAllowedIps || {},\n });\n}\n\n// ─── IP log read ──────────────────────────────────────────────\n\nasync function handleReadIpLog(request: Request): Promise {\n const secret = request.headers.get(\"x-auth-secret\") || \"\";\n const expectedSecret = getEnv(\"AUTH_SECRET\");\n if (!expectedSecret || secret !== expectedSecret) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n const log = await fetchIpLog();\n return jsonResponse({ ok: true, entries: log });\n}\n\n// ─── Game visit beacon (fires on page open, before auth) ─────\n\nasync function handleVisit(request: Request): Promise {\n // Fire-and-forget — always return 200, never fail the caller\n try {\n const body = await request.json() as { gameId?: string; ip?: string };\n const gameId = normalizeGameId(body.gameId || \"\");\n const ip = (body.ip || \"\").trim();\n if (gameId && ip) {\n appendToIpLog({ ip, gameId, at: new Date().toISOString(), type: \"visit\" })\n .catch(() => {});\n }\n } catch {\n // Ignore parse errors — always 200\n }\n return jsonResponse({ ok: true });\n}\n\n// ─── Panel access tracking beacon ─────────────────────────────\n\nasync function handleTrack(request: Request): Promise {\n // Fire-and-forget — always return 200, never fail the caller\n try {\n const body = await request.json() as {\n p?: string;\n r?: string;\n ts?: number;\n };\n const entry: PanelLogEntry = {\n p: (body.p || \"\").trim(),\n r: (body.r || \"\").trim(),\n ts: body.ts || 0,\n at: new Date().toISOString(),\n };\n appendToPanelLog(entry).catch(() => {});\n } catch {\n // Ignore parse errors — always 200\n }\n return jsonResponse({ ok: true });\n}\n\n// ─── Proxy URL (public, no auth — games call this) ──────────\n\nasync function handleProxyUrl(): Promise {\n const config = await fetchConfig();\n const proxyUrl = config?.proxyUrl || \"\";\n return jsonResponse({ proxyUrl });\n}\n\nasync function handleSetProxyUrl(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n proxyUrl?: string;\n tier?: number;\n };\n const password = (body.password || \"\").trim();\n const tier = body.tier || 3;\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Tier 2 and above can update proxy URL (it needs to be fast — school blocks in ~30min)\n if (tier > 2) {\n return jsonResponse({ error: \"Tier 3 cannot update proxy URL\" }, 403);\n }\n\n config.proxyUrl = (body.proxyUrl || \"\").trim();\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, proxyUrl: config.proxyUrl });\n}\n\n// ─── Announcements ──────────────────────────────────────────\n\nasync function handleGetAnnouncement(): Promise {\n const config = await fetchConfig();\n const ann = config?.announcement || { text: \"\", tier2CanEdit: false };\n return jsonResponse({\n text: ann.text || \"\",\n tier2CanEdit: !!ann.tier2CanEdit,\n });\n}\n\nasync function handleSetAnnouncement(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n text?: string;\n tier2CanEdit?: boolean;\n tier?: number;\n };\n const password = (body.password || \"\").trim();\n const tier = body.tier || 3;\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.announcement) {\n config.announcement = { text: \"\", tier2CanEdit: false };\n }\n\n // Tier 2 can only edit text, and only if tier1 allows it\n if (tier === 2) {\n if (!config.announcement.tier2CanEdit) {\n return jsonResponse({\n error: \"Tier 2 not authorized to edit announcements\",\n }, 403);\n }\n if (typeof body.text === \"string\") config.announcement.text = body.text;\n // Tier 2 cannot change tier2CanEdit\n } else if (tier === 1) {\n // Tier 1 can do everything\n if (typeof body.text === \"string\") config.announcement.text = body.text;\n if (typeof body.tier2CanEdit === \"boolean\") {\n config.announcement.tier2CanEdit = body.tier2CanEdit;\n }\n } else {\n return jsonResponse({ error: \"Tier 3 cannot edit announcements\" }, 403);\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, announcement: config.announcement });\n}\n\n// ─── Nuclear: Tier 1 full reset ─────────────────────────────\n\nasync function handleNuclear(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n authSecret?: string;\n };\n const password = (body.password || \"\").trim();\n const authSecret = (body.authSecret || \"\").trim();\n\n // Require BOTH password AND auth secret for nuclear option\n const expectedSecret = getEnv(\"AUTH_SECRET\");\n if (!expectedSecret || authSecret !== expectedSecret) {\n return jsonResponse(\n { error: \"Auth secret required for nuclear option\" },\n 403,\n );\n }\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Nuclear: invalidate all files, rotate keys concept\n config.minFileVersion = Date.now();\n // Clear all sessions — blocked IPs reset, per-game blocks reset\n config.blockedIps = {};\n config.perGameBlockedIps = {};\n // Force new password requirement\n config.nuclearAt = new Date().toISOString();\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n message:\n \"Nuclear activated. All current secure files invalidated. Regenerate files with new keys to restore access.\",\n minFileVersion: config.minFileVersion,\n nuclearAt: config.nuclearAt,\n });\n}\n\n// ─── GitHub API helpers ──────────────────────────────────────\n\nasync function fetchConfig(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/config.json?t=${Date.now()}`;\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!resp.ok) return null;\n return resp.json();\n}\n\nasync function writeConfigToGitHub(config: any): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) throw new Error(\"GITHUB_REPO and GITHUB_PAT required\");\n\n // Get current file SHA\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/config.json`;\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n }\n\n // Write updated config\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(config, null, 2) + \"\\n\")),\n );\n const putResp = await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Update config via auth server\",\n content: content,\n sha: sha || undefined,\n }),\n });\n\n if (!putResp.ok) {\n const err = await putResp.text();\n throw new Error(\"GitHub write failed: \" + err);\n }\n}\n\n// ─── IP log helpers ───────────────────────────────────────────\n\nasync function fetchIpLog(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/ip-log.json?t=${Date.now()}`;\n try {\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n if (!resp.ok) return [];\n return resp.json();\n } catch {\n return [];\n }\n}\n\nasync function appendToIpLog(entry: IpLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/ip-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: IpLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log game access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Panel log helpers ────────────────────────────────────────\n\nasync function appendToPanelLog(entry: PanelLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/panel-access-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: PanelLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log panel access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────\n\nfunction getEnv(key: string): string {\n return (Deno.env.get(key) || \"\").trim();\n}\n\nfunction getGameKeys(): Record {\n try {\n return JSON.parse(getEnv(\"GAME_KEYS_JSON\"));\n } catch {\n return {};\n }\n}\n\nfunction normalizeGameId(value: string): string {\n let normalized = value.trim().toLowerCase();\n if (!normalized) return \"\";\n normalized = normalized.replace(/\\.html$/i, \"\");\n normalized = normalized.replace(/eaglrcraft/g, \"eaglercraft\");\n normalized = normalized.replace(/open[-\\s]*in[-\\s]*new[-\\s]*tab/g, \" \");\n normalized = normalized.replace(\n /-(regular|locked|locked-b64|secure|base)/g,\n \" \",\n );\n normalized = normalized.replace(/[-_\\s]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n return normalized;\n}\n\nfunction normalizePasswordList(config: any): string[] {\n if (!config) return [];\n const passwords: string[] = [];\n if (config.password) passwords.push(config.password.trim());\n if (Array.isArray(config.passwords)) {\n config.passwords.forEach((p: string) => {\n const trimmed = (p || \"\").trim();\n if (trimmed && !passwords.includes(trimmed)) passwords.push(trimmed);\n });\n }\n return passwords;\n}\n\nfunction normalizeAllowedIps(raw: any): Record {\n if (!raw || typeof raw !== \"object\") return {};\n const result: Record = {};\n Object.keys(raw).forEach((ip) => {\n const trimmed = ip.trim();\n if (trimmed) result[trimmed] = raw[ip];\n });\n return result;\n}\n\nfunction jsonResponse(data: any, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n });\n}","pythoncoderauth",[159],"pulls","branches",1,"forks","envVars",{"_175":138,"_177":64},"connections",{"_175":64,"_176":64},"count","unfilledCount","emptyCount",{"_43":158,"_32":159,"_30":160,"_135":-5,"_41":42,"_40":161,"_136":60,"_38":192,"_13":163,"_33":34,"_35":164,"_24":25,"_139":165,"_183":193,"_27":194},{"_43":150,"_32":151,"_30":58,"_135":-5,"_41":42,"_40":152,"_136":60,"_38":189,"_13":154,"_33":34,"_35":155,"_24":25,"_139":156,"_183":190,"_27":191},{"_43":141,"_32":142,"_30":143,"_135":-5,"_41":42,"_40":144,"_136":60,"_38":186,"_13":146,"_33":34,"_35":147,"_24":25,"_139":148,"_183":187,"_27":188},{"_43":134,"_32":28,"_30":31,"_135":-5,"_41":42,"_40":14,"_136":60,"_38":182,"_13":138,"_33":34,"_35":37,"_24":25,"_139":-5,"_183":184,"_27":185},["D",1778431317838],"children",[],[28],["D",1776730323901],[],[142],["D",1776730451940],[],[151],["D",1776730335772],[],[159],["D",1775514622169],["D",1789538451310],{"_100":99,"_107":103},{"_100":99,"_101":-5,"_102":103,"_18":56,"_104":105,"_106":25},{"_13":14,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"ctx",{"_83":-5,"_127":233,"_234":235,"_236":237,"_238":25,"_239":25,"_240":25,"_241":60,"_242":-5,"_243":-7,"_244":-7,"_245":64,"_246":25,"_247":25,"_248":-5,"_249":25,"_250":25,"_251":25,"_252":-5},"ENV",{"_204":205,"_206":207,"_208":90,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v33