[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_155":156,"_157":158},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":53,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",16,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","curie_id.ts","latestPath","fileId","fab254c8-a8da-11f1-8463-1607ee4eb77e","name","fileType","http","content","/**\n * CURIE ID — standalone identity backend, deployed as a Val.town HTTP val.\n *\n * Zero-cost stack:\n * - Firebase Auth (Spark/free) holds passwords — we never touch raw passwords ourselves.\n * - Firestore (Spark/free) holds Curie accounts — accessed here via REST + a service\n * account, so client apps can never read/write it directly (see firestore.rules).\n * - FCM (free) delivers verification/approval codes to a device — no email/SMS provider.\n * - This val itself (Val.town) replaces Cloud Functions, which requires Blaze billing.\n *\n * Required Val.town environment variables:\n * CURIE_JWT_SECRET - long random string, signs Curie's own session tokens\n * ADMIN_PASSWORD - password for the admin dashboard (pick something strong)\n * FIREBASE_WEB_API_KEY - Firebase project's public Web API key\n * FIREBASE_PROJECT_ID - Firebase project id\n * FIREBASE_CLIENT_EMAIL - service account email (Firebase console > Project settings\n * > Service accounts > Generate new private key)\n * FIREBASE_PRIVATE_KEY - service account private key (paste with \\n kept literal;\n * this file replaces \\\\n -> real newlines for you)\n *\n * User-facing endpoints:\n * GET /register/check-username ?username= -> { available }\n * POST /register/start { displayName, username, password, deviceId, fcmToken? } -> { accessToken, curieId }\n * fcmToken is optional — account activates immediately either way\n * POST /login { identifier, password, deviceId, fcmToken } -> { accessToken } |\n * identifier accepts either the 9-digit Curie ID or a username\n * { pendingApprovalId }\n * GET /login/status/:approvalId -> { status, accessToken? }\n * POST /login/approve { approvalId, approverDeviceId, decision } -> { ok }\n * POST /verify-token (Authorization: Bearer ) -> { valid, curieId }\n * GET /me (Authorization: Bearer ) -> public profile\n * POST /mint-app-token (Authorization: Bearer ) { app: \"insaka\" } -> { customToken, curieId, username, displayName }\n * GET /user/:curieId -> public profile\n *\n * Admin endpoints (Authorization: Bearer from /admin/login):\n * POST /admin/login { password } -> { accessToken }\n * GET /admin/users ?query=&cursor= -> { users, nextCursor }\n * GET /admin/users/:curieId -> full account (incl. devices)\n * POST /admin/users/:curieId/suspend -> { ok }\n * POST /admin/users/:curieId/activate -> { ok }\n * POST /admin/users/:curieId/delete -> { ok }\n * POST /admin/users/:curieId/devices/:deviceId/revoke -> { ok }\n * GET /admin/logs ?limit=100 -> { events }\n */\n\nimport { SignJWT, jwtVerify, importPKCS8 } from \"npm:jose@6\";\n\n// ---------------------------------------------------------------------------\n// Config\n// ---------------------------------------------------------------------------\n\nconst CURIE_JWT_SECRET = Deno.env.get(\"CURIE_JWT_SECRET\")!;\nconst ADMIN_PASSWORD = Deno.env.get(\"ADMIN_PASSWORD\")!;\nconst FIREBASE_WEB_API_KEY = Deno.env.get(\"FIREBASE_WEB_API_KEY\")!;\nconst FIREBASE_PROJECT_ID = Deno.env.get(\"FIREBASE_PROJECT_ID\")!;\nconst FIREBASE_CLIENT_EMAIL = Deno.env.get(\"FIREBASE_CLIENT_EMAIL\")!;\nconst FIREBASE_PRIVATE_KEY = (Deno.env.get(\"FIREBASE_PRIVATE_KEY\") || \"\").replace(/\\\\n/g, \"\\n\");\n\n// Optional — only needed if minting sign-in tokens for a SEPARATE Firebase\n// project (e.g. INSAKA) via POST /mint-app-token. Same idea as the Curie\n// project's own service account above, just for a different project.\nconst INSAKA_FIREBASE_PROJECT_ID = Deno.env.get(\"INSAKA_FIREBASE_PROJECT_ID\") || \"\";\nconst INSAKA_FIREBASE_CLIENT_EMAIL = Deno.env.get(\"INSAKA_FIREBASE_CLIENT_EMAIL\") || \"\";\nconst INSAKA_FIREBASE_PRIVATE_KEY = (Deno.env.get(\"INSAKA_FIREBASE_PRIVATE_KEY\") || \"\").replace(/\\\\n/g, \"\\n\");\n\nconst TOKEN_TTL_SECONDS = 60 * 60; // 1 hour Curie session token\nconst APPROVAL_TTL_MS = 5 * 60 * 1000; // 5 min for a new-device login approval\n\nconst FIRESTORE_BASE = `https://firestore.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/databases/(default)/documents`;\n\n// ---------------------------------------------------------------------------\n// Google OAuth2 (service account) — lets us call Firestore + FCM with admin rights\n// ---------------------------------------------------------------------------\n\nlet cachedToken: { token: string; expiresAt: number } | null = null;\n\nasync function getGoogleAccessToken(): Promise {\n if (cachedToken && cachedToken.expiresAt > Date.now() + 30_000) {\n return cachedToken.token;\n }\n\n const now = Math.floor(Date.now() / 1000);\n const key = await importPKCS8(FIREBASE_PRIVATE_KEY, \"RS256\");\n\n const assertion = await new SignJWT({\n scope: \"https://www.googleapis.com/auth/datastore https://www.googleapis.com/auth/firebase.messaging https://www.googleapis.com/auth/identitytoolkit\",\n })\n .setProtectedHeader({ alg: \"RS256\", typ: \"JWT\" })\n .setIssuer(FIREBASE_CLIENT_EMAIL)\n .setSubject(FIREBASE_CLIENT_EMAIL)\n .setAudience(\"https://oauth2.googleapis.com/token\")\n .setIssuedAt(now)\n .setExpirationTime(now + 3600)\n .sign(key);\n\n const res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n assertion,\n }),\n });\n\n if (!res.ok) throw new Error(`Google token exchange failed: ${await res.text()}`);\n const data = await res.json();\n\n cachedToken = { token: data.access_token, expiresAt: now * 1000 + data.expires_in * 1000 };\n return cachedToken.token;\n}\n\n// ---------------------------------------------------------------------------\n// Firestore REST helpers (admin access, bypasses security rules — trusted server only)\n// ---------------------------------------------------------------------------\n\nfunction toFirestoreValue(v: any): any {\n if (v === null || v === undefined) return { nullValue: null };\n if (typeof v === \"string\") return { stringValue: v };\n if (typeof v === \"boolean\") return { booleanValue: v };\n if (typeof v === \"number\") {\n return Number.isInteger(v) ? { integerValue: String(v) } : { doubleValue: v };\n }\n if (v instanceof Date) return { timestampValue: v.toISOString() };\n if (Array.isArray(v)) return { arrayValue: { values: v.map(toFirestoreValue) } };\n if (typeof v === \"object\") return { mapValue: { fields: toFirestoreFields(v) } };\n throw new Error(`Unsupported value type: ${typeof v}`);\n}\n\nfunction toFirestoreFields(obj: Record) {\n const fields: Record = {};\n for (const [k, v] of Object.entries(obj)) {\n if (v === undefined) continue;\n fields[k] = toFirestoreValue(v);\n }\n return fields;\n}\n\nfunction fromFirestoreValue(v: any): any {\n if (!v) return null;\n if (\"nullValue\" in v) return null;\n if (\"stringValue\" in v) return v.stringValue;\n if (\"integerValue\" in v) return parseInt(v.integerValue, 10);\n if (\"doubleValue\" in v) return v.doubleValue;\n if (\"booleanValue\" in v) return v.booleanValue;\n if (\"timestampValue\" in v) return v.timestampValue;\n if (\"arrayValue\" in v) return (v.arrayValue.values || []).map(fromFirestoreValue);\n if (\"mapValue\" in v) return fromFirestoreFields(v.mapValue.fields || {});\n return null;\n}\n\nfunction fromFirestoreFields(fields: Record) {\n const obj: Record = {};\n for (const [k, v] of Object.entries(fields || {})) obj[k] = fromFirestoreValue(v);\n return obj;\n}\n\nasync function getDoc(path: string): Promise | null> {\n const token = await getGoogleAccessToken();\n const res = await fetch(`${FIRESTORE_BASE}/${path}`, {\n headers: { Authorization: `Bearer ${token}` },\n });\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`Firestore get failed: ${await res.text()}`);\n const json = await res.json();\n return fromFirestoreFields(json.fields || {});\n}\n\n/** Create a doc with a specific ID. Fails (throws) if it already exists. */\nasync function createDoc(collection: string, id: string, data: Record) {\n const token = await getGoogleAccessToken();\n const res = await fetch(\n `${FIRESTORE_BASE}/${collection}?documentId=${encodeURIComponent(id)}`,\n {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields: toFirestoreFields(data) }),\n },\n );\n if (!res.ok) throw new Error(`Firestore create failed (${res.status}): ${await res.text()}`);\n}\n\nasync function patchDoc(path: string, data: Record) {\n const token = await getGoogleAccessToken();\n const mask = Object.keys(data).map((k) => `updateMask.fieldPaths=${encodeURIComponent(k)}`).join(\"&\");\n const res = await fetch(`${FIRESTORE_BASE}/${path}?${mask}`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields: toFirestoreFields(data) }),\n });\n if (!res.ok) throw new Error(`Firestore patch failed (${res.status}): ${await res.text()}`);\n}\n\nasync function deleteDoc(path: string) {\n const token = await getGoogleAccessToken();\n await fetch(`${FIRESTORE_BASE}/${path}`, {\n method: \"DELETE\",\n headers: { Authorization: `Bearer ${token}` },\n });\n}\n\n/** Runs a structuredQuery against a collection. Returns decoded documents (with their id). */\nasync function runQuery(collection: string, opts: {\n where?: { field: string; op: string; value: any };\n orderBy?: { field: string; direction?: \"ASCENDING\" | \"DESCENDING\" };\n startAt?: string;\n endAt?: string;\n limit?: number;\n}) {\n const token = await getGoogleAccessToken();\n const structuredQuery: any = { from: [{ collectionId: collection }], limit: opts.limit || 50 };\n\n if (opts.where) {\n structuredQuery.where = {\n fieldFilter: {\n field: { fieldPath: opts.where.field },\n op: opts.where.op,\n value: toFirestoreValue(opts.where.value),\n },\n };\n }\n if (opts.orderBy) {\n structuredQuery.orderBy = [{ field: { fieldPath: opts.orderBy.field }, direction: opts.orderBy.direction || \"DESCENDING\" }];\n }\n\n const res = await fetch(`${FIRESTORE_BASE}:runQuery`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ structuredQuery }),\n });\n if (!res.ok) throw new Error(`Firestore query failed: ${await res.text()}`);\n const rows = await res.json();\n\n return rows\n .filter((r: any) => r.document)\n .map((r: any) => {\n const id = r.document.name.split(\"/\").pop();\n return { id, ...fromFirestoreFields(r.document.fields || {}) };\n });\n}\n\n// ---------------------------------------------------------------------------\n// FCM push (free — delivers verification codes / approval requests)\n// ---------------------------------------------------------------------------\n\n/** Returns { success, error?, staleToken? }. staleToken means the token is dead —\n * resending to it will never work, the browser needs to generate a fresh one. */\nasync function sendPush(fcmToken: string, title: string, body: string, data: Record) {\n const token = await getGoogleAccessToken();\n const res = await fetch(\n `https://fcm.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/messages:send`,\n {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n message: { token: fcmToken, notification: { title, body }, data, android: { priority: \"high\" } },\n }),\n },\n );\n if (res.ok) return { success: true };\n\n const errText = await res.text();\n console.error(\"FCM send failed:\", errText);\n const staleToken = /UNREGISTERED|INVALID_ARGUMENT|NOT_FOUND/.test(errText);\n return { success: false, error: errText, staleToken };\n}\n\n// ---------------------------------------------------------------------------\n// Firebase Auth (Identity Toolkit REST) — holds passwords, we never store them ourselves\n// ---------------------------------------------------------------------------\n\nfunction syntheticEmail(curieId: string) {\n return `${curieId}@auth.curie.internal`;\n}\n\nasync function createAuthUser(curieId: string, password: string, displayName: string): Promise {\n const res = await fetch(\n `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_WEB_API_KEY}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ email: syntheticEmail(curieId), password, displayName, returnSecureToken: false }),\n },\n );\n if (!res.ok) throw new Error(`Auth user create failed: ${await res.text()}`);\n const data = await res.json();\n return data.localId as string; // Firebase Auth's own uid — save this, needed for admin deletion later\n}\n\n/** Admin-only: permanently deletes the underlying Firebase Auth credential. */\nasync function deleteAuthUserByUid(authUid: string) {\n const token = await getGoogleAccessToken();\n await fetch(\n `https://identitytoolkit.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/accounts:delete`,\n {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ localId: authUid }),\n },\n );\n}\n\nasync function firebasePasswordLogin(curieId: string, password: string) {\n const res = await fetch(\n `https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${FIREBASE_WEB_API_KEY}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ email: syntheticEmail(curieId), password, returnSecureToken: true }),\n },\n );\n if (!res.ok) throw new Error(\"Invalid Curie ID or password\");\n return res.json();\n}\n\n// ---------------------------------------------------------------------------\n// Curie ID + session token\n// ---------------------------------------------------------------------------\n\nfunction isValidCurieId(v: string) {\n return /^[0-9]{9}c$/.test(v);\n}\n\nfunction normalizeCurieId(v: unknown) {\n return String(v || \"\").trim().toLowerCase();\n}\n\nfunction isStrongPassword(p: unknown) {\n // At least 6 characters, with a mix of letters and numbers.\n return typeof p === \"string\" && p.length >= 6 && p.length <= 128 &&\n /[a-zA-Z]/.test(p) && /[0-9]/.test(p);\n}\n\nfunction isValidUsername(v: unknown) {\n return typeof v === \"string\" && /^[a-z0-9_]{3,20}$/.test(v);\n}\n\nfunction normalizeUsername(v: unknown) {\n return String(v || \"\").trim().toLowerCase();\n}\n\nfunction generateCurieId() {\n const digits = Math.floor(100_000_000 + Math.random() * 900_000_000).toString();\n return `${digits}c`;\n}\n\nasync function generateUniqueCurieId() {\n for (let i = 0; i < 20; i++) {\n const id = generateCurieId();\n if (!(await getDoc(`Users/${id}`))) return id;\n }\n throw new Error(\"Could not allocate a Curie ID\");\n}\n\nfunction getSecretBytes() {\n return new TextEncoder().encode(CURIE_JWT_SECRET);\n}\n\nasync function issueAccessToken(curieId: string) {\n return new SignJWT({ curieId, scope: \"curie\" })\n .setProtectedHeader({ alg: \"HS256\", typ: \"JWT\" })\n .setIssuedAt()\n .setExpirationTime(`${TOKEN_TTL_SECONDS}s`)\n .setIssuer(\"curie-id\")\n .setAudience(\"curie-apps\")\n .sign(getSecretBytes());\n}\n\nasync function authenticate(req: Request) {\n const header = req.headers.get(\"authorization\") || \"\";\n if (!header.startsWith(\"Bearer \")) throw new Error(\"Missing bearer token\");\n const { payload } = await jwtVerify(header.slice(7), getSecretBytes(), {\n issuer: \"curie-id\",\n audience: \"curie-apps\",\n });\n if (!payload.curieId || !isValidCurieId(payload.curieId as string)) throw new Error(\"Invalid token\");\n return payload;\n}\n\n// ---------------------------------------------------------------------------\n// Minting sign-in tokens for OTHER Firebase projects (e.g. INSAKA)\n// ---------------------------------------------------------------------------\n// A Firebase \"custom token\" is just a signed JWT in a specific shape — Google\n// never has to be called to create one, unlike the OAuth2 access tokens above.\n// Any app holding a project's service account key can mint one for any uid\n// in that project, and the client redeems it via signInWithCustomToken().\n// This is how a Curie ID login becomes a real, first-class signed-in session\n// inside INSAKA's own separate Firebase project, using INSAKA's own uid\n// space — no changes needed to INSAKA's existing Auth-based security rules.\nasync function mintFirebaseCustomToken(\n projectClientEmail: string,\n projectPrivateKey: string,\n uid: string,\n extraClaims: Record = {},\n) {\n const key = await importPKCS8(projectPrivateKey, \"RS256\");\n const now = Math.floor(Date.now() / 1000);\n return new SignJWT({\n uid,\n claims: extraClaims,\n })\n .setProtectedHeader({ alg: \"RS256\", typ: \"JWT\" })\n .setIssuer(projectClientEmail)\n .setSubject(projectClientEmail)\n .setAudience(\"https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit\")\n .setIssuedAt(now)\n .setExpirationTime(now + 3600)\n .sign(key);\n}\n\n// ---------------------------------------------------------------------------\n// Audit log (feeds the admin dashboard's activity view)\n// ---------------------------------------------------------------------------\n\nasync function logEvent(type: string, curieId: string | null, meta: Record = {}) {\n const token = await getGoogleAccessToken();\n try {\n await fetch(`${FIRESTORE_BASE}/AuditLog`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields: toFirestoreFields({ type, curieId, meta, createdAt: new Date() }) }),\n });\n } catch (e) {\n console.error(\"Failed to write audit log:\", e); // never block the actual request over this\n }\n}\n\n// ---------------------------------------------------------------------------\n// Admin auth — separate token type from user sessions, gated by ADMIN_PASSWORD\n// ---------------------------------------------------------------------------\n\nasync function issueAdminToken() {\n return new SignJWT({ scope: \"admin\" })\n .setProtectedHeader({ alg: \"HS256\", typ: \"JWT\" })\n .setIssuedAt()\n .setExpirationTime(\"4h\")\n .setIssuer(\"curie-id-admin\")\n .setAudience(\"curie-admin-dashboard\")\n .sign(getSecretBytes());\n}\n\nasync function authenticateAdmin(req: Request) {\n const header = req.headers.get(\"authorization\") || \"\";\n if (!header.startsWith(\"Bearer \")) throw new Error(\"Missing bearer token\");\n const { payload } = await jwtVerify(header.slice(7), getSecretBytes(), {\n issuer: \"curie-id-admin\",\n audience: \"curie-admin-dashboard\",\n });\n if (payload.scope !== \"admin\") throw new Error(\"Not an admin token\");\n return payload;\n}\n\nfunction publicUser(data: Record) {\n return {\n curieId: data.curieId,\n username: data.username || null,\n displayName: data.displayName || \"\",\n countryCode: data.countryCode || null,\n createdAt: data.createdAt || null,\n };\n}\n\n// ---------------------------------------------------------------------------\n// Login rate limiting (existing account brute-force protection)\n// ---------------------------------------------------------------------------\n\nasync function isRateLimited(curieId: string) {\n const doc = await getDoc(`LoginAttempts/${curieId}`);\n if (!doc) return false;\n return !!(doc.lockedUntil && new Date(doc.lockedUntil).getTime() > Date.now());\n}\n\nasync function recordFailedLogin(curieId: string) {\n const doc = (await getDoc(`LoginAttempts/${curieId}`)) || { failedCount: 0 };\n const failedCount = (doc.failedCount || 0) + 1;\n const update: Record = { failedCount };\n if (failedCount >= 5) update.lockedUntil = new Date(Date.now() + 15 * 60 * 1000);\n try {\n await createDoc(\"LoginAttempts\", curieId, update);\n } catch {\n await patchDoc(`LoginAttempts/${curieId}`, update);\n }\n}\n\nasync function clearFailedLogins(curieId: string) {\n await deleteDoc(`LoginAttempts/${curieId}`);\n}\n\n// ---------------------------------------------------------------------------\n// Simple per-IP throttle for /register/start (no account exists yet to lock)\n// ---------------------------------------------------------------------------\n\nasync function isRegisterThrottled(ip: string) {\n const doc = await getDoc(`RegisterAttempts/${ip.replace(/[.:]/g, \"_\")}`);\n if (!doc) return false;\n return !!(doc.lockedUntil && new Date(doc.lockedUntil).getTime() > Date.now());\n}\n\nasync function recordRegisterAttempt(ip: string) {\n const key = ip.replace(/[.:]/g, \"_\");\n const doc = (await getDoc(`RegisterAttempts/${key}`)) || { count: 0 };\n const count = (doc.count || 0) + 1;\n const update: Record = { count };\n if (count >= 5) update.lockedUntil = new Date(Date.now() + 15 * 60 * 1000);\n try {\n await createDoc(\"RegisterAttempts\", key, update);\n } catch {\n await patchDoc(`RegisterAttempts/${key}`, update);\n }\n}\n\n// ---------------------------------------------------------------------------\n// HTTP handler\n// ---------------------------------------------------------------------------\n\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\", \"Access-Control-Allow-Origin\": \"*\" },\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,Authorization\",\n },\n });\n }\n\n try {\n // Health check --------------------------------------------------------\n if (req.method === \"GET\" && path === \"/\") {\n return json({ service: \"Curie ID\", status: \"online\" });\n }\n\n // GET /register/check-username -------------------------------------------\n if (req.method === \"GET\" && path === \"/register/check-username\") {\n const username = normalizeUsername(url.searchParams.get(\"username\"));\n if (!isValidUsername(username)) {\n return json({ available: false, error: \"3-20 characters, lowercase letters/numbers/underscore only\" }, 400);\n }\n const existing = await getDoc(`Usernames/${username}`);\n return json({ available: !existing });\n }\n\n // POST /register/start -------------------------------------------------\n // First-time signup activates the account immediately — no code required.\n // Verification only ever happens later, when logging in from a device\n // this account hasn't used before (see POST /login below).\n if (req.method === \"POST\" && path === \"/register/start\") {\n const ip = req.headers.get(\"x-forwarded-for\") || \"unknown\";\n if (await isRegisterThrottled(ip)) {\n return json({ error: \"Too many attempts. Try again later.\" }, 429);\n }\n\n const { displayName, username: rawUsername, password, deviceId, fcmToken } = await req.json();\n const username = normalizeUsername(rawUsername);\n\n if (!displayName || !isStrongPassword(password) || !deviceId) {\n await recordRegisterAttempt(ip);\n return json({ error: \"displayName, a strong password, and deviceId are required\" }, 400);\n }\n if (!isValidUsername(username)) {\n await recordRegisterAttempt(ip);\n return json({ error: \"Username must be 3-20 characters: lowercase letters, numbers, underscore only\" }, 400);\n }\n\n const curieId = await generateUniqueCurieId();\n\n // Reserve the username first — if someone else already has it, fail fast\n // before creating any auth user or account.\n try {\n await createDoc(\"Usernames\", username, { curieId });\n } catch (e) {\n await recordRegisterAttempt(ip);\n return json({ error: \"That username is already taken. Please choose another.\" }, 409);\n }\n\n let authUid: string;\n try {\n authUid = await createAuthUser(curieId, password, String(displayName).trim().slice(0, 100));\n } catch (e) {\n await deleteDoc(`Usernames/${username}`);\n return json({ error: \"Could not create account\" }, 400);\n }\n\n // fcmToken is optional here — it's a nice-to-have so this device can receive\n // approval pushes for FUTURE logins from other devices. Not having one yet\n // doesn't block account creation; it just means this device can't approve\n // other logins until it gets a working push token some other way.\n try {\n await createDoc(\"Users\", curieId, {\n curieId,\n username,\n authUid,\n displayName: String(displayName).trim().slice(0, 100),\n status: \"active\",\n trustedDevices: [{ deviceId, fcmToken: fcmToken || null, addedAt: new Date() }],\n createdAt: new Date(),\n });\n } catch (e) {\n await deleteAuthUserByUid(authUid);\n await deleteDoc(`Usernames/${username}`);\n return json({ error: \"Could not create account, please try again\" }, 500);\n }\n\n await logEvent(\"register\", curieId, { ip, username, hasPushToken: !!fcmToken });\n await recordRegisterAttempt(ip);\n\n const token = await issueAccessToken(curieId);\n return json({ accessToken: token, tokenType: \"Bearer\", expiresIn: TOKEN_TTL_SECONDS, curieId }, 201);\n }\n\n // POST /login -------------------------------------------------------------\n if (req.method === \"POST\" && path === \"/login\") {\n const { curieId: rawId, identifier: rawIdentifier, password, deviceId, fcmToken } = await req.json();\n const raw = normalizeCurieId(rawIdentifier ?? rawId); // accepts either field name\n\n if (!raw || typeof password !== \"string\" || !deviceId) {\n return json({ error: \"Invalid login request\" }, 400);\n }\n\n // Accept either the 9-digit Curie ID directly, or a username that resolves to one.\n let curieId: string;\n if (isValidCurieId(raw)) {\n curieId = raw;\n } else if (isValidUsername(raw)) {\n const usernameDoc = await getDoc(`Usernames/${raw}`);\n if (!usernameDoc) return json({ error: \"Invalid Curie ID/username or password\" }, 401);\n curieId = usernameDoc.curieId;\n } else {\n return json({ error: \"Invalid login request\" }, 400);\n }\n\n if (await isRateLimited(curieId)) {\n return json({ error: \"Too many failed attempts. Try again later.\" }, 429);\n }\n\n try {\n await firebasePasswordLogin(curieId, password);\n } catch {\n await recordFailedLogin(curieId);\n return json({ error: \"Invalid Curie ID/username or password\" }, 401);\n }\n await clearFailedLogins(curieId);\n\n const user = await getDoc(`Users/${curieId}`);\n if (!user || user.status === \"deleted\") {\n return json({ error: \"Account not found\" }, 403);\n }\n if (user.status === \"suspended\") {\n await logEvent(\"login_denied_suspended\", curieId, { deviceId });\n return json({ error: \"This account has been suspended\" }, 403);\n }\n if (user.status !== \"active\") {\n return json({ error: \"Account not verified\" }, 403);\n }\n\n const trusted = (user.trustedDevices || []).find((d: any) => d.deviceId === deviceId);\n if (trusted) {\n const token = await issueAccessToken(curieId);\n await logEvent(\"login_success\", curieId, { deviceId });\n return json({ accessToken: token, tokenType: \"Bearer\", expiresIn: TOKEN_TTL_SECONDS, curieId });\n }\n\n // Unrecognized device, but the password has already been verified above —\n // that's the actual proof of identity. Matching how Google/most services'\n // baseline sign-in works: a correct password gets you in immediately, full\n // stop. Device-approval as a mandatory extra gate meant clearing browser\n // data (or losing/wiping the one device you had) could lock someone out\n // permanently with no way back in — that's a worse failure mode than the\n // security it bought. So this now just trusts the device and logs in,\n // and — best-effort, non-blocking — lets other trusted devices know a\n // new sign-in happened, the same way Google emails \"was this you?\"\n // without waiting for a reply.\n await patchDoc(`Users/${curieId}`, {\n trustedDevices: [...(user.trustedDevices || []), { deviceId, fcmToken: fcmToken || null, addedAt: new Date() }],\n });\n for (const d of user.trustedDevices || []) {\n try {\n await sendPush(d.fcmToken, \"New sign-in on your Curie ID\", \"A new device just signed in. Wasn't you? Change your password.\", {\n type: \"new_device_notice\",\n curieId,\n });\n } catch {\n // Notification is informational only — never block login on it.\n }\n }\n const token = await issueAccessToken(curieId);\n await logEvent(\"login_success_new_device\", curieId, { deviceId });\n return json({ accessToken: token, tokenType: \"Bearer\", expiresIn: TOKEN_TTL_SECONDS, curieId });\n }\n\n // GET /login/status/:approvalId --------------------------------------\n const statusMatch = path.match(/^\\/login\\/status\\/([a-zA-Z0-9-]+)$/);\n if (req.method === \"GET\" && statusMatch) {\n const approval = await getDoc(`LoginApprovals/${statusMatch[1]}`);\n if (!approval) return json({ error: \"Not found\" }, 404);\n\n if (approval.status === \"approved\") {\n const token = await issueAccessToken(approval.curieId);\n return json({ status: \"approved\", accessToken: token, tokenType: \"Bearer\", expiresIn: TOKEN_TTL_SECONDS, curieId: approval.curieId });\n }\n if (approval.status === \"denied\" || new Date(approval.expiresAt).getTime() < Date.now()) {\n return json({ status: \"denied\" });\n }\n return json({ status: \"pending\" }, 202);\n }\n\n // POST /login/approve --------------------------------------------------\n if (req.method === \"POST\" && path === \"/login/approve\") {\n const { approvalId, approverDeviceId, decision } = await req.json();\n if (!approvalId || !approverDeviceId || ![\"approve\", \"deny\"].includes(decision)) {\n return json({ error: \"approvalId, approverDeviceId, decision are required\" }, 400);\n }\n\n const approval = await getDoc(`LoginApprovals/${approvalId}`);\n if (!approval || approval.status !== \"pending\") return json({ error: \"Not found or already resolved\" }, 404);\n\n const user = await getDoc(`Users/${approval.curieId}`);\n const isTrusted = (user?.trustedDevices || []).some((d: any) => d.deviceId === approverDeviceId);\n if (!isTrusted) return json({ error: \"Not authorized to approve this login\" }, 403);\n\n if (decision === \"approve\") {\n const newDevices = [\n ...(user.trustedDevices || []),\n { deviceId: approval.newDeviceId, fcmToken: approval.newDeviceFcmToken, addedAt: new Date() },\n ];\n await patchDoc(`Users/${approval.curieId}`, { trustedDevices: newDevices });\n await patchDoc(`LoginApprovals/${approvalId}`, { status: \"approved\" });\n await logEvent(\"login_approved\", approval.curieId, { newDeviceId: approval.newDeviceId, approverDeviceId });\n } else {\n await patchDoc(`LoginApprovals/${approvalId}`, { status: \"denied\" });\n await logEvent(\"login_denied_by_user\", approval.curieId, { newDeviceId: approval.newDeviceId, approverDeviceId });\n }\n\n return json({ ok: true });\n }\n\n // -----------------------------------------------------------------------\n // ADMIN ROUTES\n // -----------------------------------------------------------------------\n\n // POST /admin/login -------------------------------------------------------\n if (req.method === \"POST\" && path === \"/admin/login\") {\n const { password } = await req.json();\n if (!password || password !== ADMIN_PASSWORD) {\n return json({ error: \"Invalid password\" }, 401);\n }\n const token = await issueAdminToken();\n return json({ accessToken: token, tokenType: \"Bearer\" });\n }\n\n // Everything else under /admin/ requires a valid admin token.\n if (path.startsWith(\"/admin/\")) {\n try {\n await authenticateAdmin(req);\n } catch {\n return json({ error: \"Admin authentication required\" }, 401);\n }\n\n // GET /admin/users?query= --------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/users\") {\n const query = (url.searchParams.get(\"query\") || \"\").trim();\n const limit = Math.min(parseInt(url.searchParams.get(\"limit\") || \"50\", 10), 100);\n\n let users;\n if (isValidCurieId(normalizeCurieId(query))) {\n const one = await getDoc(`Users/${normalizeCurieId(query)}`);\n users = one ? [{ id: normalizeCurieId(query), ...one }] : [];\n } else if (query) {\n // Try an exact username match first; if that misses, fall through to a\n // display-name prefix search rather than assuming \"looks like a username\"\n // means \"is a username\" — plenty of real names match that same pattern.\n const usernameMapping = isValidUsername(normalizeUsername(query))\n ? await getDoc(`Usernames/${normalizeUsername(query)}`)\n : null;\n\n if (usernameMapping) {\n const one = await getDoc(`Users/${usernameMapping.curieId}`);\n users = one ? [one] : [];\n } else {\n users = await runQuery(\"Users\", {\n where: { field: \"displayName\", op: \"GREATER_THAN_OR_EQUAL\", value: query },\n orderBy: { field: \"displayName\", direction: \"ASCENDING\" },\n limit,\n });\n users = users.filter((u: any) => (u.displayName || \"\").toLowerCase().startsWith(query.toLowerCase()));\n }\n } else {\n users = await runQuery(\"Users\", { orderBy: { field: \"createdAt\", direction: \"DESCENDING\" }, limit });\n }\n\n return json({\n users: users.map((u: any) => ({\n curieId: u.curieId,\n username: u.username || null,\n displayName: u.displayName,\n status: u.status,\n createdAt: u.createdAt,\n deviceCount: (u.trustedDevices || []).length,\n })),\n });\n }\n\n // GET /admin/users/:curieId ------------------------------------------\n const adminUserMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && adminUserMatch) {\n const user = await getDoc(`Users/${adminUserMatch[1]}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n return json({\n curieId: user.curieId,\n displayName: user.displayName,\n status: user.status,\n createdAt: user.createdAt,\n trustedDevices: user.trustedDevices || [],\n });\n }\n\n // POST /admin/users/:curieId/suspend ----------------------------------\n const suspendMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/suspend$/);\n if (req.method === \"POST\" && suspendMatch) {\n await patchDoc(`Users/${suspendMatch[1]}`, { status: \"suspended\" });\n await logEvent(\"admin_suspend\", suspendMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/activate ---------------------------------\n const activateMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/activate$/);\n if (req.method === \"POST\" && activateMatch) {\n await patchDoc(`Users/${activateMatch[1]}`, { status: \"active\" });\n await logEvent(\"admin_activate\", activateMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/delete ------------------------------------\n // Permanent, hard delete — releases the username and Curie ID so the\n // person (or anyone else) can sign up fresh with either afterward.\n const deleteMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/delete$/);\n if (req.method === \"POST\" && deleteMatch) {\n const curieId = deleteMatch[1];\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n\n if (user.authUid) {\n try {\n await deleteAuthUserByUid(user.authUid);\n } catch (e) {\n console.error(\"Failed to delete underlying auth credential:\", e);\n }\n }\n if (user.username) {\n await deleteDoc(`Usernames/${user.username}`);\n }\n await deleteDoc(`Users/${curieId}`);\n await deleteDoc(`LoginAttempts/${curieId}`);\n await logEvent(\"admin_delete\", curieId, { username: user.username || null });\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/devices/:deviceId/revoke ------------------\n const revokeMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/devices\\/([^/]+)\\/revoke$/);\n if (req.method === \"POST\" && revokeMatch) {\n const [, curieId, deviceId] = revokeMatch;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n const remaining = (user.trustedDevices || []).filter((d: any) => d.deviceId !== deviceId);\n await patchDoc(`Users/${curieId}`, { trustedDevices: remaining });\n await logEvent(\"admin_revoke_device\", curieId, { deviceId });\n return json({ ok: true });\n }\n\n // GET /admin/logs ---------------------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/logs\") {\n const limit = Math.min(parseInt(url.searchParams.get(\"limit\") || \"100\", 10), 200);\n const events = await runQuery(\"AuditLog\", { orderBy: { field: \"createdAt\", direction: \"DESCENDING\" }, limit });\n return json({ events });\n }\n\n return json({ error: \"Not found\" }, 404);\n }\n\n // POST /verify-token ----------------------------------------------------\n if (req.method === \"POST\" && path === \"/verify-token\") {\n const payload = await authenticate(req);\n return json({ valid: true, curieId: payload.curieId, expiresAt: payload.exp });\n }\n\n // GET /me -----------------------------------------------------------------\n if (req.method === \"GET\" && path === \"/me\") {\n const payload = await authenticate(req);\n const user = await getDoc(`Users/${payload.curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n // POST /mint-app-token ------------------------------------------------------\n // Called by another app's own frontend (e.g. INSAKA) after it receives a\n // Curie access token via the redirect-back flow. Verifies the token, then\n // mints a real Firebase Auth custom token for that app's OWN project, using\n // the Curie ID as the uid. The app signs in with it via\n // signInWithCustomToken() — a real, first-class session in ITS OWN Firebase\n // project, so nothing about how that app already works has to change.\n if (req.method === \"POST\" && path === \"/mint-app-token\") {\n const payload = await authenticate(req);\n const { app } = await req.json();\n\n if (app !== \"insaka\") return json({ error: \"Unknown app\" }, 400);\n if (!INSAKA_FIREBASE_PROJECT_ID || !INSAKA_FIREBASE_CLIENT_EMAIL || !INSAKA_FIREBASE_PRIVATE_KEY) {\n return json({ error: \"INSAKA integration is not configured on this server\" }, 501);\n }\n\n const curieId = payload.curieId as string;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n\n const customToken = await mintFirebaseCustomToken(\n INSAKA_FIREBASE_CLIENT_EMAIL,\n INSAKA_FIREBASE_PRIVATE_KEY,\n curieId, // becomes the uid inside INSAKA's Firebase project\n { curieUsername: user.username || null, curieDisplayName: user.displayName || null },\n );\n\n await logEvent(\"mint_app_token\", curieId, { app });\n return json({\n customToken,\n curieId,\n username: user.username || null,\n displayName: user.displayName || \"\",\n });\n }\n\n // GET /user/:curieId ---------------------------------------------------\n const publicMatch = path.match(/^\\/user\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && publicMatch) {\n const user = await getDoc(`Users/${publicMatch[1]}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n return json({ error: \"Not found\" }, 404);\n } catch (err) {\n console.error(err);\n return json({ error: \"Internal server error\" }, 500);\n }\n}","/**\n * CURIE ID — standalone identity backend, deployed as a Val.town HTTP val.\n *\n * Zero-cost stack:\n * - Firebase Auth (Spark/free) holds passwords — we never touch raw passwords ourselves.\n * - Firestore (Spark/free) holds Curie accounts — accessed here via REST + a service\n * account, so client apps can never read/write it directly (see firestore.rules).\n * - FCM (free) delivers verification/approval codes to a device — no email/SMS provider.\n * - This val itself (Val.town) replaces Cloud Functions, which requires Blaze billing.\n *\n * Required Val.town environment variables:\n * CURIE_JWT_SECRET - long random string, signs Curie's own session tokens\n * ADMIN_PASSWORD - password for the admin dashboard (pick something strong)\n * FIREBASE_WEB_API_KEY - Firebase project's public Web API key\n * FIREBASE_PROJECT_ID - Firebase project id\n * FIREBASE_CLIENT_EMAIL - service account email (Firebase console > Project settings\n * > Service accounts > Generate new private key)\n * FIREBASE_PRIVATE_KEY - service account private key (paste with \\n kept literal;\n * this file replaces \\\\n -> real newlines for you)\n *\n * Optional — only needed for the INSAKA integration (see /mint-app-token\n * and /admin/insaka/* below):\n * INSAKA_FIREBASE_PROJECT_ID - INSAKA's own Firebase project id\n * INSAKA_FIREBASE_CLIENT_EMAIL - INSAKA's own service account email\n * INSAKA_FIREBASE_PRIVATE_KEY - INSAKA's own service account private key\n * INSAKA_DATABASE_URL - INSAKA's Realtime Database URL, e.g.\n * https://insaka-web-default-rtdb.europe-west1.firebasedatabase.app\n *\n * User-facing endpoints:\n * GET /register/check-username ?username= -> { available }\n * POST /register/start { displayName, username, password, deviceId, fcmToken? } -> { accessToken, curieId }\n * fcmToken is optional — account activates immediately either way\n * POST /login { identifier, password, deviceId, fcmToken } -> { accessToken } |\n * identifier accepts either the 9-digit Curie ID or a username\n * { pendingApprovalId }\n * GET /login/status/:approvalId -> { status, accessToken? }\n * POST /login/approve { approvalId, approverDeviceId, decision } -> { ok }\n * POST /verify-token (Authorization: Bearer ) -> { valid, curieId }\n * GET /me (Authorization: Bearer ) -> public profile\n * POST /mint-app-token (Authorization: Bearer ) { app: \"insaka\" } -> { customToken, curieId, username, displayName }\n * GET /user/:curieId -> public profile\n *\n * Admin endpoints (Authorization: Bearer from /admin/login):\n * POST /admin/login { password } -> { accessToken }\n * GET /admin/users ?query=&cursor= -> { users, nextCursor }\n * GET /admin/users/:curieId -> full account (incl. devices)\n * POST /admin/users/:curieId/suspend -> { ok }\n * POST /admin/users/:curieId/activate -> { ok }\n * POST /admin/users/:curieId/delete -> { ok }\n * POST /admin/users/:curieId/devices/:deviceId/revoke -> { ok }\n * GET /admin/logs ?limit=100 -> { events }\n *\n * POST /admin/insaka/announcements { title, message } -> { ok, id }\n * GET /admin/insaka/announcements -> { announcements }\n * POST /admin/insaka/announcements/:id/delete -> { ok }\n * GET /admin/insaka/reports ?status= -> { reports }\n * POST /admin/insaka/reports/:id/resolve { status, note?, blockReportedUser? } -> { ok }\n * GET /admin/insaka/stats -> safety-report counts/trend\n */\n\nimport { SignJWT, jwtVerify, importPKCS8 } from \"npm:jose@6\";\n\n// ---------------------------------------------------------------------------\n// Config\n// ---------------------------------------------------------------------------\n\nconst CURIE_JWT_SECRET = Deno.env.get(\"CURIE_JWT_SECRET\")!;\nconst ADMIN_PASSWORD = Deno.env.get(\"ADMIN_PASSWORD\")!;\nconst FIREBASE_WEB_API_KEY = Deno.env.get(\"FIREBASE_WEB_API_KEY\")!;\nconst FIREBASE_PROJECT_ID = Deno.env.get(\"FIREBASE_PROJECT_ID\")!;\nconst FIREBASE_CLIENT_EMAIL = Deno.env.get(\"FIREBASE_CLIENT_EMAIL\")!;\nconst FIREBASE_PRIVATE_KEY = (Deno.env.get(\"FIREBASE_PRIVATE_KEY\") || \"\").replace(/\\\\n/g, \"\\n\");\n\n// Optional — only needed if minting sign-in tokens for a SEPARATE Firebase\n// project (e.g. INSAKA) via POST /mint-app-token. Same idea as the Curie\n// project's own service account above, just for a different project.\nconst INSAKA_FIREBASE_PROJECT_ID = Deno.env.get(\"INSAKA_FIREBASE_PROJECT_ID\") || \"\";\nconst INSAKA_FIREBASE_CLIENT_EMAIL = Deno.env.get(\"INSAKA_FIREBASE_CLIENT_EMAIL\") || \"\";\nconst INSAKA_FIREBASE_PRIVATE_KEY = (Deno.env.get(\"INSAKA_FIREBASE_PRIVATE_KEY\") || \"\").replace(/\\\\n/g, \"\\n\");\nconst INSAKA_DATABASE_URL = Deno.env.get(\"INSAKA_DATABASE_URL\") || \"\"; // e.g. https://insaka-web-default-rtdb.europe-west1.firebasedatabase.app\n\nconst TOKEN_TTL_SECONDS = 60 * 60; // 1 hour Curie session token\nconst APPROVAL_TTL_MS = 5 * 60 * 1000; // 5 min for a new-device login approval\n\nconst FIRESTORE_BASE = `https://firestore.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/databases/(default)/documents`;\n\n// ---------------------------------------------------------------------------\n// Google OAuth2 (service account) — lets us call Firestore + FCM with admin rights\n// ---------------------------------------------------------------------------\n\nlet cachedToken: { token: string; expiresAt: number } | null = null;\n\nasync function getGoogleAccessToken(): Promise {\n if (cachedToken && cachedToken.expiresAt > Date.now() + 30_000) {\n return cachedToken.token;\n }\n\n const now = Math.floor(Date.now() / 1000);\n const key = await importPKCS8(FIREBASE_PRIVATE_KEY, \"RS256\");\n\n const assertion = await new SignJWT({\n scope: \"https://www.googleapis.com/auth/datastore https://www.googleapis.com/auth/firebase.messaging https://www.googleapis.com/auth/identitytoolkit\",\n })\n .setProtectedHeader({ alg: \"RS256\", typ: \"JWT\" })\n .setIssuer(FIREBASE_CLIENT_EMAIL)\n .setSubject(FIREBASE_CLIENT_EMAIL)\n .setAudience(\"https://oauth2.googleapis.com/token\")\n .setIssuedAt(now)\n .setExpirationTime(now + 3600)\n .sign(key);\n\n const res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n assertion,\n }),\n });\n\n if (!res.ok) throw new Error(`Google token exchange failed: ${await res.text()}`);\n const data = await res.json();\n\n cachedToken = { token: data.access_token, expiresAt: now * 1000 + data.expires_in * 1000 };\n return cachedToken.token;\n}\n\n// ---------------------------------------------------------------------------\n// INSAKA's Realtime Database — admin access via INSAKA's OWN service account\n// (separate OAuth token, since it's a different Google Cloud project entirely)\n// ---------------------------------------------------------------------------\n\nlet cachedInsakaToken: { token: string; expiresAt: number } | null = null;\n\nasync function getInsakaAccessToken(): Promise {\n if (cachedInsakaToken && cachedInsakaToken.expiresAt > Date.now() + 30_000) {\n return cachedInsakaToken.token;\n }\n const now = Math.floor(Date.now() / 1000);\n const key = await importPKCS8(INSAKA_FIREBASE_PRIVATE_KEY, \"RS256\");\n\n const assertion = await new SignJWT({\n scope: \"https://www.googleapis.com/auth/firebase.database https://www.googleapis.com/auth/userinfo.email\",\n })\n .setProtectedHeader({ alg: \"RS256\", typ: \"JWT\" })\n .setIssuer(INSAKA_FIREBASE_CLIENT_EMAIL)\n .setSubject(INSAKA_FIREBASE_CLIENT_EMAIL)\n .setAudience(\"https://oauth2.googleapis.com/token\")\n .setIssuedAt(now)\n .setExpirationTime(now + 3600)\n .sign(key);\n\n const res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({ grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\", assertion }),\n });\n if (!res.ok) throw new Error(`INSAKA token exchange failed: ${await res.text()}`);\n const data = await res.json();\n\n cachedInsakaToken = { token: data.access_token, expiresAt: now * 1000 + data.expires_in * 1000 };\n return cachedInsakaToken.token;\n}\n\n/** Realtime Database REST call, admin access (bypasses INSAKA's own security rules). */\nasync function insakaRtdb(method: string, path: string, body?: any) {\n const token = await getInsakaAccessToken();\n const res = await fetch(`${INSAKA_DATABASE_URL}/${path}.json`, {\n method,\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: body !== undefined ? JSON.stringify(body) : undefined,\n });\n if (!res.ok) throw new Error(`INSAKA database ${method} failed: ${await res.text()}`);\n return res.status === 204 ? null : res.json();\n}\n\n// ---------------------------------------------------------------------------\n// Firestore REST helpers (admin access, bypasses security rules — trusted server only)\n// ---------------------------------------------------------------------------\n\nfunction toFirestoreValue(v: any): any {\n if (v === null || v === undefined) return { nullValue: null };\n if (typeof v === \"string\") return { stringValue: v };\n if (typeof v === \"boolean\") return { booleanValue: v };\n if (typeof v === \"number\") {\n return Number.isInteger(v) ? { integerValue: String(v) } : { doubleValue: v };\n }\n if (v instanceof Date) return { timestampValue: v.toISOString() };\n if (Array.isArray(v)) return { arrayValue: { values: v.map(toFirestoreValue) } };\n if (typeof v === \"object\") return { mapValue: { fields: toFirestoreFields(v) } };\n throw new Error(`Unsupported value type: ${typeof v}`);\n}\n\nfunction toFirestoreFields(obj: Record) {\n const fields: Record = {};\n for (const [k, v] of Object.entries(obj)) {\n if (v === undefined) continue;\n fields[k] = toFirestoreValue(v);\n }\n return fields;\n}\n\nfunction fromFirestoreValue(v: any): any {\n if (!v) return null;\n if (\"nullValue\" in v) return null;\n if (\"stringValue\" in v) return v.stringValue;\n if (\"integerValue\" in v) return parseInt(v.integerValue, 10);\n if (\"doubleValue\" in v) return v.doubleValue;\n if (\"booleanValue\" in v) return v.booleanValue;\n if (\"timestampValue\" in v) return v.timestampValue;\n if (\"arrayValue\" in v) return (v.arrayValue.values || []).map(fromFirestoreValue);\n if (\"mapValue\" in v) return fromFirestoreFields(v.mapValue.fields || {});\n return null;\n}\n\nfunction fromFirestoreFields(fields: Record) {\n const obj: Record = {};\n for (const [k, v] of Object.entries(fields || {})) obj[k] = fromFirestoreValue(v);\n return obj;\n}\n\nasync function getDoc(path: string): Promise | null> {\n const token = await getGoogleAccessToken();\n const res = await fetch(`${FIRESTORE_BASE}/${path}`, {\n headers: { Authorization: `Bearer ${token}` },\n });\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`Firestore get failed: ${await res.text()}`);\n const json = await res.json();\n return fromFirestoreFields(json.fields || {});\n}\n\n/** Create a doc with a specific ID. Fails (throws) if it already exists. */\nasync function createDoc(collection: string, id: string, data: Record) {\n const token = await getGoogleAccessToken();\n const res = await fetch(\n `${FIRESTORE_BASE}/${collection}?documentId=${encodeURIComponent(id)}`,\n {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields: toFirestoreFields(data) }),\n },\n );\n if (!res.ok) throw new Error(`Firestore create failed (${res.status}): ${await res.text()}`);\n}\n\nasync function patchDoc(path: string, data: Record) {\n const token = await getGoogleAccessToken();\n const mask = Object.keys(data).map((k) => `updateMask.fieldPaths=${encodeURIComponent(k)}`).join(\"&\");\n const res = await fetch(`${FIRESTORE_BASE}/${path}?${mask}`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields: toFirestoreFields(data) }),\n });\n if (!res.ok) throw new Error(`Firestore patch failed (${res.status}): ${await res.text()}`);\n}\n\nasync function deleteDoc(path: string) {\n const token = await getGoogleAccessToken();\n await fetch(`${FIRESTORE_BASE}/${path}`, {\n method: \"DELETE\",\n headers: { Authorization: `Bearer ${token}` },\n });\n}\n\n/** Runs a structuredQuery against a collection. Returns decoded documents (with their id). */\nasync function runQuery(collection: string, opts: {\n where?: { field: string; op: string; value: any };\n orderBy?: { field: string; direction?: \"ASCENDING\" | \"DESCENDING\" };\n startAt?: string;\n endAt?: string;\n limit?: number;\n}) {\n const token = await getGoogleAccessToken();\n const structuredQuery: any = { from: [{ collectionId: collection }], limit: opts.limit || 50 };\n\n if (opts.where) {\n structuredQuery.where = {\n fieldFilter: {\n field: { fieldPath: opts.where.field },\n op: opts.where.op,\n value: toFirestoreValue(opts.where.value),\n },\n };\n }\n if (opts.orderBy) {\n structuredQuery.orderBy = [{ field: { fieldPath: opts.orderBy.field }, direction: opts.orderBy.direction || \"DESCENDING\" }];\n }\n\n const res = await fetch(`${FIRESTORE_BASE}:runQuery`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ structuredQuery }),\n });\n if (!res.ok) throw new Error(`Firestore query failed: ${await res.text()}`);\n const rows = await res.json();\n\n return rows\n .filter((r: any) => r.document)\n .map((r: any) => {\n const id = r.document.name.split(\"/\").pop();\n return { id, ...fromFirestoreFields(r.document.fields || {}) };\n });\n}\n\n// ---------------------------------------------------------------------------\n// FCM push (free — delivers verification codes / approval requests)\n// ---------------------------------------------------------------------------\n\n/** Returns { success, error?, staleToken? }. staleToken means the token is dead —\n * resending to it will never work, the browser needs to generate a fresh one. */\nasync function sendPush(fcmToken: string, title: string, body: string, data: Record) {\n const token = await getGoogleAccessToken();\n const res = await fetch(\n `https://fcm.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/messages:send`,\n {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n message: { token: fcmToken, notification: { title, body }, data, android: { priority: \"high\" } },\n }),\n },\n );\n if (res.ok) return { success: true };\n\n const errText = await res.text();\n console.error(\"FCM send failed:\", errText);\n const staleToken = /UNREGISTERED|INVALID_ARGUMENT|NOT_FOUND/.test(errText);\n return { success: false, error: errText, staleToken };\n}\n\n// ---------------------------------------------------------------------------\n// Firebase Auth (Identity Toolkit REST) — holds passwords, we never store them ourselves\n// ---------------------------------------------------------------------------\n\nfunction syntheticEmail(curieId: string) {\n return `${curieId}@auth.curie.internal`;\n}\n\nasync function createAuthUser(curieId: string, password: string, displayName: string): Promise {\n const res = await fetch(\n `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_WEB_API_KEY}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ email: syntheticEmail(curieId), password, displayName, returnSecureToken: false }),\n },\n );\n if (!res.ok) throw new Error(`Auth user create failed: ${await res.text()}`);\n const data = await res.json();\n return data.localId as string; // Firebase Auth's own uid — save this, needed for admin deletion later\n}\n\n/** Admin-only: permanently deletes the underlying Firebase Auth credential. */\nasync function deleteAuthUserByUid(authUid: string) {\n const token = await getGoogleAccessToken();\n await fetch(\n `https://identitytoolkit.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/accounts:delete`,\n {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ localId: authUid }),\n },\n );\n}\n\nasync function firebasePasswordLogin(curieId: string, password: string) {\n const res = await fetch(\n `https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${FIREBASE_WEB_API_KEY}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ email: syntheticEmail(curieId), password, returnSecureToken: true }),\n },\n );\n if (!res.ok) throw new Error(\"Invalid Curie ID or password\");\n return res.json();\n}\n\n// ---------------------------------------------------------------------------\n// Curie ID + session token\n// ---------------------------------------------------------------------------\n\nfunction isValidCurieId(v: string) {\n return /^[0-9]{9}c$/.test(v);\n}\n\nfunction normalizeCurieId(v: unknown) {\n return String(v || \"\").trim().toLowerCase();\n}\n\nfunction isStrongPassword(p: unknown) {\n // At least 6 characters, with a mix of letters and numbers.\n return typeof p === \"string\" && p.length >= 6 && p.length <= 128 &&\n /[a-zA-Z]/.test(p) && /[0-9]/.test(p);\n}\n\nfunction isValidUsername(v: unknown) {\n return typeof v === \"string\" && /^[a-z0-9_]{3,20}$/.test(v);\n}\n\nfunction normalizeUsername(v: unknown) {\n return String(v || \"\").trim().toLowerCase();\n}\n\nfunction generateCurieId() {\n const digits = Math.floor(100_000_000 + Math.random() * 900_000_000).toString();\n return `${digits}c`;\n}\n\nasync function generateUniqueCurieId() {\n for (let i = 0; i < 20; i++) {\n const id = generateCurieId();\n if (!(await getDoc(`Users/${id}`))) return id;\n }\n throw new Error(\"Could not allocate a Curie ID\");\n}\n\nfunction getSecretBytes() {\n return new TextEncoder().encode(CURIE_JWT_SECRET);\n}\n\nasync function issueAccessToken(curieId: string) {\n return new SignJWT({ curieId, scope: \"curie\" })\n .setProtectedHeader({ alg: \"HS256\", typ: \"JWT\" })\n .setIssuedAt()\n .setExpirationTime(`${TOKEN_TTL_SECONDS}s`)\n .setIssuer(\"curie-id\")\n .setAudience(\"curie-apps\")\n .sign(getSecretBytes());\n}\n\nasync function authenticate(req: Request) {\n const header = req.headers.get(\"authorization\") || \"\";\n if (!header.startsWith(\"Bearer \")) throw new Error(\"Missing bearer token\");\n const { payload } = await jwtVerify(header.slice(7), getSecretBytes(), {\n issuer: \"curie-id\",\n audience: \"curie-apps\",\n });\n if (!payload.curieId || !isValidCurieId(payload.curieId as string)) throw new Error(\"Invalid token\");\n return payload;\n}\n\n// ---------------------------------------------------------------------------\n// Minting sign-in tokens for OTHER Firebase projects (e.g. INSAKA)\n// ---------------------------------------------------------------------------\n// A Firebase \"custom token\" is just a signed JWT in a specific shape — Google\n// never has to be called to create one, unlike the OAuth2 access tokens above.\n// Any app holding a project's service account key can mint one for any uid\n// in that project, and the client redeems it via signInWithCustomToken().\n// This is how a Curie ID login becomes a real, first-class signed-in session\n// inside INSAKA's own separate Firebase project, using INSAKA's own uid\n// space — no changes needed to INSAKA's existing Auth-based security rules.\nasync function mintFirebaseCustomToken(\n projectClientEmail: string,\n projectPrivateKey: string,\n uid: string,\n extraClaims: Record = {},\n) {\n const key = await importPKCS8(projectPrivateKey, \"RS256\");\n const now = Math.floor(Date.now() / 1000);\n return new SignJWT({\n uid,\n claims: extraClaims,\n })\n .setProtectedHeader({ alg: \"RS256\", typ: \"JWT\" })\n .setIssuer(projectClientEmail)\n .setSubject(projectClientEmail)\n .setAudience(\"https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit\")\n .setIssuedAt(now)\n .setExpirationTime(now + 3600)\n .sign(key);\n}\n\n// ---------------------------------------------------------------------------\n// Audit log (feeds the admin dashboard's activity view)\n// ---------------------------------------------------------------------------\n\nasync function logEvent(type: string, curieId: string | null, meta: Record = {}) {\n const token = await getGoogleAccessToken();\n try {\n await fetch(`${FIRESTORE_BASE}/AuditLog`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ fields: toFirestoreFields({ type, curieId, meta, createdAt: new Date() }) }),\n });\n } catch (e) {\n console.error(\"Failed to write audit log:\", e); // never block the actual request over this\n }\n}\n\n// ---------------------------------------------------------------------------\n// Admin auth — separate token type from user sessions, gated by ADMIN_PASSWORD\n// ---------------------------------------------------------------------------\n\nasync function issueAdminToken() {\n return new SignJWT({ scope: \"admin\" })\n .setProtectedHeader({ alg: \"HS256\", typ: \"JWT\" })\n .setIssuedAt()\n .setExpirationTime(\"4h\")\n .setIssuer(\"curie-id-admin\")\n .setAudience(\"curie-admin-dashboard\")\n .sign(getSecretBytes());\n}\n\nasync function authenticateAdmin(req: Request) {\n const header = req.headers.get(\"authorization\") || \"\";\n if (!header.startsWith(\"Bearer \")) throw new Error(\"Missing bearer token\");\n const { payload } = await jwtVerify(header.slice(7), getSecretBytes(), {\n issuer: \"curie-id-admin\",\n audience: \"curie-admin-dashboard\",\n });\n if (payload.scope !== \"admin\") throw new Error(\"Not an admin token\");\n return payload;\n}\n\nfunction publicUser(data: Record) {\n return {\n curieId: data.curieId,\n username: data.username || null,\n displayName: data.displayName || \"\",\n countryCode: data.countryCode || null,\n createdAt: data.createdAt || null,\n };\n}\n\n// ---------------------------------------------------------------------------\n// Login rate limiting (existing account brute-force protection)\n// ---------------------------------------------------------------------------\n\nasync function isRateLimited(curieId: string) {\n const doc = await getDoc(`LoginAttempts/${curieId}`);\n if (!doc) return false;\n return !!(doc.lockedUntil && new Date(doc.lockedUntil).getTime() > Date.now());\n}\n\nasync function recordFailedLogin(curieId: string) {\n const doc = (await getDoc(`LoginAttempts/${curieId}`)) || { failedCount: 0 };\n const failedCount = (doc.failedCount || 0) + 1;\n const update: Record = { failedCount };\n if (failedCount >= 5) update.lockedUntil = new Date(Date.now() + 15 * 60 * 1000);\n try {\n await createDoc(\"LoginAttempts\", curieId, update);\n } catch {\n await patchDoc(`LoginAttempts/${curieId}`, update);\n }\n}\n\nasync function clearFailedLogins(curieId: string) {\n await deleteDoc(`LoginAttempts/${curieId}`);\n}\n\n// ---------------------------------------------------------------------------\n// Simple per-IP throttle for /register/start (no account exists yet to lock)\n// ---------------------------------------------------------------------------\n\nasync function isRegisterThrottled(ip: string) {\n const doc = await getDoc(`RegisterAttempts/${ip.replace(/[.:]/g, \"_\")}`);\n if (!doc) return false;\n return !!(doc.lockedUntil && new Date(doc.lockedUntil).getTime() > Date.now());\n}\n\nasync function recordRegisterAttempt(ip: string) {\n const key = ip.replace(/[.:]/g, \"_\");\n const doc = (await getDoc(`RegisterAttempts/${key}`)) || { count: 0 };\n const count = (doc.count || 0) + 1;\n const update: Record = { count };\n if (count >= 5) update.lockedUntil = new Date(Date.now() + 15 * 60 * 1000);\n try {\n await createDoc(\"RegisterAttempts\", key, update);\n } catch {\n await patchDoc(`RegisterAttempts/${key}`, update);\n }\n}\n\n// ---------------------------------------------------------------------------\n// HTTP handler\n// ---------------------------------------------------------------------------\n\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\", \"Access-Control-Allow-Origin\": \"*\" },\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,Authorization\",\n },\n });\n }\n\n try {\n // Health check --------------------------------------------------------\n if (req.method === \"GET\" && path === \"/\") {\n return json({ service: \"Curie ID\", status: \"online\" });\n }\n\n // GET /register/check-username -------------------------------------------\n if (req.method === \"GET\" && path === \"/register/check-username\") {\n const username = normalizeUsername(url.searchParams.get(\"username\"));\n if (!isValidUsername(username)) {\n return json({ available: false, error: \"3-20 characters, lowercase letters/numbers/underscore only\" }, 400);\n }\n const existing = await getDoc(`Usernames/${username}`);\n return json({ available: !existing });\n }\n\n // POST /register/start -------------------------------------------------\n // First-time signup activates the account immediately — no code required.\n // Verification only ever happens later, when logging in from a device\n // this account hasn't used before (see POST /login below).\n if (req.method === \"POST\" && path === \"/register/start\") {\n const ip = req.headers.get(\"x-forwarded-for\") || \"unknown\";\n if (await isRegisterThrottled(ip)) {\n return json({ error: \"Too many attempts. Try again later.\" }, 429);\n }\n\n const { displayName, username: rawUsername, password, deviceId, fcmToken } = await req.json();\n const username = normalizeUsername(rawUsername);\n\n if (!displayName || !isStrongPassword(password) || !deviceId) {\n await recordRegisterAttempt(ip);\n return json({ error: \"displayName, a strong password, and deviceId are required\" }, 400);\n }\n if (!isValidUsername(username)) {\n await recordRegisterAttempt(ip);\n return json({ error: \"Username must be 3-20 characters: lowercase letters, numbers, underscore only\" }, 400);\n }\n\n const curieId = await generateUniqueCurieId();\n\n // Reserve the username first — if someone else already has it, fail fast\n // before creating any auth user or account.\n try {\n await createDoc(\"Usernames\", username, { curieId });\n } catch (e) {\n await recordRegisterAttempt(ip);\n return json({ error: \"That username is already taken. Please choose another.\" }, 409);\n }\n\n let authUid: string;\n try {\n authUid = await createAuthUser(curieId, password, String(displayName).trim().slice(0, 100));\n } catch (e) {\n await deleteDoc(`Usernames/${username}`);\n return json({ error: \"Could not create account\" }, 400);\n }\n\n // fcmToken is optional here — it's a nice-to-have so this device can receive\n // approval pushes for FUTURE logins from other devices. Not having one yet\n // doesn't block account creation; it just means this device can't approve\n // other logins until it gets a working push token some other way.\n try {\n await createDoc(\"Users\", curieId, {\n curieId,\n username,\n authUid,\n displayName: String(displayName).trim().slice(0, 100),\n status: \"active\",\n trustedDevices: [{ deviceId, fcmToken: fcmToken || null, addedAt: new Date() }],\n createdAt: new Date(),\n });\n } catch (e) {\n await deleteAuthUserByUid(authUid);\n await deleteDoc(`Usernames/${username}`);\n return json({ error: \"Could not create account, please try again\" }, 500);\n }\n\n await logEvent(\"register\", curieId, { ip, username, hasPushToken: !!fcmToken });\n await recordRegisterAttempt(ip);\n\n const token = await issueAccessToken(curieId);\n return json({ accessToken: token, tokenType: \"Bearer\", expiresIn: TOKEN_TTL_SECONDS, curieId }, 201);\n }\n\n // POST /login -------------------------------------------------------------\n if (req.method === \"POST\" && path === \"/login\") {\n const { curieId: rawId, identifier: rawIdentifier, password, deviceId, fcmToken } = await req.json();\n const raw = normalizeCurieId(rawIdentifier ?? rawId); // accepts either field name\n\n if (!raw || typeof password !== \"string\" || !deviceId) {\n return json({ error: \"Invalid login request\" }, 400);\n }\n\n // Accept either the 9-digit Curie ID directly, or a username that resolves to one.\n let curieId: string;\n if (isValidCurieId(raw)) {\n curieId = raw;\n } else if (isValidUsername(raw)) {\n const usernameDoc = await getDoc(`Usernames/${raw}`);\n if (!usernameDoc) return json({ error: \"Invalid Curie ID/username or password\" }, 401);\n curieId = usernameDoc.curieId;\n } else {\n return json({ error: \"Invalid login request\" }, 400);\n }\n\n if (await isRateLimited(curieId)) {\n return json({ error: \"Too many failed attempts. Try again later.\" }, 429);\n }\n\n try {\n await firebasePasswordLogin(curieId, password);\n } catch {\n await recordFailedLogin(curieId);\n return json({ error: \"Invalid Curie ID/username or password\" }, 401);\n }\n await clearFailedLogins(curieId);\n\n const user = await getDoc(`Users/${curieId}`);\n if (!user || user.status === \"deleted\") {\n return json({ error: \"Account not found\" }, 403);\n }\n if (user.status === \"suspended\") {\n await logEvent(\"login_denied_suspended\", curieId, { deviceId });\n return json({ error: \"This account has been suspended\" }, 403);\n }\n if (user.status !== \"active\") {\n return json({ error: \"Account not verified\" }, 403);\n }\n\n const trusted = (user.trustedDevices || []).find((d: any) => d.deviceId === deviceId);\n if (trusted) {\n const token = await issueAccessToken(curieId);\n await logEvent(\"login_success\", curieId, { deviceId });\n return json({ accessToken: token, tokenType: \"Bearer\", expiresIn: TOKEN_TTL_SECONDS, curieId });\n }\n\n // Unrecognized device — push an approval request to every trusted device.\n const approvalId = crypto.randomUUID();\n await createDoc(\"LoginApprovals\", approvalId, {\n curieId,\n newDeviceId: deviceId,\n newDeviceFcmToken: fcmToken || null,\n status: \"pending\",\n createdAt: new Date(),\n expiresAt: new Date(Date.now() + APPROVAL_TTL_MS),\n });\n\n for (const d of user.trustedDevices || []) {\n await sendPush(d.fcmToken, \"New Curie ID login\", \"Approve this login from a new device?\", {\n type: \"login_approval\",\n approvalId,\n curieId,\n });\n }\n\n await logEvent(\"login_approval_requested\", curieId, { deviceId, approvalId });\n return json({ status: \"pending_approval\", approvalId }, 202);\n }\n\n // GET /login/status/:approvalId --------------------------------------\n const statusMatch = path.match(/^\\/login\\/status\\/([a-zA-Z0-9-]+)$/);\n if (req.method === \"GET\" && statusMatch) {\n const approval = await getDoc(`LoginApprovals/${statusMatch[1]}`);\n if (!approval) return json({ error: \"Not found\" }, 404);\n\n if (approval.status === \"approved\") {\n const token = await issueAccessToken(approval.curieId);\n return json({ status: \"approved\", accessToken: token, tokenType: \"Bearer\", expiresIn: TOKEN_TTL_SECONDS, curieId: approval.curieId });\n }\n if (approval.status === \"denied\" || new Date(approval.expiresAt).getTime() < Date.now()) {\n return json({ status: \"denied\" });\n }\n return json({ status: \"pending\" }, 202);\n }\n\n // POST /login/approve --------------------------------------------------\n if (req.method === \"POST\" && path === \"/login/approve\") {\n const { approvalId, approverDeviceId, decision } = await req.json();\n if (!approvalId || !approverDeviceId || ![\"approve\", \"deny\"].includes(decision)) {\n return json({ error: \"approvalId, approverDeviceId, decision are required\" }, 400);\n }\n\n const approval = await getDoc(`LoginApprovals/${approvalId}`);\n if (!approval || approval.status !== \"pending\") return json({ error: \"Not found or already resolved\" }, 404);\n\n const user = await getDoc(`Users/${approval.curieId}`);\n const isTrusted = (user?.trustedDevices || []).some((d: any) => d.deviceId === approverDeviceId);\n if (!isTrusted) return json({ error: \"Not authorized to approve this login\" }, 403);\n\n if (decision === \"approve\") {\n const newDevices = [\n ...(user.trustedDevices || []),\n { deviceId: approval.newDeviceId, fcmToken: approval.newDeviceFcmToken, addedAt: new Date() },\n ];\n await patchDoc(`Users/${approval.curieId}`, { trustedDevices: newDevices });\n await patchDoc(`LoginApprovals/${approvalId}`, { status: \"approved\" });\n await logEvent(\"login_approved\", approval.curieId, { newDeviceId: approval.newDeviceId, approverDeviceId });\n } else {\n await patchDoc(`LoginApprovals/${approvalId}`, { status: \"denied\" });\n await logEvent(\"login_denied_by_user\", approval.curieId, { newDeviceId: approval.newDeviceId, approverDeviceId });\n }\n\n return json({ ok: true });\n }\n\n // -----------------------------------------------------------------------\n // ADMIN ROUTES\n // -----------------------------------------------------------------------\n\n // POST /admin/login -------------------------------------------------------\n if (req.method === \"POST\" && path === \"/admin/login\") {\n const { password } = await req.json();\n if (!password || password !== ADMIN_PASSWORD) {\n return json({ error: \"Invalid password\" }, 401);\n }\n const token = await issueAdminToken();\n return json({ accessToken: token, tokenType: \"Bearer\" });\n }\n\n // Everything else under /admin/ requires a valid admin token.\n if (path.startsWith(\"/admin/\")) {\n try {\n await authenticateAdmin(req);\n } catch {\n return json({ error: \"Admin authentication required\" }, 401);\n }\n\n // GET /admin/users?query= --------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/users\") {\n const query = (url.searchParams.get(\"query\") || \"\").trim();\n const limit = Math.min(parseInt(url.searchParams.get(\"limit\") || \"50\", 10), 100);\n\n let users;\n if (isValidCurieId(normalizeCurieId(query))) {\n const one = await getDoc(`Users/${normalizeCurieId(query)}`);\n users = one ? [{ id: normalizeCurieId(query), ...one }] : [];\n } else if (query) {\n // Try an exact username match first; if that misses, fall through to a\n // display-name prefix search rather than assuming \"looks like a username\"\n // means \"is a username\" — plenty of real names match that same pattern.\n const usernameMapping = isValidUsername(normalizeUsername(query))\n ? await getDoc(`Usernames/${normalizeUsername(query)}`)\n : null;\n\n if (usernameMapping) {\n const one = await getDoc(`Users/${usernameMapping.curieId}`);\n users = one ? [one] : [];\n } else {\n users = await runQuery(\"Users\", {\n where: { field: \"displayName\", op: \"GREATER_THAN_OR_EQUAL\", value: query },\n orderBy: { field: \"displayName\", direction: \"ASCENDING\" },\n limit,\n });\n users = users.filter((u: any) => (u.displayName || \"\").toLowerCase().startsWith(query.toLowerCase()));\n }\n } else {\n users = await runQuery(\"Users\", { orderBy: { field: \"createdAt\", direction: \"DESCENDING\" }, limit });\n }\n\n return json({\n users: users.map((u: any) => ({\n curieId: u.curieId,\n username: u.username || null,\n displayName: u.displayName,\n status: u.status,\n createdAt: u.createdAt,\n deviceCount: (u.trustedDevices || []).length,\n })),\n });\n }\n\n // GET /admin/users/:curieId ------------------------------------------\n const adminUserMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && adminUserMatch) {\n const user = await getDoc(`Users/${adminUserMatch[1]}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n return json({\n curieId: user.curieId,\n displayName: user.displayName,\n status: user.status,\n createdAt: user.createdAt,\n trustedDevices: user.trustedDevices || [],\n });\n }\n\n // POST /admin/users/:curieId/suspend ----------------------------------\n const suspendMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/suspend$/);\n if (req.method === \"POST\" && suspendMatch) {\n await patchDoc(`Users/${suspendMatch[1]}`, { status: \"suspended\" });\n await logEvent(\"admin_suspend\", suspendMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/activate ---------------------------------\n const activateMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/activate$/);\n if (req.method === \"POST\" && activateMatch) {\n await patchDoc(`Users/${activateMatch[1]}`, { status: \"active\" });\n await logEvent(\"admin_activate\", activateMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/delete ------------------------------------\n // Permanent, hard delete — releases the username and Curie ID so the\n // person (or anyone else) can sign up fresh with either afterward.\n const deleteMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/delete$/);\n if (req.method === \"POST\" && deleteMatch) {\n const curieId = deleteMatch[1];\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n\n if (user.authUid) {\n try {\n await deleteAuthUserByUid(user.authUid);\n } catch (e) {\n console.error(\"Failed to delete underlying auth credential:\", e);\n }\n }\n if (user.username) {\n await deleteDoc(`Usernames/${user.username}`);\n }\n await deleteDoc(`Users/${curieId}`);\n await deleteDoc(`LoginAttempts/${curieId}`);\n await logEvent(\"admin_delete\", curieId, { username: user.username || null });\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/devices/:deviceId/revoke ------------------\n const revokeMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/devices\\/([^/]+)\\/revoke$/);\n if (req.method === \"POST\" && revokeMatch) {\n const [, curieId, deviceId] = revokeMatch;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n const remaining = (user.trustedDevices || []).filter((d: any) => d.deviceId !== deviceId);\n await patchDoc(`Users/${curieId}`, { trustedDevices: remaining });\n await logEvent(\"admin_revoke_device\", curieId, { deviceId });\n return json({ ok: true });\n }\n\n // GET /admin/logs ---------------------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/logs\") {\n const limit = Math.min(parseInt(url.searchParams.get(\"limit\") || \"100\", 10), 200);\n const events = await runQuery(\"AuditLog\", { orderBy: { field: \"createdAt\", direction: \"DESCENDING\" }, limit });\n return json({ events });\n }\n\n // -----------------------------------------------------------------------\n // INSAKA admin — announcements, reports, safety monitoring\n // All of this reads/writes INSAKA's Realtime Database directly, using\n // INSAKA's own service account (admin access, bypasses INSAKA's rules).\n // -----------------------------------------------------------------------\n\n // POST /admin/insaka/announcements -------------------------------------\n // Posts as an official Kashimi (Stories) item under a reserved uid every\n // INSAKA client always subscribes to — so it renders through INSAKA's\n // existing Stories viewer with zero special-case UI needed, and expires\n // after 24h the same way a normal story does.\n if (req.method === \"POST\" && path === \"/admin/insaka/announcements\") {\n const { title, message } = await req.json();\n if (!title || !message) return json({ error: \"title and message are required\" }, 400);\n\n const result = await insakaRtdb(\"POST\", \"kashimi/insaka_official\", {\n uid: \"insaka_official\",\n type: \"text\",\n text: String(message).slice(0, 500),\n caption: String(title).slice(0, 200),\n bgColor: \"#0a6b5a\",\n createdAt: Date.now(),\n });\n await logEvent(\"insaka_announcement_posted\", null, { title });\n return json({ ok: true, id: result.name });\n }\n\n // GET /admin/insaka/announcements ---------------------------------------\n if (req.method === \"GET\" && path === \"/admin/insaka/announcements\") {\n const raw = (await insakaRtdb(\"GET\", \"kashimi/insaka_official\")) || {};\n const announcements = Object.entries(raw)\n .map(([id, a]: [string, any]) => ({ id, ...a }))\n .sort((a: any, b: any) => b.createdAt - a.createdAt);\n return json({ announcements });\n }\n\n // POST /admin/insaka/announcements/:id/delete ----------------------------\n const deleteAnnouncementMatch = path.match(/^\\/admin\\/insaka\\/announcements\\/([^/]+)\\/delete$/);\n if (req.method === \"POST\" && deleteAnnouncementMatch) {\n await insakaRtdb(\"DELETE\", `kashimi/insaka_official/${deleteAnnouncementMatch[1]}`);\n await logEvent(\"insaka_announcement_deleted\", null, { id: deleteAnnouncementMatch[1] });\n return json({ ok: true });\n }\n\n // GET /admin/insaka/reports?status= ---------------------------------------\n if (req.method === \"GET\" && path === \"/admin/insaka/reports\") {\n const statusFilter = url.searchParams.get(\"status\");\n const raw = (await insakaRtdb(\"GET\", \"reports\")) || {};\n let reports = Object.entries(raw).map(([id, r]: [string, any]) => ({ id, ...r }));\n if (statusFilter) reports = reports.filter((r: any) => (r.status || \"open\") === statusFilter);\n reports.sort((a: any, b: any) => (b.createdAt || 0) - (a.createdAt || 0));\n return json({ reports });\n }\n\n // POST /admin/insaka/reports/:id/resolve -----------------------------------\n const resolveReportMatch = path.match(/^\\/admin\\/insaka\\/reports\\/([^/]+)\\/resolve$/);\n if (req.method === \"POST\" && resolveReportMatch) {\n const { status, note, blockReportedUser } = await req.json();\n if (![\"reviewed\", \"dismissed\", \"actioned\"].includes(status)) {\n return json({ error: \"status must be reviewed, dismissed, or actioned\" }, 400);\n }\n const reportId = resolveReportMatch[1];\n const report = await insakaRtdb(\"GET\", `reports/${reportId}`);\n if (!report) return json({ error: \"Report not found\" }, 404);\n\n await insakaRtdb(\"PATCH\", `reports/${reportId}`, {\n status,\n adminNote: note || null,\n resolvedAt: Date.now(),\n });\n\n // Optional: admin can force-suspend the account being reported, on\n // top of whatever the reporter's own personal block already covers.\n if (blockReportedUser && report.reportedUid) {\n await insakaRtdb(\"PATCH\", `users/${report.reportedUid}`, { suspended: true });\n }\n\n await logEvent(\"insaka_report_resolved\", null, { reportId, status });\n return json({ ok: true });\n }\n\n // GET /admin/insaka/stats --------------------------------------------------\n // Simple safety trend: reports filed and resolved this week vs last week.\n if (req.method === \"GET\" && path === \"/admin/insaka/stats\") {\n const raw = (await insakaRtdb(\"GET\", \"reports\")) || {};\n const reports: any[] = Object.values(raw);\n const now = Date.now();\n const WEEK = 7 * 24 * 60 * 60 * 1000;\n const thisWeek = reports.filter((r) => r.createdAt >= now - WEEK);\n const lastWeek = reports.filter((r) => r.createdAt >= now - 2 * WEEK && r.createdAt < now - WEEK);\n\n return json({\n totalReports: reports.length,\n openReports: reports.filter((r) => (r.status || \"open\") === \"open\").length,\n resolvedReports: reports.filter((r) => [\"reviewed\", \"dismissed\", \"actioned\"].includes(r.status)).length,\n actionedReports: reports.filter((r) => r.status === \"actioned\").length,\n reportsThisWeek: thisWeek.length,\n reportsLastWeek: lastWeek.length,\n reasonBreakdown: reports.reduce((acc: Record, r) => {\n const reason = r.reason || \"unspecified\";\n acc[reason] = (acc[reason] || 0) + 1;\n return acc;\n }, {}),\n });\n }\n\n return json({ error: \"Not found\" }, 404);\n }\n\n // POST /verify-token ----------------------------------------------------\n if (req.method === \"POST\" && path === \"/verify-token\") {\n const payload = await authenticate(req);\n return json({ valid: true, curieId: payload.curieId, expiresAt: payload.exp });\n }\n\n // GET /me -----------------------------------------------------------------\n if (req.method === \"GET\" && path === \"/me\") {\n const payload = await authenticate(req);\n const user = await getDoc(`Users/${payload.curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n // POST /mint-app-token ------------------------------------------------------\n // Called by another app's own frontend (e.g. INSAKA) after it receives a\n // Curie access token via the redirect-back flow. Verifies the token, then\n // mints a real Firebase Auth custom token for that app's OWN project, using\n // the Curie ID as the uid. The app signs in with it via\n // signInWithCustomToken() — a real, first-class session in ITS OWN Firebase\n // project, so nothing about how that app already works has to change.\n if (req.method === \"POST\" && path === \"/mint-app-token\") {\n const payload = await authenticate(req);\n const { app } = await req.json();\n\n if (app !== \"insaka\") return json({ error: \"Unknown app\" }, 400);\n if (!INSAKA_FIREBASE_PROJECT_ID || !INSAKA_FIREBASE_CLIENT_EMAIL || !INSAKA_FIREBASE_PRIVATE_KEY) {\n return json({ error: \"INSAKA integration is not configured on this server\" }, 501);\n }\n\n const curieId = payload.curieId as string;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n\n const customToken = await mintFirebaseCustomToken(\n INSAKA_FIREBASE_CLIENT_EMAIL,\n INSAKA_FIREBASE_PRIVATE_KEY,\n curieId, // becomes the uid inside INSAKA's Firebase project\n { curieUsername: user.username || null, curieDisplayName: user.displayName || null },\n );\n\n await logEvent(\"mint_app_token\", curieId, { app });\n return json({\n customToken,\n curieId,\n username: user.username || null,\n displayName: user.displayName || \"\",\n });\n }\n\n // GET /user/:curieId ---------------------------------------------------\n const publicMatch = path.match(/^\\/user\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && publicMatch) {\n const user = await getDoc(`Users/${publicMatch[1]}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n return json({ error: \"Not found\" }, 404);\n } catch (err) {\n console.error(err);\n return json({ error: \"Internal server error\" }, 500);\n }\n}","createdAt",["D",1788947245347],"branchVersion","branchId","2c04a53e-0cd9-4938-a6f5-b437131ee544","id","45ec6b4d-76f2-43a3-b881-a7aaf9187167","curie-ID",["D",1788579388689],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","860f2044-8a7f-4d4f-b481-eca89f0a8cf2","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019fb42d-289d-76eb-8026-f986896fa425","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",27,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","rocurity","handle","displayName","Rocurity","avatar","https://lh3.googleusercontent.com/a/ACg8ocI77drc4gWKU5gaAhxupzRpDqO2PN5OtCM-f_7zVnsNaWomkd0=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":151,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":152,"_80":153,"_82":154,"_84":25},"tree",[146],"files",[146],"counts",{"_134":62,"_135":136,"_137":62,"_138":139,"_140":141},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_27":133},"9a08e302-1711-4dcb-8e08-931bac8f8176","parentId","latest",["D",1788947245347],15,"label",[28],"pulls","branches",1,"forks","envVars",{"_142":144,"_145":62},"connections",{"_142":62,"_143":62},"count","unfilledCount",14,"emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":147,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_148":149,"_27":150},["D",1788947245347],"children",[],[28],["D",1788579388689],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_123":188,"_189":190,"_191":192,"_193":25,"_194":25,"_195":25,"_196":58,"_197":-5,"_198":-7,"_199":-7,"_200":62,"_201":25,"_202":25,"_203":-5,"_204":25,"_205":25,"_206":25,"_207":-5},"ENV",{"_159":160,"_161":162,"_163":86,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v16