Your Curie ID (${curieId}) password reset code is:

${code}

This code expires in 15 minutes. If you didn't request this, you can ignore this email.

`,\n );\n await logEvent(\"password_reset_requested\", curieId, { emailSent: sent });\n }\n }\n\n return json({ ok: true });\n }\n\n // POST /reset-password -----------------------------------------------------\n if (req.method === \"POST\" && path === \"/reset-password\") {\n const { identifier: rawIdentifier, code, newPassword } = await req.json();\n const raw = normalizeCurieId(rawIdentifier);\n\n let curieId: string | null = null;\n if (isValidCurieId(raw)) {\n curieId = raw;\n } else if (isValidUsername(raw)) {\n const usernameDoc = await getDoc(`Usernames/${raw}`);\n if (usernameDoc) curieId = usernameDoc.curieId;\n }\n if (!curieId || !code || !isStrongPassword(newPassword)) {\n return json({ error: \"Invalid reset request\" }, 400);\n }\n\n const reset = await getDoc(`PasswordResets/${curieId}`);\n if (\n !reset || reset.code !== code ||\n new Date(reset.expiresAt).getTime() < Date.now()\n ) {\n return json({ error: \"That code is invalid or has expired\" }, 400);\n }\n\n const user = await getDoc(`Users/${curieId}`);\n if (!user || !user.authUid) {\n return json({ error: \"Account not found\" }, 404);\n }\n\n await adminSetPassword(user.authUid, newPassword);\n await deleteDoc(`PasswordResets/${curieId}`);\n await clearFailedLogins(curieId);\n await logEvent(\"password_reset_completed\", curieId, {});\n\n return json({ ok: true });\n }\n\n // -----------------------------------------------------------------------\n // ADMIN ROUTES\n // -----------------------------------------------------------------------\n\n // POST /admin/login -------------------------------------------------------\n if (req.method === \"POST\" && path === \"/admin/login\") {\n const { password } = await req.json();\n if (!password || password !== ADMIN_PASSWORD) {\n return json({ error: \"Invalid password\" }, 401);\n }\n const token = await issueAdminToken();\n return json({ accessToken: token, tokenType: \"Bearer\" });\n }\n\n // Everything else under /admin/ requires a valid admin token.\n if (path.startsWith(\"/admin/\")) {\n try {\n await authenticateAdmin(req);\n } catch {\n return json({ error: \"Admin authentication required\" }, 401);\n }\n\n // GET /admin/users?query= --------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/users\") {\n const query = (url.searchParams.get(\"query\") || \"\").trim();\n const limit = Math.min(\n parseInt(url.searchParams.get(\"limit\") || \"50\", 10),\n 100,\n );\n\n let users;\n if (isValidCurieId(normalizeCurieId(query))) {\n const one = await getDoc(`Users/${normalizeCurieId(query)}`);\n users = one ? [{ id: normalizeCurieId(query), ...one }] : [];\n } else if (query) {\n const usernameMapping = isValidUsername(normalizeUsername(query))\n ? await getDoc(`Usernames/${normalizeUsername(query)}`)\n : null;\n\n if (usernameMapping) {\n const one = await getDoc(`Users/${usernameMapping.curieId}`);\n users = one ? [one] : [];\n } else {\n users = await runQuery(\"Users\", {\n where: {\n field: \"displayName\",\n op: \"GREATER_THAN_OR_EQUAL\",\n value: query,\n },\n orderBy: { field: \"displayName\", direction: \"ASCENDING\" },\n limit,\n });\n users = users.filter((u: any) =>\n (u.displayName || \"\").toLowerCase().startsWith(\n query.toLowerCase(),\n )\n );\n }\n } else {\n users = await runQuery(\"Users\", {\n orderBy: { field: \"createdAt\", direction: \"DESCENDING\" },\n limit,\n });\n }\n\n return json({\n users: users.map((u: any) => ({\n curieId: u.curieId,\n username: u.username || null,\n displayName: u.displayName,\n status: u.status,\n createdAt: u.createdAt,\n deviceCount: (u.trustedDevices || []).length,\n })),\n });\n }\n\n // GET /admin/users/:curieId ------------------------------------------\n const adminUserMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && adminUserMatch) {\n const user = await getDoc(`Users/${adminUserMatch[1]}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n return json({\n curieId: user.curieId,\n displayName: user.displayName,\n status: user.status,\n createdAt: user.createdAt,\n trustedDevices: user.trustedDevices || [],\n });\n }\n\n // POST /admin/users/:curieId/suspend ----------------------------------\n const suspendMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/suspend$/);\n if (req.method === \"POST\" && suspendMatch) {\n await patchDoc(`Users/${suspendMatch[1]}`, { status: \"suspended\" });\n await logEvent(\"admin_suspend\", suspendMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/activate ---------------------------------\n const activateMatch = path.match(\n /^\\/admin\\/users\\/([0-9]{9}c)\\/activate$/,\n );\n if (req.method === \"POST\" && activateMatch) {\n await patchDoc(`Users/${activateMatch[1]}`, { status: \"active\" });\n await logEvent(\"admin_activate\", activateMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/delete ------------------------------------\n const deleteMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/delete$/);\n if (req.method === \"POST\" && deleteMatch) {\n const curieId = deleteMatch[1];\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n\n if (user.authUid) {\n try {\n await deleteAuthUserByUid(user.authUid);\n } catch (e) {\n console.error(\"Failed to delete underlying auth credential:\", e);\n }\n }\n if (user.username) {\n await deleteDoc(`Usernames/${user.username}`);\n }\n await deleteDoc(`Users/${curieId}`);\n await deleteDoc(`LoginAttempts/${curieId}`);\n await logEvent(\"admin_delete\", curieId, {\n username: user.username || null,\n });\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/devices/:deviceId/revoke ------------------\n const revokeMatch = path.match(\n /^\\/admin\\/users\\/([0-9]{9}c)\\/devices\\/([^/]+)\\/revoke$/,\n );\n if (req.method === \"POST\" && revokeMatch) {\n const [, curieId, deviceId] = revokeMatch;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n const remaining = (user.trustedDevices || []).filter((d: any) =>\n d.deviceId !== deviceId\n );\n await patchDoc(`Users/${curieId}`, { trustedDevices: remaining });\n await logEvent(\"admin_revoke_device\", curieId, { deviceId });\n return json({ ok: true });\n }\n\n // GET /admin/logs ---------------------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/logs\") {\n const limit = Math.min(\n parseInt(url.searchParams.get(\"limit\") || \"100\", 10),\n 200,\n );\n const events = await runQuery(\"AuditLog\", {\n orderBy: { field: \"createdAt\", direction: \"DESCENDING\" },\n limit,\n });\n return json({ events });\n }\n\n return json({ error: \"Not found\" }, 404);\n }\n\n // POST /verify-token ----------------------------------------------------\n if (req.method === \"POST\" && path === \"/verify-token\") {\n const payload = await authenticate(req);\n return json({\n valid: true,\n curieId: payload.curieId,\n expiresAt: payload.exp,\n });\n }\n\n // GET /me -----------------------------------------------------------------\n if (req.method === \"GET\" && path === \"/me\") {\n const payload = await authenticate(req);\n const user = await getDoc(`Users/${payload.curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n // POST /mint-app-token ------------------------------------------------------\n // Looks the requested app up in a small credentials table instead of\n // hardcoding a single app, so new apps (like Tushimi) can be added just\n // by adding env vars + a new entry here — no other endpoint changes.\n if (req.method === \"POST\" && path === \"/mint-app-token\") {\n const payload = await authenticate(req);\n const { app } = await req.json();\n\n const APP_CREDENTIALS: Record<\n string,\n { projectId: string; clientEmail: string; privateKey: string }\n > = {\n insaka: {\n projectId: INSAKA_FIREBASE_PROJECT_ID,\n clientEmail: INSAKA_FIREBASE_CLIENT_EMAIL,\n privateKey: INSAKA_FIREBASE_PRIVATE_KEY,\n },\n tushimi: {\n projectId: TUSHIMI_FIREBASE_PROJECT_ID,\n clientEmail: TUSHIMI_FIREBASE_CLIENT_EMAIL,\n privateKey: TUSHIMI_FIREBASE_PRIVATE_KEY,\n },\n };\n\n const creds = APP_CREDENTIALS[app];\n if (!creds) return json({ error: \"Unknown app\" }, 400);\n if (!creds.projectId || !creds.clientEmail || !creds.privateKey) {\n return json({\n error: `${app} integration is not configured on this server`,\n }, 501);\n }\n\n const curieId = payload.curieId as string;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n\n const customToken = await mintFirebaseCustomToken(\n creds.clientEmail,\n creds.privateKey,\n curieId, // becomes the uid inside the target app's Firebase project\n {\n curieUsername: user.username || null,\n curieDisplayName: user.displayName || null,\n },\n );\n\n await logEvent(\"mint_app_token\", curieId, { app });\n return json({\n customToken,\n curieId,\n username: user.username || null,\n displayName: user.displayName || \"\",\n });\n }\n\n // GET /user/:curieId ---------------------------------------------------\n const publicMatch = path.match(/^\\/user\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && publicMatch) {\n const user = await getDoc(`Users/${publicMatch[1]}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n return json({ error: \"Not found\" }, 404);\n } catch (err) {\n console.error(err);\n return json({ error: \"Internal server error\" }, 500);\n }\n}","deleted","label",[115],"pulls",1,"forks","envVars",{"_137":139,"_140":54},"connections",{"_137":54,"_138":54},"count","unfilledCount",14,"emptyCount",{"_20":114,"_13":115,"_116":48,"_117":-5,"_118":21,"_119":30,"_120":50,"_22":142,"_29":122,"_123":124,"_125":126,"_127":38,"_128":-5,"_143":144,"_91":145},["D",1789185672616],"children",[],[115],["D",1788579388689],{"_11":12,"_89":85},{"_11":12,"_82":83,"_84":85,"_45":46,"_86":87,"_88":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_77":-5,"_78":-5,"_79":-5,"_80":14,"_81":12},"ctx",{"_70":-5,"_110":183,"_184":185,"_186":187,"_188":38,"_189":38,"_190":38,"_191":50,"_192":-5,"_193":-7,"_194":-7,"_195":54,"_196":38,"_197":38,"_198":-5,"_199":38,"_200":38,"_201":38,"_202":-5},"ENV",{"_154":155,"_156":157,"_158":26,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1