[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_116":-5,"_20":117,"_22":118,"_119":120,"_121":122,"_25":123,"_24":-5,"_124":-5,"_125":-5,"_126":53,"_127":128,"_129":44,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","soremo","name","Stundenplan","branchName","main","version","path","","project",{"_33":62,"_13":14,"_45":63,"_64":-5,"_65":53,"_66":67,"_68":67,"_69":-5,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":44,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":95,"_96":97,"_98":99,"_100":53},"tree",[57],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_18":56},"id","4f5eb241-98b9-4f30-b340-26499dce2da8","main.ts","fileId","c3f23e38-b026-11f0-89c2-0224a6c84d84","parentId","branchId","c3ee8a9a-b026-11f0-89c2-0224a6c84d84","branchVersion",33,"latest",true,"createdAt",["D",1789369559602],32,"fileType","http","content","import { Hono } from \"npm:hono@3\";\nimport ical from \"npm:ical-generator@9\";\n\n// ── Konfiguration ──────────────────────────────────────────────\nconst SCHOOL = Deno.env.get(\"untis_school\")!;\nconst USER = Deno.env.get(\"untis_user\")!;\nconst PASSWORD = Deno.env.get(\"untis_password\")!;\nconst BASEURL = Deno.env.get(\"untis_baseurl\")!;\nconst ACCESS_TOKEN = Deno.env.get(\"untis_access_token\") ?? \"\";\n\nconst ORIGIN = `https://${BASEURL}`;\n\n// WebUntis element types (durchgängig verwendete Konvention)\nconst TYPE = { CLASS: 1, TEACHER: 2, SUBJECT: 3, ROOM: 4, STUDENT: 5 } as const;\n\n// ── Zugriffsschutz ────────────────────────────────────────────\n// Gilt für ALLE Endpunkte inkl. /calendar.ics - die Daten dahinter\n// sind personenbezogen, nicht nur die Debug-Routen.\nfunction requireToken(c: any): Response | null {\n if (ACCESS_TOKEN && c.req.query(\"token\") !== ACCESS_TOKEN) {\n return c.text(\"forbidden\", 403);\n }\n return null;\n}\n\n// ── Cookie-Jar ────────────────────────────────────────────────\nclass CookieJar {\n private jar = new Map();\n\n absorb(res: Response) {\n const raw = typeof res.headers.getSetCookie === \"function\"\n ? res.headers.getSetCookie()\n : (res.headers.get(\"set-cookie\") ? [res.headers.get(\"set-cookie\")!] : []);\n for (const line of raw) {\n const [pair] = line.split(\";\");\n const idx = pair.indexOf(\"=\");\n if (idx > -1) {\n this.jar.set(pair.slice(0, idx).trim(), pair.slice(idx + 1).trim());\n }\n }\n }\n\n get(name: string): string | undefined {\n return this.jar.get(name);\n }\n\n keys(): string[] {\n return [...this.jar.keys()];\n }\n\n header(): string {\n return [...this.jar.entries()].map(([k, v]) => `${k}=${v}`).join(\"; \");\n }\n}\n\n// ── WebUntis REST Client ─────────────────────────────────────\n// Nur Cookie-Login (JSESSIONID) - kein JWT/tenant-id nötig, da sowohl\n// /api/app/config als auch /api/public/timetable/weekly/data mit\n// Session-Cookies auskommen.\nclass WebUntisRest {\n private jar = new CookieJar();\n\n async login() {\n const priming = await fetch(`${ORIGIN}/WebUntis/api/app/config`);\n this.jar.absorb(priming);\n const csrfToken = this.jar.get(\"XSRF-TOKEN\") ??\n this.jar.get(\"Authorization\");\n\n const loginRes = await fetch(`${ORIGIN}/WebUntis/j_spring_security_check`, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Cookie\": this.jar.header(),\n },\n body: new URLSearchParams({\n j_username: USER,\n j_password: PASSWORD,\n school: SCHOOL,\n ...(csrfToken ? { token: csrfToken } : {}),\n }),\n redirect: \"manual\",\n });\n this.jar.absorb(loginRes);\n\n // JSESSIONID existiert schon vor dem Login (anonyme Session) - taugt\n // nicht als Erfolgskriterium. Stattdessen das Redirect-Ziel prüfen:\n // Erfolg -> \"/WebUntis/index.do\", Fehlschlag -> zurück zu webuntis.com\n // mit einem \"hint=...\"-Parameter.\n const location = loginRes.headers.get(\"location\") ?? \"\";\n if (\n loginRes.status !== 302 || location.includes(\"hint=\") ||\n location.includes(\"webuntis.com\")\n ) {\n throw new Error(\n `Login fehlgeschlagen (Status ${loginRes.status}, Redirect: ${\n location || \"keiner\"\n })`,\n );\n }\n }\n\n // Liste der zugänglichen Personen (Kinder). Quelle: webuntis-api-docs, GET /api/app/config\n async getPersons(): Promise<{ id: number; type: number }[]> {\n const res = await fetch(`${ORIGIN}/WebUntis/api/app/config`, {\n headers: { \"Cookie\": this.jar.header() },\n });\n if (!res.ok) {\n throw new Error(`app/config -> ${res.status} ${await res.text()}`);\n }\n const json = await res.json();\n return json?.data?.loginServiceConfig?.user?.persons ?? [];\n }\n\n // Eine einzelne Woche abrufen. date = Montag der Woche, ISO-Format (yyyy-MM-dd) -\n // dieser Endpunkt weicht damit vom sonst üblichen yyyyMMdd-Format ab.\n async getWeek(\n elementType: number,\n elementId: string,\n mondayIso: string,\n formatId = 1,\n ) {\n const params = new URLSearchParams({\n elementType: String(elementType),\n elementId,\n date: mondayIso,\n formatId: String(formatId),\n });\n const res = await fetch(\n `${ORIGIN}/WebUntis/api/public/timetable/weekly/data?${params}`,\n { headers: { \"Cookie\": this.jar.header() } },\n );\n if (!res.ok) {\n throw new Error(`weekly/data -> ${res.status} ${await res.text()}`);\n }\n const json = await res.json();\n if (json?.data?.result?.data?.isSessionTimeout) {\n throw new Error(\n \"Session abgelaufen (isSessionTimeout) - Login erneut nötig\",\n );\n }\n return json?.data?.result?.data;\n }\n}\n\n// ── Zeit-Helper ───────────────────────────────────────────────\nfunction berlinLocalToDate(\n y: number,\n m: number,\n d: number,\n hhmm: number,\n): Date {\n const hh = Math.floor(hhmm / 100);\n const mm = hhmm % 100;\n return new Date(Date.UTC(y, m - 1, d, hh, mm));\n}\n\nfunction parseUntisDate(yyyymmdd: number): [number, number, number] {\n const s = String(yyyymmdd);\n return [Number(s.slice(0, 4)), Number(s.slice(4, 6)), Number(s.slice(6, 8))];\n}\n\n// UTC-konsistent, damit die Berechnung unabhängig von der Zeitzone des\n// Deno-Prozesses immer denselben Montag liefert wie isoDate().\nfunction mondayOf(date: Date): Date {\n const day = date.getUTCDay();\n const diff = day === 0 ? -6 : 1 - day;\n const d = new Date(\n Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()),\n );\n d.setUTCDate(d.getUTCDate() + diff);\n return d;\n}\n\nfunction isoDate(d: Date) {\n return d.toISOString().slice(0, 10);\n}\n\n// ── Mapping: Period + Elements-Lookup -> iCal-Event ─────────────\nfunction buildElementLookup(elements: any[]) {\n const map = new Map();\n for (const el of elements ?? []) map.set(`${el.type}-${el.id}`, el);\n return map;\n}\n\nfunction resolveElement(\n period: any,\n lookup: Map,\n type: number,\n): string {\n const match = period.elements?.find((e: any) => e.type === type);\n if (!match) return \"\";\n const def = lookup.get(`${type}-${match.id}`);\n const name = def?.longName || def?.displayname || def?.name || \"\";\n if (match.orgId && match.orgId !== match.id) {\n const orgDef = lookup.get(`${type}-${match.orgId}`);\n const orgName = orgDef?.longName || orgDef?.displayname || orgDef?.name ||\n \"\";\n if (orgName && orgName !== name) return `${orgName} → ${name}`;\n }\n return name;\n}\n\nfunction mapPeriodToEvent(period: any, lookup: Map) {\n const [y, m, d] = parseUntisDate(period.date);\n const start = berlinLocalToDate(y, m, d, period.startTime);\n const end = berlinLocalToDate(y, m, d, period.endTime);\n\n const subject = resolveElement(period, lookup, TYPE.SUBJECT) ||\n period.lessonText || \"Unterricht\";\n const teacher = resolveElement(period, lookup, TYPE.TEACHER);\n const room = resolveElement(period, lookup, TYPE.ROOM);\n\n const cellState: string = period.cellState ?? \"STANDARD\";\n const prefix = cellState.includes(\"CANCEL\")\n ? \"❌ \"\n : cellState.includes(\"SUBSTITUTION\")\n ? \"🔄 \"\n : cellState === \"EXAM\"\n ? \"📝 \"\n : \"\";\n\n return {\n start,\n end,\n summary: `${prefix}${subject}`,\n location: room || \"Unbekannter Ort\",\n description: [\n teacher ? `Lehrer: ${teacher}` : null,\n period.substText ? `Info: ${period.substText}` : null,\n period.periodInfo ? `Hinweis: ${period.periodInfo}` : null,\n period.periodText ? `Text: ${period.periodText}` : null,\n ].filter(Boolean).join(\"\\n\"),\n };\n}\n\n// ── HTTP-App ──────────────────────────────────────────────────\nconst app = new Hono();\n\napp.get(\"/students\", async (c) => {\n const denied = requireToken(c);\n if (denied) return denied;\n\n const client = new WebUntisRest();\n await client.login();\n return c.json({ persons: await client.getPersons() });\n});\n\napp.get(\"/calendar.ics\", async (c) => {\n const denied = requireToken(c);\n if (denied) return denied;\n\n const studentId = c.req.query(\"student\");\n const classId = c.req.query(\"class\");\n const label = c.req.query(\"name\") ?? \"WebUntis\";\n const weeks = parseInt(c.req.query(\"weeks\") ?? \"3\", 10);\n\n if (!studentId && !classId) {\n return c.json({\n error:\n \"Bitte ?student= oder ?class= angeben. IDs via /students finden.\",\n }, 400);\n }\n const elementType = studentId ? TYPE.STUDENT : TYPE.CLASS;\n const elementId = studentId ?? classId!;\n\n const client = new WebUntisRest();\n try {\n await client.login();\n\n const calendar = ical({\n name: `Stundenplan ${label}`,\n timezone: \"Europe/Berlin\",\n });\n const thisMonday = mondayOf(new Date());\n\n for (let i = 0; i < weeks; i++) {\n const monday = new Date(thisMonday);\n monday.setUTCDate(monday.getUTCDate() + i * 7);\n\n const weekData = await client.getWeek(\n elementType,\n elementId,\n isoDate(monday),\n );\n const lookup = buildElementLookup(weekData?.elements);\n const periods = weekData?.elementPeriods?.[elementId] ?? [];\n\n for (const period of periods) {\n calendar.createEvent(mapPeriodToEvent(period, lookup));\n }\n }\n\n return new Response(calendar.toString(), {\n headers: {\n \"Content-Type\": \"text/calendar; charset=utf-8\",\n \"Content-Disposition\": 'inline; filename=\"calendar.ics\"',\n },\n });\n } catch (err) {\n console.error(err);\n return c.json({ error: String(err) }, 502);\n }\n});\n\napp.get(\"/debug/week\", async (c) => {\n const denied = requireToken(c);\n if (denied) return denied;\n\n const studentId = c.req.query(\"student\");\n const classId = c.req.query(\"class\");\n if (!studentId && !classId) {\n return c.json({ error: \"?student= oder ?class= nötig\" }, 400);\n }\n\n const client = new WebUntisRest();\n await client.login();\n const monday = isoDate(mondayOf(new Date()));\n const data = await client.getWeek(\n studentId ? TYPE.STUDENT : TYPE.CLASS,\n studentId ?? classId!,\n monday,\n );\n return c.json(data);\n});\n\napp.get(\"/debug/login\", async (c) => {\n const denied = requireToken(c);\n if (denied) return denied;\n\n const jar = new CookieJar();\n const steps: any[] = [];\n\n const priming = await fetch(`${ORIGIN}/WebUntis/api/app/config`);\n jar.absorb(priming);\n steps.push({\n step: \"priming GET /api/app/config\",\n status: priming.status,\n cookiesSoFar: jar.keys(),\n bodySnippet: (await priming.text()).slice(0, 300),\n });\n\n const csrfToken = jar.get(\"XSRF-TOKEN\") ?? jar.get(\"Authorization\");\n\n const loginRes = await fetch(`${ORIGIN}/WebUntis/j_spring_security_check`, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Cookie\": jar.header(),\n },\n body: new URLSearchParams({\n j_username: USER,\n j_password: PASSWORD,\n school: SCHOOL,\n ...(csrfToken ? { token: csrfToken } : {}),\n }),\n redirect: \"manual\",\n });\n jar.absorb(loginRes);\n steps.push({\n step: \"POST /j_spring_security_check\",\n status: loginRes.status,\n location: loginRes.headers.get(\"location\"),\n cookiesSoFar: jar.keys(),\n bodySnippet: (await loginRes.text()).slice(0, 300),\n });\n\n return c.json({ csrfTokenFound: !!csrfToken, steps });\n});\n\nexport default app.fetch;","deleted",false,"label","stundenplan",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":58,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_59":60,"_18":61},["D",1789369559602],"children",[],[35],"c3edf2e2-b026-11f0-89c2-0224a6c84d84",["D",1761234099081],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","5d48cd83-4af1-4c6d-bbb2-a55ca600b9b7","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","c29954f2-52fb-4a15-9575-096b30301bff","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_115":111},"org",{"_11":12,"_109":-5,"_110":111,"_71":72,"_112":113,"_114":53},"branch",{"_17":42,"_13":16,"_33":40,"_101":62,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzJkWFlhZDJOamZwZmMzS1U0Y2dIM2RzSWxTVSJ9","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":62,"_13":14,"_45":150,"_64":-5,"_65":53,"_66":67,"_68":67,"_69":-5,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":44,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":151,"_96":152,"_98":153,"_100":53},[147],"files",[147],"counts",{"_136":78,"_137":138,"_139":78,"_31":140,"_141":142},[134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_18":135},[35],"pulls","branches",1,"forks",{"_143":145,"_146":78},"connections",{"_143":78,"_144":78},"count","unfilledCount",5,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":58,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_59":148,"_18":149},[],[35],["D",1761234099081],{"_11":12,"_115":111},{"_11":12,"_109":-5,"_110":111,"_71":72,"_112":113,"_114":53},{"_17":42,"_13":16,"_33":40,"_101":62,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"ctx",{"_94":-5,"_131":187,"_188":189,"_190":191,"_192":53,"_193":53,"_194":53,"_195":44,"_196":-5,"_197":-7,"_198":-7,"_199":78,"_200":53,"_201":53,"_202":-5,"_203":53,"_204":53,"_205":53,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":16,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code