[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_253":254,"_255":256},"routes/_app.x.$handle.$name",{"_103":102,"_38":50,"_111":93,"_33":60,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_26":-5,"_122":-5,"_123":-5,"_124":31,"_125":126,"_127":65,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_48":49,"_38":50,"_43":51,"_52":-5,"_53":31,"_54":55,"_56":55,"_57":58,"_59":60,"_19":61,"_62":63,"_64":65,"_66":65,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":31},"version",222,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","506a3ad0-f140-49c4-8ac9-b59e9da785d4","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":26,"_40":42,"_43":44,"_45":14,"_46":47,"_30":31},"previous",{"_36":37,"_38":34,"_39":26,"_40":41},"deleted",false,"deletedHere","path","README.md","latestPath","fileId","9cbce088-b441-11f0-80ca-0224a6c84d84","name","fileType","content","# std/oauth – Login with Val Town OAuth Middleware\n\nAdd user auth to your Val Town app in seconds.\n\nAllow Val Town user to log into your app with one click. You can authorize users\nbased on their membership in your org account or by their username or Val Town\nuser ID.\n\nAdding Val Town OAuth is as easy as (asking your agent to) import & wrap your\napp with `oauthMiddleware`. Then your app is augmented with `/auth/login`,\n`/auth/logout` routes, you can link to where appropriate.\n\n## Features\n\n- **Zero config** — works out of the box, no API keys or environment variables\n needed\n- **Stateless sessions** — encrypted cookies, no database required\n- **OAuth 2.0 + PKCE** — secure authorization code flow with proof key\n- **Org membership** — `session.isOrgMember` tells you if the user belongs to\n the val's org\n- **Access token included** — use `session.accessToken` to call the Val Town API\n on behalf of the logged-in user\n\n## Quick Start\n\n```tsx\n/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n\n return c.html(\n \n \n {session?.user\n ?

Logged in as {session.user.username}

\n : Log in}\n \n ,\n );\n});\n\nexport default oauthMiddleware(app.fetch);\n```\n\nSee [example.tsx](./example.tsx) for a full working example.\n\n## Restricting Access to Org Members\n\n`session.isOrgMember` tells you whether the logged-in user belongs to the val's\norg. Use it to build internal tools:\n\n```tsx\n/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return c.redirect(\"/auth/login\");\n if (!session.isOrgMember) {\n return c.text(\"You must be a member of this org to access this app.\", 403);\n }\n return c.text(`Welcome, ${session.user.username}!`);\n});\n\nexport default oauthMiddleware(app.fetch);\n```\n\nSee [org.example.tsx](./org.example.tsx) for a full working example.\n\n## API Reference\n\n### `oauthMiddleware(appFetch)` or `oauthMiddleware(options, appFetch)`\n\nWraps your app's fetch handler to add OAuth routes.\n\n**Options:**\n\n| Option | Type | Default | Description |\n| ------------ | ---------- | ---------------------------------------------------- | ---------------------------------- |\n| `scopes` | `string[]` | `[\"openid\", \"offline_access\", \"profile\", \"user_rw\"]` | OAuth scopes to request |\n| `clientName` | `string` | Auto-detected from val name | Name shown on the authorize screen |\n\n**Routes:**\n\n| Route | Method | Description |\n| ---------------- | ------ | -------------------------------------- |\n| `/auth/login` | GET | Start the OAuth flow |\n| `/auth/callback` | GET | OAuth callback (handled automatically) |\n| `/auth/logout` | POST | Clear the session cookie |\n| `/auth/logo` | GET | Val Town logo SVG (for login buttons) |\n\nThe `/auth/logo` endpoint serves the Val Town logo as an SVG. Use `?theme=light`\nfor a white logo (on dark backgrounds) or omit for the default black logo.\n\n### `getOAuthUserData(req: Request): Promise`\n\nRead the session from an incoming request. Returns `null` if not logged in.\n\n```typescript\ninterface SessionData {\n user: {\n id: string;\n username: string | null;\n email: string | null;\n bio: string | null;\n tier: \"free\" | \"pro\" | null;\n type: \"user\" | \"org\";\n url: string;\n links: {\n self: string;\n profileImageUrl: string | null;\n };\n };\n accessToken: string; // Val Town API token (act on behalf of the user)\n refreshToken?: string;\n idToken?: string;\n expiresAt: number; // Unix timestamp (ms)\n isOrgMember?: boolean; // true if user belongs to this val's org\n}\n```\n\n## Environment Variables\n\n| Variable | Required | Description |\n| ---------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `OAUTH_STATE_ENCRYPTION_KEY` | No | Encryption key for sessions. Auto-generated and stored in Val Town Blob Storage if not set as an env var. We recommend setting manually (`https://generate-random-signing-key.val.run/`) for better cold-start performance. (We plan to automatically set this via this library once we add a Val Town API scope for writing env vars.) |\n\n## How It Works\n\n```mermaid\nsequenceDiagram\n participant User\n participant App as Your Val\n participant VT as Val Town OAuth\n\n User->>App: Click \"Log in\" → GET /auth/login\n App->>VT: Redirect to /oauth/auth (PKCE)\n User->>VT: Authorize\n VT->>App: GET /auth/callback?code=…\n App->>VT: Exchange code for tokens\n App->>VT: Fetch profile + org membership\n App->>User: Set encrypted session cookie, redirect to /\n Note over User,App: Subsequent requests read the cookie\n User->>App: GET / (with cookie)\n App->>App: Decrypt → SessionData\n```\n\nSessions last 30 days and are stored entirely in the cookie (no server-side\nstorage).\n\n## Security\n\nThis code falls under Val Town's\n[Vulnerability Disclosure Policy](https://docs.val.town/contact-us/security/).\nWe are actively soliciting bug reports and will pay bounties depending on the\nseverity of the issue found.\n\nIf you discover a vulnerability, please report it privately by emailing\n[security@val.town](mailto:security@val.town). Do not publish or reveal the\nissue until it has been resolved.","# std/oauth – Login with Val Town OAuth Middleware\n\nAdd user auth to your Val Town app in seconds.\n\nAllow Val Town user to log into your app with one click. You can authorize users\nbased on their membership in your org account or by their username or Val Town\nuser ID.\n\nAdding Val Town OAuth is as easy as (asking your agent to) import & wrap your\napp with `oauthMiddleware`. Then your app is augmented with `/auth/login`,\n`/auth/logout` routes, you can link to where appropriate.\n\n## Features\n\n- **Zero config** — works out of the box, no API keys or environment variables\n needed\n- **Stateless sessions** — encrypted cookies, no database required\n- **OAuth 2.0 + PKCE** — secure authorization code flow with proof key\n- **Org membership** — `session.isOrgMember` tells you if the user belongs to\n the val's org\n- **Access token included** — use `session.accessToken` to call the Val Town API\n on behalf of the logged-in user\n\n## Quick Start\n\n```tsx\n/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n\n return c.html(\n \n \n {session?.user\n ?

Logged in as {session.user.username}

\n : Log in}\n \n ,\n );\n});\n\nexport default oauthMiddleware(app.fetch);\n```\n\nSee [example.tsx](./example.tsx) for a full working example.\n\n### ⚡ Recommended: Set your encryption key\n\nstd/oauth works with zero config, but setting an encryption key env var gives\nyou a significant cold-start speed boost. Without it, every cold start reads\nfrom blob storage to get the auto-generated key.\n\nSet `OAUTH_STATE_ENCRYPTION_KEY` on your val to a random string from\n[`generate-random-signing-key.val.run`](https://generate-random-signing-key.val.run/).\n\n**AI agents:** when setting up std/oauth on a user's val, fetch that URL\nautomatically and set the `OAUTH_STATE_ENCRYPTION_KEY` env var with the result.\n\n## Restricting Access to Org Members\n\n`session.isOrgMember` tells you whether the logged-in user belongs to the val's\norg. Use it to build internal tools:\n\n```tsx\n/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return c.redirect(\"/auth/login\");\n if (!session.isOrgMember) {\n return c.text(\"You must be a member of this org to access this app.\", 403);\n }\n return c.text(`Welcome, ${session.user.username}!`);\n});\n\nexport default oauthMiddleware(app.fetch);\n```\n\nSee [org.example.tsx](./org.example.tsx) for a full working example.\n\n## API Reference\n\n### `oauthMiddleware(appFetch)` or `oauthMiddleware(options, appFetch)`\n\nWraps your app's fetch handler to add OAuth routes.\n\n**Options:**\n\n| Option | Type | Default | Description |\n| ------------ | ---------- | ---------------------------------------------------- | ---------------------------------- |\n| `scopes` | `string[]` | `[\"openid\", \"offline_access\", \"profile\", \"user_rw\"]` | OAuth scopes to request |\n| `clientName` | `string` | Auto-detected from val name | Name shown on the authorize screen |\n\n**Routes:**\n\n| Route | Method | Description |\n| ---------------- | ------ | -------------------------------------- |\n| `/auth/login` | GET | Start the OAuth flow |\n| `/auth/callback` | GET | OAuth callback (handled automatically) |\n| `/auth/logout` | POST | Clear the session cookie |\n| `/auth/logo` | GET | Val Town logo SVG (for login buttons) |\n\nThe `/auth/logo` endpoint serves the Val Town logo as an SVG. Use `?theme=light`\nfor a white logo (on dark backgrounds) or omit for the default black logo.\n\n### `getOAuthUserData(req: Request): Promise`\n\nRead the session from an incoming request. Returns `null` if not logged in.\n\n```typescript\ninterface SessionData {\n user: {\n id: string;\n username: string | null;\n email: string | null;\n bio: string | null;\n tier: \"free\" | \"pro\" | null;\n type: \"user\" | \"org\";\n url: string;\n links: {\n self: string;\n profileImageUrl: string | null;\n };\n };\n accessToken: string; // Val Town API token (act on behalf of the user)\n refreshToken?: string;\n idToken?: string;\n expiresAt: number; // Unix timestamp (ms)\n isOrgMember?: boolean; // true if user belongs to this val's org\n}\n```\n\n## Environment Variables\n\n| Variable | Required | Description |\n| ---------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `OAUTH_STATE_ENCRYPTION_KEY` | No | Encryption key for sessions. Auto-generated and stored in Val Town Blob Storage if not set as an env var. We recommend setting manually (`https://generate-random-signing-key.val.run/`) for better cold-start performance. (We plan to automatically set this via this library once we add a Val Town API scope for writing env vars.) |\n\n## How It Works\n\n```mermaid\nsequenceDiagram\n participant User\n participant App as Your Val\n participant VT as Val Town OAuth\n\n User->>App: Click \"Log in\" → GET /auth/login\n App->>VT: Redirect to /oauth/auth (PKCE)\n User->>VT: Authorize\n VT->>App: GET /auth/callback?code=…\n App->>VT: Exchange code for tokens\n App->>VT: Fetch profile + org membership\n App->>User: Set encrypted session cookie, redirect to /\n Note over User,App: Subsequent requests read the cookie\n User->>App: GET / (with cookie)\n App->>App: Decrypt → SessionData\n```\n\nSessions last 30 days and are stored entirely in the cookie (no server-side\nstorage).\n\n## Security\n\nThis code falls under Val Town's\n[Vulnerability Disclosure Policy](https://docs.val.town/contact-us/security/).\nWe are actively soliciting bug reports and will pay bounties depending on the\nseverity of the issue found.\n\nIf you discover a vulnerability, please report it privately by emailing\n[security@val.town](mailto:security@val.town). Do not publish or reveal the\nissue until it has been resolved.","createdAt",["D",1775073274775],"branchVersion","branchId","83eb3964-b42e-11f0-a32e-0224a6c84d84","id","83e9d146-b42e-11f0-a32e-0224a6c84d84","oauth",["D",1761677232251],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Login with Val Town OAuth Middleware","imageUrl","","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","91178458-b42e-11f0-b6f3-0224a6c84d84","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",5,"orgId","c606f87f-4d7e-48c8-9c39-ef5ab94aec49","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_103":102,"_110":106},"org",{"_103":102,"_104":-5,"_105":106,"_19":-5,"_107":108,"_109":31},"branch",{"_13":92,"_38":93,"_48":47,"_94":49,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":50,"_101":102},"isOwned",233,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","std","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJVaVhpQ1BId3dscVpBbkdZVWlMNjJtcjkxWS5wbmcifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_48":49,"_38":50,"_43":249,"_52":-5,"_53":31,"_54":55,"_56":55,"_57":58,"_59":60,"_19":61,"_62":63,"_64":65,"_66":65,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":250,"_87":251,"_89":252,"_91":31},"tree",[216,217,218,219,220,221,222,223],"files",[216,217,218,219,220,221,222,223],"counts",{"_205":181,"_206":207,"_208":181,"_209":210,"_211":212},"contents",[132,133,134,135,136,137,138,139],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_48":201,"_38":34,"_36":37,"_143":-5,"_46":47,"_45":14,"_145":31,"_43":202,"_13":203,"_39":26,"_40":42,"_30":31,"_150":-5,"_33":204},{"_48":193,"_38":194,"_36":195,"_143":-5,"_46":47,"_45":196,"_145":65,"_43":197,"_13":198,"_39":148,"_40":199,"_30":31,"_150":-5,"_33":200},{"_48":185,"_38":186,"_36":63,"_143":-5,"_46":47,"_45":187,"_145":31,"_43":188,"_13":189,"_39":158,"_40":190,"_30":31,"_150":191,"_33":192},{"_48":177,"_38":178,"_36":179,"_143":-5,"_46":47,"_45":164,"_145":65,"_43":180,"_13":181,"_39":158,"_40":182,"_30":31,"_150":183,"_33":184},{"_48":169,"_38":170,"_36":171,"_143":-5,"_46":47,"_45":172,"_145":31,"_43":173,"_13":174,"_39":148,"_40":175,"_30":31,"_150":-5,"_33":176},{"_48":161,"_38":162,"_36":163,"_143":-5,"_46":47,"_45":164,"_145":65,"_43":165,"_13":166,"_39":148,"_40":167,"_30":31,"_150":-5,"_33":168},{"_48":152,"_38":153,"_36":154,"_143":-5,"_46":47,"_45":155,"_145":31,"_43":156,"_13":157,"_39":158,"_40":159,"_30":31,"_150":-5,"_33":160},{"_48":140,"_38":141,"_36":142,"_143":-5,"_46":47,"_45":144,"_145":65,"_43":146,"_13":147,"_39":148,"_40":149,"_30":31,"_150":-5,"_33":151},"97ca4d3a-2b16-11f1-9245-42dde27851f2","session.ts","602fa54e-b507-11f0-b16d-0224a6c84d84","parentId",180,"latest",["D",1774751146084],3,"script","// Session management using encrypted cookies\nimport { decrypt, encrypt } from \"./crypto.ts\";\nimport type ValTown from \"npm:@valtown/sdk@3.10.0\";\n\nexport interface SessionData {\n user: ValTown.Me.Profile.ProfileRetrieveResponse;\n accessToken: string;\n refreshToken?: string;\n idToken?: string;\n expiresAt: number; // Unix timestamp in milliseconds\n /** Whether the user is a member of this val's org, checked at login time */\n isOrgMember?: boolean;\n}\n\nconst SESSION_DURATION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\n/**\n * Encrypt session data into a cookie-safe string\n */\nexport async function encryptSession(\n data: SessionData,\n redirectUri: string,\n): Promise {\n const payload = JSON.stringify(data);\n return await encrypt(payload, redirectUri);\n}\n\n/**\n * Decrypt and validate a session cookie\n * Returns null if invalid or expired\n */\nexport async function decryptSession(\n encryptedSession: string,\n redirectUri: string,\n): Promise {\n try {\n const decrypted = await decrypt(encryptedSession, redirectUri);\n const session = JSON.parse(decrypted) as SessionData;\n\n // Validate expiry\n if (Date.now() >= session.expiresAt) {\n return null;\n }\n\n return session;\n } catch {\n return null;\n }\n}\n\n/**\n * Create a new session with default 30-day expiry\n */\nexport function createSessionData(\n user: ValTown.Me.Profile.ProfileRetrieveResponse,\n options: {\n accessToken: string;\n refreshToken?: string;\n idToken?: string;\n isOrgMember?: boolean;\n },\n): SessionData {\n return {\n user,\n accessToken: options.accessToken,\n refreshToken: options.refreshToken,\n idToken: options.idToken,\n isOrgMember: options.isOrgMember,\n expiresAt: Date.now() + SESSION_DURATION_MS,\n };\n}\n","label",[141],"bc83443c-2ba3-11f1-92dd-42dde27851f2","org.example.tsx","97c9def4-2b16-11f1-9245-42dde27851f2",215,["D",1774811766739],4,"http","/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport { getOAuthUserData, oauthMiddleware } from \"./middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n\n return c.html(\n \n \n

Org-Only App Demo

\n {!session\n ? (\n \n $\"Val$ \n Log in with Val Town\n \n )\n : !session.isOrgMember\n ? (\n <>\n

\n Logged in as {session.user.username}, but you\n are not a member of this org.\n

\n ,\n );\n});\n\napp.onError((err) => Promise.reject(err));\nexport default oauthMiddleware(app.fetch);\n",[153],"fb693636-2ba1-11f1-b44d-42dde27851f2","oauth.ts","1744e9ae-b43d-11f0-999e-0224a6c84d84",190,["D",1774811013258],23,"import { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { decrypt, encrypt } from \"./crypto.ts\";\n\nconst OAUTH_ISSUER = \"https://val.town\";\n\ninterface OAuthClientData {\n client_id: string;\n redirect_uris: string[];\n [key: string]: unknown;\n}\n\n// Client cache: stores most recent client in memory\nlet cachedClient: OAuthClientData | null = null;\n\nexport function getDefaultClientName(): string {\n try {\n const val = parseVal();\n return `${val.name} by ${val.username}`;\n } catch {\n return \"Generic Val Town App\";\n }\n}\n\n// Extract redirect URI from request\nexport function getRedirectUri(req: Request): string {\n const origin = new URL(req.url).origin;\n return `${origin}/auth/callback`;\n}\n\n// Generate PKCE code verifier and challenge\nexport async function generatePKCE() {\n const array = new Uint8Array(32);\n crypto.getRandomValues(array);\n const codeVerifier = btoa(String.fromCharCode(...array))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\n const codeChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n\n return { codeVerifier, codeChallenge };\n}\n\n// Encode state with embedded code_verifier, client_id, and timestamp\nexport async function encodeState(\n codeVerifier: string,\n clientId: string,\n redirectUri: string,\n): Promise {\n const payload = JSON.stringify({\n verifier: codeVerifier,\n clientId: clientId,\n timestamp: Date.now(),\n });\n return await encrypt(payload, redirectUri);\n}\n\n// Decode and validate state\nexport async function decodeState(\n state: string,\n redirectUri: string,\n): Promise<{ codeVerifier: string; clientId: string }> {\n const decrypted = await decrypt(state, redirectUri);\n const payload = JSON.parse(decrypted);\n\n // Validate timestamp (10 minute expiry)\n const age = Date.now() - payload.timestamp;\n if (age > 10 * 60 * 1000) {\n throw new Error(\"State expired - please restart the OAuth flow\");\n }\n\n return { codeVerifier: payload.verifier, clientId: payload.clientId };\n}\n\n// Get or create OAuth client with two-tier caching\nexport async function getOrCreateClient(\n redirectUri: string,\n clientName?: string,\n): Promise {\n // Check memory cache - if redirect URI matches, return immediately (no blob fetch needed)\n if (cachedClient?.redirect_uris?.[0] === redirectUri) {\n return cachedClient.client_id;\n }\n\n // Check blob storage\n const blobClient = await blob.getJSON(`oauth_client:${redirectUri}`);\n if (blobClient?.redirect_uris?.[0] === redirectUri) {\n cachedClient = blobClient;\n return blobClient.client_id;\n }\n\n // Register new client\n const newClient = await registerPublicClient(redirectUri, clientName);\n cachedClient = newClient;\n await blob.setJSON(`oauth_client:${redirectUri}`, newClient);\n return newClient.client_id;\n}\n\n// Register a new public OAuth client via Dynamic Client Registration\nexport async function registerPublicClient(\n redirectUri: string,\n clientName = getDefaultClientName(),\n): Promise {\n const response = await fetch(`${OAUTH_ISSUER}/oauth/reg`, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n redirect_uris: [redirectUri],\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: clientName,\n token_endpoint_auth_method: \"none\", // Public client - no secret authentication\n }),\n });\n\n if (!response.ok) {\n const error = await response.text();\n throw new Error(`Client registration failed: ${error}`);\n }\n\n const clientData = await response.json();\n return clientData;\n}",[162],"8ca8a2d4-2ba3-11f1-9f11-42dde27851f2","middleware.ts","83ef0a4e-b42e-11f0-a32e-0224a6c84d84",210,["D",1774811686437],87,"import {\n decodeState,\n encodeState,\n generatePKCE,\n getDefaultClientName,\n getOrCreateClient,\n getRedirectUri,\n} from \"./oauth.ts\";\nimport {\n createSessionData,\n decryptSession,\n encryptSession,\n SessionData,\n} from \"./session.ts\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport ValTown from \"npm:@valtown/sdk@3.10.0\";\n\nconst OAUTH_ISSUER = \"https://val.town\";\nconst DEFAULT_SCOPES = \"openid offline_access profile user_rw\";\nconst SESSION_COOKIE_NAME = \"vt_session\";\n\ntype AppFetch = (req: Request) => Promise | Response;\nexport type Options = {\n scopes?: string[];\n clientName?: string;\n};\n\n// Helper function to extract cookie from request\nfunction getCookie(req: Request, name: string): string | undefined {\n const cookieHeader = req.headers.get(\"Cookie\");\n if (!cookieHeader) return undefined;\n\n const cookies = cookieHeader.split(\";\").map((c) => c.trim());\n for (const cookie of cookies) {\n const [cookieName, ...cookieValue] = cookie.split(\"=\");\n if (cookieName === name) {\n return cookieValue.join(\"=\");\n }\n }\n return undefined;\n}\n\n/**\n * Extract OAuth user data from the encrypted session cookie\n * @param req - The Request object\n * @returns SessionData or null if not authenticated\n */\nexport async function getOAuthUserData(\n req: Request,\n): Promise {\n const sessionCookie = getCookie(req, SESSION_COOKIE_NAME);\n if (!sessionCookie) return null;\n\n try {\n const origin = new URL(req.url).origin;\n const redirectUri = `${origin}/auth/callback`;\n return await decryptSession(sessionCookie, redirectUri);\n } catch (error) {\n console.error(\"Failed to decrypt session:\", error);\n return null;\n }\n}\n\nexport function oauthMiddleware(appFetch: AppFetch): AppFetch;\nexport function oauthMiddleware(opts: Options, appFetch: AppFetch): AppFetch;\nexport function oauthMiddleware(\n optsOrAppFetch: Options | AppFetch,\n appFetch?: AppFetch,\n): AppFetch {\n if (typeof optsOrAppFetch === \"function\") {\n return createMiddleware(optsOrAppFetch, {});\n } else {\n return createMiddleware(appFetch, optsOrAppFetch);\n }\n}\n\n// Internal middleware creation function\nfunction createMiddleware(appFetch: AppFetch, opts: Options): AppFetch {\n return async (req: Request) => {\n const url = new URL(req.url);\n\n if (url.pathname === \"/auth/login\") return handleLogin(req, opts);\n if (url.pathname === \"/auth/callback\") return handleCallback(req);\n if (url.pathname === \"/auth/logout\") return handleLogout(req);\n if (url.pathname === \"/auth/logo\") return handleLogo(url);\n\n return appFetch(req);\n };\n}\n\n// Home page - initiate OAuth flow\nasync function handleLogin(req: Request, opts: Options) {\n try {\n const redirectUri = getRedirectUri(req);\n const clientName = opts.clientName ?? getDefaultClientName();\n const clientId = await getOrCreateClient(redirectUri, clientName);\n\n const { codeVerifier, codeChallenge } = await generatePKCE();\n\n const state = await encodeState(codeVerifier, clientId, redirectUri);\n\n const scopes = opts.scopes?.join(\" \") ?? DEFAULT_SCOPES;\n\n const authUrl = new URL(`${OAUTH_ISSUER}/oauth/auth`);\n authUrl.searchParams.set(\"client_id\", clientId);\n authUrl.searchParams.set(\"redirect_uri\", redirectUri);\n authUrl.searchParams.set(\"response_type\", \"code\");\n authUrl.searchParams.set(\"scope\", scopes);\n authUrl.searchParams.set(\"code_challenge\", codeChallenge);\n authUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n authUrl.searchParams.set(\"state\", state);\n authUrl.searchParams.set(\"prompt\", \"login consent\");\n\n // redirect to authURL\n return new Response(null, {\n headers: {\n Location: authUrl.toString(),\n },\n status: 302,\n });\n } catch (error) {\n console.error(\"OAuth error:\", error);\n const errorMsg = error?.message || error?.toString() || \"Unknown error\";\n return new Response(\n `OAuth login failed: ${errorMsg}`,\n { status: 500, headers: { \"Content-Type\": \"text/plain\" } },\n );\n }\n}\n\n// OAuth callback handler\nasync function handleCallback(req: Request) {\n const url = new URL(req.url);\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n\n if (!code) return new Response(\"Missing code\", { status: 400 });\n if (!state) return new Response(\"Missing state\", { status: 400 });\n\n try {\n const redirectUri = getRedirectUri(req);\n const { codeVerifier, clientId } = await decodeState(state, redirectUri);\n\n // Exchange authorization code for tokens\n const tokenResponse = await fetch(`${OAUTH_ISSUER}/oauth/token`, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: redirectUri,\n client_id: clientId,\n code_verifier: codeVerifier,\n }),\n });\n\n if (!tokenResponse.ok) {\n const error = await tokenResponse.text();\n return new Response(`Token exchange failed: ${error}`, { status: 500 });\n }\n\n const tokens = await tokenResponse.json();\n const client = new ValTown({ bearerToken: tokens.access_token });\n\n // Fetch profile and org memberships in parallel\n const orgHandle = parseVal().username;\n const [me, userOrgs] = await Promise.all([\n client.me.profile.retrieve(),\n Array.fromAsync(client.orgs.list({})),\n ]);\n const isOrgMember = me.username === orgHandle ||\n userOrgs.some((o) => o.username === orgHandle);\n\n const sessionData = createSessionData(\n me,\n {\n accessToken: tokens.access_token,\n refreshToken: tokens.refresh_token,\n idToken: tokens.id_token,\n isOrgMember,\n },\n );\n\n // Encrypt session for cookie\n const encryptedSession = await encryptSession(sessionData, redirectUri);\n\n // Set secure session cookie and redirect to home\n const headers = new Headers();\n headers.set(\"Location\", \"/\");\n headers.set(\n \"Set-Cookie\",\n `${SESSION_COOKIE_NAME}=${encryptedSession}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${\n 30 * 24 * 60 * 60\n }`,\n );\n\n return new Response(null, {\n status: 302,\n headers,\n });\n } catch (error) {\n console.error(\"OAuth callback error:\", error);\n return new Response(`Authentication failed: ${error.message}`, {\n status: 500,\n });\n }\n}\n\n// Logout handler\nasync function handleLogout(req: Request) {\n if (req.method !== \"POST\") {\n return new Response(\n \"Method not allowed. Use POST to log out.\",\n { status: 405 },\n );\n }\n\n // Clear session cookie by setting Max-Age=0\n const headers = new Headers();\n headers.set(\"Location\", \"/\");\n headers.set(\n \"Set-Cookie\",\n `${SESSION_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,\n );\n\n return new Response(null, {\n status: 302,\n headers,\n });\n}\n\n// Logo handler - serves Val Town logo as SVG\n// Use ?theme=light for white logo (on dark backgrounds)\nfunction handleLogo(url: URL) {\n const theme = url.searchParams.get(\"theme\");\n const fill = theme === \"light\" ? \"white\" : \"black\";\n\n const svg = ``;\n\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml\",\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n },\n });\n}\n",[170],"fb68bb34-2ba1-11f1-b44d-42dde27851f2","generate-random-signing-key.ts","fb68bc06-2ba1-11f1-b44d-42dde27851f2",["D",1774811013258],0,"import { randomBytes } from \"node:crypto\";\nexport default () => Response.json(randomBytes(32).toString(\"base64\"));","generate-random-signing-key",[178],"ccb78390-2ba3-11f1-86b2-42dde27851f2","example.tsx",216,["D",1774811793928],57,"/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport { getOAuthUserData, oauthMiddleware } from \"./middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const { user } = (await getOAuthUserData(c.req.raw)) || {};\n\n return c.html(\n \n \n

OAuth Demo

\n {user\n ? (\n <>\n

\n Logged in as {user.username}\n

\n ,\n );\n});\n\napp.onError((err) => Promise.reject(err));\nexport default oauthMiddleware(app.fetch);","std-oauth",[186],"01f05f24-078b-11f1-86e0-42dde27851f2","crypto.ts","0560d0e4-b50b-11f0-aab9-0224a6c84d84",178,["D",1770842903945],2,"// Shared encryption utilities for OAuth state and session management\nimport { blob } from \"https://esm.town/v/std/blob\";\n\n// Encryption key cache: stores encryption key material in memory\nlet cachedEncryptionKey: string | null = null;\n\n// Get or create encryption key material with three-tier caching\nexport async function getOrCreateEncryptionKeyMaterial(\n redirectUri: string,\n): Promise {\n // Check memory cache\n if (cachedEncryptionKey) return cachedEncryptionKey;\n\n // Check environment variable (fastest - no I/O)\n const envKey = Deno.env.get(\"OAUTH_STATE_ENCRYPTION_KEY\");\n if (envKey) {\n cachedEncryptionKey = envKey;\n return envKey;\n }\n\n // Check blob storage (scoped to redirect URI)\n const blobKey = `oauth_encryption_key:${redirectUri}`;\n try {\n const storedKey = await blob.getJSON(blobKey) as string | null;\n if (storedKey) {\n cachedEncryptionKey = storedKey;\n return storedKey;\n }\n } catch (_error) {\n // Blob doesn't exist or is in old format, will create new one below\n }\n // Generate new random key (32 bytes = 256 bits)\n const randomBytes = new Uint8Array(32);\n crypto.getRandomValues(randomBytes);\n const newKey = btoa(String.fromCharCode(...randomBytes));\n // Store in blob for persistence\n await blob.setJSON(blobKey, newKey);\n cachedEncryptionKey = newKey;\n\n return newKey;\n}\n\n// Derive encryption key from key material\nexport async function getEncryptionKey(\n redirectUri: string,\n): Promise {\n const keyMaterialString = await getOrCreateEncryptionKeyMaterial(redirectUri);\n const encoder = new TextEncoder();\n const keyMaterial = encoder.encode(keyMaterialString);\n const keyHash = await crypto.subtle.digest(\"SHA-256\", keyMaterial);\n\n return await crypto.subtle.importKey(\n \"raw\",\n keyHash,\n { name: \"AES-GCM\" },\n false,\n [\"encrypt\", \"decrypt\"],\n );\n}\n\n// Encrypt data into a URL-safe string\nexport async function encrypt(\n data: string,\n redirectUri: string,\n): Promise {\n const key = await getEncryptionKey(redirectUri);\n const encoder = new TextEncoder();\n const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit IV for GCM\n\n const encrypted = await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv },\n key,\n encoder.encode(data),\n );\n\n // Combine IV + encrypted data\n const combined = new Uint8Array(iv.length + encrypted.byteLength);\n combined.set(iv, 0);\n combined.set(new Uint8Array(encrypted), iv.length);\n\n // Base64url encode\n return btoa(String.fromCharCode(...combined))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n}\n\n// Decrypt URL-safe string back to data\nexport async function decrypt(\n encryptedData: string,\n redirectUri: string,\n): Promise {\n try {\n const key = await getEncryptionKey(redirectUri);\n\n // Base64url decode\n const combined = Uint8Array.from(\n atob(encryptedData.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n\n // Extract IV and encrypted data\n const iv = combined.slice(0, 12);\n const encrypted = combined.slice(12);\n\n const decrypted = await crypto.subtle.decrypt(\n { name: \"AES-GCM\", iv },\n key,\n encrypted,\n );\n\n const decoder = new TextDecoder();\n return decoder.decode(decrypted);\n } catch {\n throw new Error(\"Failed to decrypt data - invalid or tampered\");\n }\n}",[194],"9b746196-2e04-11f1-9c48-42dde27851f2",["D",1775073274775],37,[34],"pulls","branches",1,"forks","envVars",{"_213":181,"_215":181},"connections",{"_213":181,"_214":181},"count","unfilledCount","emptyCount",{"_48":201,"_38":34,"_36":37,"_143":-5,"_46":47,"_45":14,"_145":31,"_43":246,"_13":203,"_39":26,"_40":42,"_30":31,"_150":-5,"_225":247,"_33":248},{"_48":193,"_38":194,"_36":195,"_143":-5,"_46":47,"_45":196,"_145":65,"_43":243,"_13":198,"_39":148,"_40":199,"_30":31,"_150":-5,"_225":244,"_33":245},{"_48":185,"_38":186,"_36":63,"_143":-5,"_46":47,"_45":187,"_145":31,"_43":240,"_13":189,"_39":158,"_40":190,"_30":31,"_150":191,"_225":241,"_33":242},{"_48":177,"_38":178,"_36":179,"_143":-5,"_46":47,"_45":164,"_145":65,"_43":237,"_13":181,"_39":158,"_40":182,"_30":31,"_150":183,"_225":238,"_33":239},{"_48":169,"_38":170,"_36":171,"_143":-5,"_46":47,"_45":172,"_145":31,"_43":234,"_13":174,"_39":148,"_40":175,"_30":31,"_150":-5,"_225":235,"_33":236},{"_48":161,"_38":162,"_36":163,"_143":-5,"_46":47,"_45":164,"_145":65,"_43":231,"_13":166,"_39":148,"_40":167,"_30":31,"_150":-5,"_225":232,"_33":233},{"_48":152,"_38":153,"_36":154,"_143":-5,"_46":47,"_45":155,"_145":31,"_43":228,"_13":157,"_39":158,"_40":159,"_30":31,"_150":-5,"_225":229,"_33":230},{"_48":140,"_38":141,"_36":142,"_143":-5,"_46":47,"_45":144,"_145":65,"_43":224,"_13":147,"_39":148,"_40":149,"_30":31,"_150":-5,"_225":226,"_33":227},["D",1774751146084],"children",[],[141],["D",1774811766739],[],[153],["D",1774811013258],[],[162],["D",1774811686437],[],[170],["D",1774811013258],[],[178],["D",1774811793928],[],[186],["D",1770842903945],[],[194],["D",1775073274775],[],[34],["D",1761677232251],{"_103":102,"_110":106},{"_103":102,"_104":-5,"_105":106,"_19":-5,"_107":108,"_109":31},{"_13":92,"_38":93,"_48":47,"_94":49,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":50,"_101":102},"ctx",{"_85":-5,"_129":286,"_287":288,"_289":290,"_291":31,"_292":31,"_293":31,"_294":65,"_295":-5,"_296":-7,"_297":-7,"_298":181,"_299":31,"_300":31,"_301":-5,"_302":31,"_303":31,"_304":31,"_305":-5},"ENV",{"_257":258,"_259":260,"_261":93,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v222