Org-Only App Demo

\n {!session\n ? (\n \n $\"Val$ \n Log in with Val Town\n \n )\n : !session.isOrgMember\n ? (\n <>\n

\n Logged in as{\" \"}\n {session.user.username}, but you are not a\n member of this org.\n

\n ,\n );\n});\n\napp.onError((err) => Promise.reject(err));\nexport default oauthMiddleware(app.fetch);",[141],"fb693636-2ba1-11f1-b44d-42dde27851f2","oauth.ts","1744e9ae-b43d-11f0-999e-0224a6c84d84",190,["D",1774811013258],23,"import { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { decrypt, encrypt } from \"./crypto.ts\";\n\nconst OAUTH_ISSUER = \"https://val.town\";\n\ninterface OAuthClientData {\n client_id: string;\n redirect_uris: string[];\n [key: string]: unknown;\n}\n\n// Client cache: stores most recent client in memory\nlet cachedClient: OAuthClientData | null = null;\n\nexport function getDefaultClientName(): string {\n try {\n const val = parseVal();\n return `${val.name} by ${val.username}`;\n } catch {\n return \"Generic Val Town App\";\n }\n}\n\n// Extract redirect URI from request\nexport function getRedirectUri(req: Request): string {\n const origin = new URL(req.url).origin;\n return `${origin}/auth/callback`;\n}\n\n// Generate PKCE code verifier and challenge\nexport async function generatePKCE() {\n const array = new Uint8Array(32);\n crypto.getRandomValues(array);\n const codeVerifier = btoa(String.fromCharCode(...array))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n\n const encoder = new TextEncoder();\n const data = encoder.encode(codeVerifier);\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\n const codeChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n\n return { codeVerifier, codeChallenge };\n}\n\n// Encode state with embedded code_verifier, client_id, and timestamp\nexport async function encodeState(\n codeVerifier: string,\n clientId: string,\n redirectUri: string,\n): Promise {\n const payload = JSON.stringify({\n verifier: codeVerifier,\n clientId: clientId,\n timestamp: Date.now(),\n });\n return await encrypt(payload, redirectUri);\n}\n\n// Decode and validate state\nexport async function decodeState(\n state: string,\n redirectUri: string,\n): Promise<{ codeVerifier: string; clientId: string }> {\n const decrypted = await decrypt(state, redirectUri);\n const payload = JSON.parse(decrypted);\n\n // Validate timestamp (10 minute expiry)\n const age = Date.now() - payload.timestamp;\n if (age > 10 * 60 * 1000) {\n throw new Error(\"State expired - please restart the OAuth flow\");\n }\n\n return { codeVerifier: payload.verifier, clientId: payload.clientId };\n}\n\n// Get or create OAuth client with two-tier caching\nexport async function getOrCreateClient(\n redirectUri: string,\n clientName?: string,\n): Promise {\n // Check memory cache - if redirect URI matches, return immediately (no blob fetch needed)\n if (cachedClient?.redirect_uris?.[0] === redirectUri) {\n return cachedClient.client_id;\n }\n\n // Check blob storage\n const blobClient = await blob.getJSON(`oauth_client:${redirectUri}`);\n if (blobClient?.redirect_uris?.[0] === redirectUri) {\n cachedClient = blobClient;\n return blobClient.client_id;\n }\n\n // Register new client\n const newClient = await registerPublicClient(redirectUri, clientName);\n cachedClient = newClient;\n await blob.setJSON(`oauth_client:${redirectUri}`, newClient);\n return newClient.client_id;\n}\n\n// Register a new public OAuth client via Dynamic Client Registration\nexport async function registerPublicClient(\n redirectUri: string,\n clientName = getDefaultClientName(),\n): Promise {\n const response = await fetch(`${OAUTH_ISSUER}/oauth/reg`, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n redirect_uris: [redirectUri],\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: clientName,\n token_endpoint_auth_method: \"none\", // Public client - no secret authentication\n }),\n });\n\n if (!response.ok) {\n const error = await response.text();\n throw new Error(`Client registration failed: ${error}`);\n }\n\n const clientData = await response.json();\n return clientData;\n}",[148],"5e2cd316-dc91-4908-ba48-0752f604adf7","middleware.ts","83ef0a4e-b42e-11f0-a32e-0224a6c84d84",["D",1781441668159],92,"export * from \"./middleware/index.ts\";\n",[156],"fb68bb34-2ba1-11f1-b44d-42dde27851f2","generate-random-signing-key.ts","fb68bc06-2ba1-11f1-b44d-42dde27851f2",["D",1774811013258],0,"import { randomBytes } from \"node:crypto\";\nexport default () => Response.json(randomBytes(32).toString(\"base64\"));","generate-random-signing-key",[163],"bd1569ab-1a04-4b07-a9a9-02df03bddfc6","example.tsx",["D",1781441668159],62,"/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport { getOAuthUserData, oauthMiddleware } from \"./middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const { user } = (await getOAuthUserData(c.req.raw)) || {};\n\n return c.html(\n \n \n

OAuth Demo

\n {user\n ? (\n <>\n

\n Logged in as {user.username}\n

\n ,\n );\n});\n\napp.onError((err) => Promise.reject(err));\nexport default oauthMiddleware(app.fetch);","std-oauth",[171],"01f05f24-078b-11f1-86e0-42dde27851f2","crypto.ts","0560d0e4-b50b-11f0-aab9-0224a6c84d84",178,["D",1770842903945],2,"// Shared encryption utilities for OAuth state and session management\nimport { blob } from \"https://esm.town/v/std/blob\";\n\n// Encryption key cache: stores encryption key material in memory\nlet cachedEncryptionKey: string | null = null;\n\n// Get or create encryption key material with three-tier caching\nexport async function getOrCreateEncryptionKeyMaterial(\n redirectUri: string,\n): Promise {\n // Check memory cache\n if (cachedEncryptionKey) return cachedEncryptionKey;\n\n // Check environment variable (fastest - no I/O)\n const envKey = Deno.env.get(\"OAUTH_STATE_ENCRYPTION_KEY\");\n if (envKey) {\n cachedEncryptionKey = envKey;\n return envKey;\n }\n\n // Check blob storage (scoped to redirect URI)\n const blobKey = `oauth_encryption_key:${redirectUri}`;\n try {\n const storedKey = await blob.getJSON(blobKey) as string | null;\n if (storedKey) {\n cachedEncryptionKey = storedKey;\n return storedKey;\n }\n } catch (_error) {\n // Blob doesn't exist or is in old format, will create new one below\n }\n // Generate new random key (32 bytes = 256 bits)\n const randomBytes = new Uint8Array(32);\n crypto.getRandomValues(randomBytes);\n const newKey = btoa(String.fromCharCode(...randomBytes));\n // Store in blob for persistence\n await blob.setJSON(blobKey, newKey);\n cachedEncryptionKey = newKey;\n\n return newKey;\n}\n\n// Derive encryption key from key material\nexport async function getEncryptionKey(\n redirectUri: string,\n): Promise {\n const keyMaterialString = await getOrCreateEncryptionKeyMaterial(redirectUri);\n const encoder = new TextEncoder();\n const keyMaterial = encoder.encode(keyMaterialString);\n const keyHash = await crypto.subtle.digest(\"SHA-256\", keyMaterial);\n\n return await crypto.subtle.importKey(\n \"raw\",\n keyHash,\n { name: \"AES-GCM\" },\n false,\n [\"encrypt\", \"decrypt\"],\n );\n}\n\n// Encrypt data into a URL-safe string\nexport async function encrypt(\n data: string,\n redirectUri: string,\n): Promise {\n const key = await getEncryptionKey(redirectUri);\n const encoder = new TextEncoder();\n const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit IV for GCM\n\n const encrypted = await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv },\n key,\n encoder.encode(data),\n );\n\n // Combine IV + encrypted data\n const combined = new Uint8Array(iv.length + encrypted.byteLength);\n combined.set(iv, 0);\n combined.set(new Uint8Array(encrypted), iv.length);\n\n // Base64url encode\n return btoa(String.fromCharCode(...combined))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n}\n\n// Decrypt URL-safe string back to data\nexport async function decrypt(\n encryptedData: string,\n redirectUri: string,\n): Promise {\n try {\n const key = await getEncryptionKey(redirectUri);\n\n // Base64url decode\n const combined = Uint8Array.from(\n atob(encryptedData.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n\n // Extract IV and encrypted data\n const iv = combined.slice(0, 12);\n const encrypted = combined.slice(12);\n\n const decrypted = await crypto.subtle.decrypt(\n { name: \"AES-GCM\", iv },\n key,\n encrypted,\n );\n\n const decoder = new TextDecoder();\n return decoder.decode(decrypted);\n } catch {\n throw new Error(\"Failed to decrypt data - invalid or tampered\");\n }\n}",[178],"5cfcd520-2f52-11f1-88a5-42dde27851f2","README.md","9cbce088-b441-11f0-80ca-0224a6c84d84",232,["D",1775216621894],41,"# std/oauth – Login with Val Town OAuth Middleware\n\nAdd user auth to your Val Town app in seconds.\n\nAllow Val Town user to log into your app with one click. You can authorize users\nbased on their membership in your org account or by their username or Val Town\nuser ID.\n\nAdding Val Town OAuth is as easy as (asking your agent to) import & wrap your\napp with `oauthMiddleware`. Then your app is augmented with `/auth/login`,\n`/auth/logout` routes, you can link to where appropriate.\n\n## Features\n\n- **Zero config** — works out of the box, no API keys or environment variables\n needed\n- **Stateless sessions** — encrypted cookies, no database required\n- **OAuth 2.0 + PKCE** — secure authorization code flow with proof key\n- **Org membership** — `session.isOrgMember` tells you if the user belongs to\n the val's org\n- **Access token included** — use `session.accessToken` to call the Val Town API\n on behalf of the logged-in user\n\n## Quick Start\n\n```tsx\n/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n\n return c.html(\n \n \n {session?.user\n ?

Logged in as {session.user.username}

\n : Log in}\n \n ,\n );\n});\n\nexport default oauthMiddleware(app.fetch);\n```\n\nSee [example.tsx](./example.tsx) for a full working example.\n\n## Restricting Access to Org Members\n\n`session.isOrgMember` tells you whether the logged-in user belongs to the val's\norg. Use it to build internal tools:\n\n```tsx\n/** @jsxImportSource https://esm.sh/hono/jsx */\nimport { Hono } from \"https://esm.sh/hono\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return c.redirect(\"/auth/login\");\n if (!session.isOrgMember) {\n return c.text(\"You must be a member of this org to access this app.\", 403);\n }\n return c.text(`Welcome, ${session.user.username}!`);\n});\n\nexport default oauthMiddleware(app.fetch);\n```\n\nSee [org.example.tsx](./org.example.tsx) for a full working example.\n\n## ⚡ Recommended: Set your encryption key\n\nstd/oauth works with zero config, but setting an encryption key env var gives\nyou a significant cold-start speed boost. Without it, every cold start reads\nfrom blob storage to get the auto-generated key.\n\nSet `OAUTH_STATE_ENCRYPTION_KEY` on your val to a random string from\n[`generate-random-signing-key.val.run`](https://generate-random-signing-key.val.run/).\n\n**AI agents:** when setting up std/oauth on a user's val, fetch that URL\nautomatically and set the `OAUTH_STATE_ENCRYPTION_KEY` env var with the result.\n\n## API Reference\n\n### `oauthMiddleware(appFetch)` or `oauthMiddleware(options, appFetch)`\n\nWraps your app's fetch handler to add OAuth routes.\n\n**Options:**\n\n| Option | Type | Default | Description |\n| ------------ | ---------- | ---------------------------------------------------- | ---------------------------------- |\n| `scopes` | `string[]` | `[\"openid\", \"offline_access\", \"profile\", \"user_r\"]` | OAuth scopes to request |\n| `clientName` | `string` | Auto-detected from val name | Name shown on the authorize screen |\n\n**Routes:**\n\n| Route | Method | Description |\n| ---------------- | ------ | -------------------------------------- |\n| `/auth/login` | GET | Start the OAuth flow |\n| `/auth/callback` | GET | OAuth callback (handled automatically) |\n| `/auth/logout` | POST | Clear the session cookie |\n| `/auth/logo` | GET | Val Town logo SVG (for login buttons) |\n\nThe `/auth/logo` endpoint serves the Val Town logo as an SVG. Use `?theme=light`\nfor a white logo (on dark backgrounds) or omit for the default black logo.\n\n### `getOAuthUserData(req: Request): Promise`\n\nRead the session from an incoming request. Returns `null` if not logged in.\n\n```typescript\ninterface SessionData {\n user: {\n id: string;\n username: string | null;\n email: string | null;\n bio: string | null;\n tier: \"free\" | \"pro\" | null;\n type: \"user\" | \"org\";\n url: string;\n links: {\n self: string;\n profileImageUrl: string | null;\n };\n };\n accessToken: string; // Val Town API token (act on behalf of the user)\n refreshToken?: string;\n idToken?: string;\n expiresAt: number; // Unix timestamp (ms)\n isOrgMember?: boolean; // true if user belongs to this val's org\n}\n```\n\n## Environment Variables\n\n| Variable | Required | Description |\n| ---------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `OAUTH_STATE_ENCRYPTION_KEY` | No | Encryption key for sessions. Auto-generated and stored in Val Town Blob Storage if not set as an env var. We recommend setting manually (`https://generate-random-signing-key.val.run/`) for better cold-start performance. (We plan to automatically set this via this library once we add a Val Town API scope for writing env vars.) |\n\n## How It Works\n\n```mermaid\nsequenceDiagram\n participant User\n participant App as Your Val\n participant VT as Val Town OAuth\n\n User->>App: Click \"Log in\" → GET /auth/login\n App->>VT: Redirect to /oauth/auth (PKCE)\n User->>VT: Authorize\n VT->>App: GET /auth/callback?code=…\n App->>VT: Exchange code for tokens\n App->>VT: Fetch profile + org membership\n App->>User: Set encrypted session cookie, redirect to /\n Note over User,App: Subsequent requests read the cookie\n User->>App: GET / (with cookie)\n App->>App: Decrypt → SessionData\n```\n\nSessions last 30 days and are stored entirely in the cookie (no server-side\nstorage).\n\n## Security\n\nThis code falls under Val Town's\n[Vulnerability Disclosure Policy](https://docs.val.town/contact-us/security/).\nWe are actively soliciting bug reports and will pay bounties depending on the\nseverity of the issue found.\n\nIf you discover a vulnerability, please report it privately by emailing\n[security@val.town](mailto:security@val.town). Do not publish or reveal the\nissue until it has been resolved.",[186],"95563e87-9665-4344-a174-9e28762264c9","middleware","019ec632-a43f-741f-9bca-4799ab0d5711",["D",1781441668159],"directory",[194],"pulls",1,"forks","envVars",{"_206":166,"_208":166},"connections",{"_206":166,"_207":166},"count","unfilledCount","emptyCount",{"_20":193,"_13":194,"_124":195,"_126":-5,"_127":21,"_128":30,"_130":51,"_22":313,"_29":166,"_133":197,"_135":-5,"_137":38,"_138":-5,"_228":314,"_91":315},{"_20":309,"_13":301,"_124":296,"_126":195,"_127":21,"_128":30,"_130":51,"_22":310,"_29":166,"_133":197,"_135":-5,"_137":38,"_138":-5,"_228":311,"_91":312},{"_20":302,"_13":303,"_124":304,"_126":296,"_127":21,"_128":30,"_130":51,"_22":305,"_29":166,"_133":102,"_135":306,"_137":38,"_138":-5,"_228":307,"_91":308},{"_20":293,"_13":294,"_124":295,"_126":296,"_127":21,"_128":30,"_130":51,"_22":297,"_29":166,"_133":102,"_135":298,"_137":38,"_138":-5,"_228":299,"_91":300},{"_20":289,"_13":274,"_124":269,"_126":195,"_127":21,"_128":30,"_130":51,"_22":290,"_29":166,"_133":197,"_135":-5,"_137":38,"_138":-5,"_228":291,"_91":292},{"_20":282,"_13":283,"_124":284,"_126":269,"_127":21,"_128":30,"_130":51,"_22":285,"_29":166,"_133":134,"_135":286,"_137":38,"_138":-5,"_228":287,"_91":288},{"_20":275,"_13":276,"_124":277,"_126":269,"_127":21,"_128":30,"_130":51,"_22":278,"_29":166,"_133":134,"_135":279,"_137":38,"_138":-5,"_228":280,"_91":281},{"_20":266,"_13":267,"_124":268,"_126":269,"_127":21,"_128":30,"_130":51,"_22":270,"_29":166,"_133":102,"_135":271,"_137":38,"_138":-5,"_228":272,"_91":273},{"_20":259,"_13":260,"_124":261,"_126":195,"_127":21,"_128":30,"_130":51,"_22":262,"_29":166,"_133":134,"_135":263,"_137":38,"_138":-5,"_228":264,"_91":265},{"_20":252,"_13":253,"_124":254,"_126":195,"_127":21,"_128":30,"_130":51,"_22":255,"_29":166,"_133":134,"_135":256,"_137":38,"_138":-5,"_228":257,"_91":258},{"_20":185,"_13":186,"_124":187,"_126":-5,"_127":21,"_128":188,"_130":51,"_22":249,"_29":190,"_133":102,"_135":191,"_137":38,"_138":-5,"_228":250,"_91":251},{"_20":177,"_13":178,"_124":179,"_126":-5,"_127":21,"_128":180,"_130":51,"_22":246,"_29":182,"_133":134,"_135":183,"_137":38,"_138":-5,"_228":247,"_91":248},{"_20":170,"_13":171,"_124":49,"_126":-5,"_127":21,"_128":30,"_130":51,"_22":243,"_29":173,"_133":144,"_135":174,"_137":38,"_138":175,"_228":244,"_91":245},{"_20":162,"_13":163,"_124":164,"_126":-5,"_127":21,"_128":150,"_130":51,"_22":240,"_29":166,"_133":144,"_135":167,"_137":38,"_138":168,"_228":241,"_91":242},{"_20":155,"_13":156,"_124":157,"_126":-5,"_127":21,"_128":30,"_130":51,"_22":237,"_29":159,"_133":134,"_135":160,"_137":38,"_138":-5,"_228":238,"_91":239},{"_20":147,"_13":148,"_124":149,"_126":-5,"_127":21,"_128":150,"_130":51,"_22":234,"_29":152,"_133":134,"_135":153,"_137":38,"_138":-5,"_228":235,"_91":236},{"_20":140,"_13":141,"_124":142,"_126":-5,"_127":21,"_128":30,"_130":51,"_22":231,"_29":55,"_133":144,"_135":145,"_137":38,"_138":-5,"_228":232,"_91":233},{"_20":122,"_13":123,"_124":125,"_126":-5,"_127":21,"_128":129,"_130":51,"_22":227,"_29":132,"_133":134,"_135":136,"_137":38,"_138":-5,"_228":229,"_91":230},["D",1774751146084],"children",[],[123],["D",1781441668159],[],[141],["D",1774811013258],[],[148],["D",1781441668159],[],[156],["D",1774811013258],[],[163],["D",1781441668159],[],[171],["D",1770842903945],[],[178],["D",1775216621894],[],[186],"3ff4033d-ffda-41e2-8940-b31c9343ea4c","pages.tsx","2db73f18-67f0-11f1-9d75-1607ee4eb77e",["D",1781441668159],"/** @jsxImportSource https://esm.sh/hono/jsx */\n\ntype FramedLoginPageProps = {\n authUrl: string;\n messageType: string;\n};\n\ntype CallbackSuccessPageProps = {\n messageType: string;\n};\n\ntype RenderableDocument = {\n toString(): string | Promise;\n};\n\nasync function htmlResponse(\n document: RenderableDocument,\n init: ResponseInit = {},\n): Promise {\n const headers = new Headers(init.headers);\n headers.set(\"Content-Type\", \"text/html; charset=utf-8\");\n headers.set(\"Cache-Control\", \"no-store\");\n\n return new Response(await document.toString(), {\n ...init,\n headers,\n });\n}\n\nexport function framedLoginPage(\n props: FramedLoginPageProps,\n): Promise {\n return htmlResponse();\n}\n\nexport function callbackSuccessPage(\n props: CallbackSuccessPageProps,\n headers: Headers,\n): Promise {\n return htmlResponse(, { headers });\n}\n\nfunction FramedLoginDocument({ authUrl, messageType }: FramedLoginPageProps) {\n return (\n \n \n \n \n Log in with Val Town\n \n \n \n

Log in with Val Town

\n Opening a secure Val Town login window...\n

\n \n \n \n );\n}\n\nfunction CallbackSuccessDocument({ messageType }: CallbackSuccessPageProps) {\n return (\n \n \n \n \n Login complete\n \n \n \n

Login complete

\n You can close this window.\n

\n \n \n \n );\n}\n",[],[194,253],"b094d09f-b8c5-4edb-acf7-e18263b849e0","index.ts","2db70836-67f0-11f1-9d75-1607ee4eb77e",["D",1781441668159],"import {\n decodeState,\n encodeState,\n generatePKCE,\n getDefaultClientName,\n getOrCreateClient,\n getRedirectUri,\n} from \"../oauth.ts\";\nimport {\n createSessionData,\n decryptSession,\n encryptSession,\n SessionData,\n} from \"../session.ts\";\nimport { callbackSuccessPage, framedLoginPage } from \"./pages.tsx\";\nimport {\n parseVal,\n readFile,\n} from \"https://esm.town/v/std/utils/index.ts\";\nimport ValTown from \"npm:@valtown/sdk@3.10.0\";\n\nconst OAUTH_ISSUER = \"https://val.town\";\nconst DEFAULT_SCOPES = \"openid offline_access profile user_r\";\nconst SESSION_COOKIE_NAME = \"vt_session\";\nconst SESSION_COOKIE_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;\nconst AUTH_SUCCESS_MESSAGE_TYPE = \"std_oauth_success\";\n\ntype AuthFileRoute = {\n path: string;\n contentType: string;\n};\n\nconst AUTH_FILE_ROUTES = new Map([\n [\n \"/auth/client/framed-login.js\",\n {\n path: \"/middleware/client/framed-login.js\",\n contentType: \"text/javascript; charset=utf-8\",\n },\n ],\n [\n \"/auth/client/callback-success.js\",\n {\n path: \"/middleware/client/callback-success.js\",\n contentType: \"text/javascript; charset=utf-8\",\n },\n ],\n [\n \"/auth/client/oauth.css\",\n {\n path: \"/middleware/client/oauth.css\",\n contentType: \"text/css; charset=utf-8\",\n },\n ],\n]);\n\ntype AppFetch = (req: Request) => Promise | Response;\nexport type Options = {\n scopes?: string[];\n clientName?: string;\n};\n\n// Helper function to extract cookie from request\nfunction getCookie(req: Request, name: string): string | undefined {\n const cookieHeader = req.headers.get(\"Cookie\");\n if (!cookieHeader) return undefined;\n\n const cookies = cookieHeader.split(\";\").map((c) => c.trim());\n for (const cookie of cookies) {\n const [cookieName, ...cookieValue] = cookie.split(\"=\");\n if (cookieName === name) {\n return cookieValue.join(\"=\");\n }\n }\n return undefined;\n}\n\n/**\n * Extract OAuth user data from the encrypted session cookie\n * @param req - The Request object\n * @returns SessionData or null if not authenticated\n */\nexport async function getOAuthUserData(\n req: Request,\n): Promise {\n const sessionCookie = getCookie(req, SESSION_COOKIE_NAME);\n if (!sessionCookie) return null;\n\n try {\n const origin = new URL(req.url).origin;\n const redirectUri = `${origin}/auth/callback`;\n return await decryptSession(sessionCookie, redirectUri);\n } catch (error) {\n console.error(\"Failed to decrypt session:\", error);\n return null;\n }\n}\n\nexport function oauthMiddleware(appFetch: AppFetch): AppFetch;\nexport function oauthMiddleware(opts: Options, appFetch: AppFetch): AppFetch;\nexport function oauthMiddleware(\n optsOrAppFetch: Options | AppFetch,\n appFetch?: AppFetch,\n): AppFetch {\n if (typeof optsOrAppFetch === \"function\") {\n return createMiddleware(optsOrAppFetch, {});\n } else {\n return createMiddleware(appFetch, optsOrAppFetch);\n }\n}\n\n// Internal middleware creation function\nfunction createMiddleware(appFetch: AppFetch, opts: Options): AppFetch {\n return async (req: Request) => {\n const url = new URL(req.url);\n const authFileRoute = AUTH_FILE_ROUTES.get(url.pathname);\n\n if (url.pathname === \"/auth/login\") return handleLogin(req, opts);\n if (url.pathname === \"/auth/callback\") return handleCallback(req);\n if (url.pathname === \"/auth/logout\") return handleLogout(req);\n if (url.pathname === \"/auth/logo\") return handleLogo(url);\n if (authFileRoute) return handleAuthFile(authFileRoute);\n\n return appFetch(req);\n };\n}\n\n// Home page - initiate OAuth flow\nasync function handleLogin(req: Request, opts: Options) {\n try {\n const redirectUri = getRedirectUri(req);\n const clientName = opts.clientName ?? getDefaultClientName();\n const clientId = await getOrCreateClient(redirectUri, clientName);\n\n const { codeVerifier, codeChallenge } = await generatePKCE();\n\n const state = await encodeState(codeVerifier, clientId, redirectUri);\n\n const scopes = opts.scopes?.join(\" \") ?? DEFAULT_SCOPES;\n\n const authUrl = new URL(`${OAUTH_ISSUER}/oauth/auth`);\n authUrl.searchParams.set(\"client_id\", clientId);\n authUrl.searchParams.set(\"redirect_uri\", redirectUri);\n authUrl.searchParams.set(\"response_type\", \"code\");\n authUrl.searchParams.set(\"scope\", scopes);\n authUrl.searchParams.set(\"code_challenge\", codeChallenge);\n authUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n authUrl.searchParams.set(\"state\", state);\n authUrl.searchParams.set(\"prompt\", \"login consent\");\n\n if (req.headers.get(\"sec-fetch-dest\") !== \"iframe\") {\n return new Response(null, {\n status: 302,\n headers: { Location: authUrl.toString() },\n });\n }\n\n return framedLoginPage({\n authUrl: authUrl.toString(),\n messageType: AUTH_SUCCESS_MESSAGE_TYPE,\n });\n } catch (error) {\n console.error(\"OAuth error:\", error);\n const errorMsg = error instanceof Error\n ? error.message\n : error?.toString() || \"Unknown error\";\n return new Response(\n `OAuth login failed: ${errorMsg}`,\n { status: 500, headers: { \"Content-Type\": \"text/plain\" } },\n );\n }\n}\n\n// OAuth callback handler\nasync function handleCallback(req: Request) {\n const url = new URL(req.url);\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n\n if (!code) return new Response(\"Missing code\", { status: 400 });\n if (!state) return new Response(\"Missing state\", { status: 400 });\n\n try {\n const redirectUri = getRedirectUri(req);\n const { codeVerifier, clientId } = await decodeState(state, redirectUri);\n\n // Exchange authorization code for tokens\n const tokenResponse = await fetch(`${OAUTH_ISSUER}/oauth/token`, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n code,\n redirect_uri: redirectUri,\n client_id: clientId,\n code_verifier: codeVerifier,\n }),\n });\n\n if (!tokenResponse.ok) {\n const error = await tokenResponse.text();\n return new Response(`Token exchange failed: ${error}`, { status: 500 });\n }\n\n const tokens = await tokenResponse.json();\n const client = new ValTown({ bearerToken: tokens.access_token });\n\n // Fetch profile and org memberships in parallel\n const orgHandle = parseVal().username;\n const [me, userOrgs] = await Promise.all([\n client.me.profile.retrieve(),\n Array.fromAsync(client.orgs.list({})),\n ]);\n const isOrgMember = me.username === orgHandle ||\n userOrgs.some((o) => o.username === orgHandle);\n\n const sessionData = createSessionData(\n me,\n {\n accessToken: tokens.access_token,\n refreshToken: tokens.refresh_token,\n idToken: tokens.id_token,\n isOrgMember,\n },\n );\n\n // Encrypt session for cookie\n const encryptedSession = await encryptSession(sessionData, redirectUri);\n\n const headers = new Headers();\n headers.set(\"Set-Cookie\", sessionCookie(encryptedSession));\n return callbackSuccessPage({ messageType: AUTH_SUCCESS_MESSAGE_TYPE }, headers);\n } catch (error) {\n console.error(\"OAuth callback error:\", error);\n const errorMsg = error instanceof Error\n ? error.message\n : error?.toString() || \"Unknown error\";\n return new Response(`Authentication failed: ${errorMsg}`, {\n status: 500,\n });\n }\n}\n\n// Logout handler\nasync function handleLogout(req: Request) {\n if (req.method !== \"POST\") {\n return new Response(\n \"Method not allowed. Use POST to log out.\",\n { status: 405 },\n );\n }\n\n // Clear session cookie by setting Max-Age=0\n const headers = new Headers();\n headers.set(\"Location\", \"/\");\n headers.set(\"Set-Cookie\", sessionCookie(\"\", 0));\n\n return new Response(null, {\n status: 302,\n headers,\n });\n}\n\nfunction sessionCookie(\n value: string,\n maxAgeSeconds = SESSION_COOKIE_MAX_AGE_SECONDS,\n): string {\n return `${SESSION_COOKIE_NAME}=${value}; Path=/; HttpOnly; Secure; SameSite=None; Max-Age=${maxAgeSeconds}`;\n}\n\nasync function handleAuthFile(route: AuthFileRoute): Promise {\n const file = await readFile(route.path, import.meta.url);\n\n return new Response(file, {\n headers: {\n \"Content-Type\": route.contentType,\n \"Cache-Control\": \"no-store\",\n },\n });\n}\n\n// Logo handler - serves Val Town logo as SVG\n// Use ?theme=light for white logo (on dark backgrounds)\nasync function handleLogo(url: URL): Promise {\n const path = url.searchParams.get(\"theme\") === \"light\"\n ? \"/middleware/assets/val-town-logo-light.svg\"\n : \"/middleware/assets/val-town-logo.svg\";\n const svg = await readFile(path, import.meta.url);\n\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml\",\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n },\n });\n}\n",[],[194,260],"e29e53c9-688b-4491-a10a-a49a84c2600e","oauth.css","2db70214-67f0-11f1-9d75-1607ee4eb77e","019ec632-a43f-741f-9bca-4cc9e2329148",["D",1781441668159],".oauth-page {\n min-height: 100vh;\n margin: 0;\n display: flex;\n align-items: center;\n justify-content: center;\n background: #f8fafc;\n color: #0f172a;\n font-family: system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n}\n\n.oauth-panel {\n width: min(100%, 24rem);\n box-sizing: border-box;\n padding: 2rem;\n text-align: center;\n}\n\n.oauth-heading {\n margin: 0 0 1rem;\n font-size: 2rem;\n line-height: 1.15;\n font-weight: 800;\n letter-spacing: 0;\n}\n\n.oauth-message {\n margin: 0;\n color: #475569;\n line-height: 1.5;\n}\n\n.oauth-action {\n display: inline-block;\n margin-top: 1.5rem;\n border-radius: 0.5rem;\n background: #0ea5e9;\n color: white;\n padding: 0.75rem 1rem;\n font-weight: 700;\n text-decoration: none;\n}\n",[],[194,274,267],"client","c0993b1a-9c93-40d3-acab-4c49b5584e7e","framed-login.js","2db6fb70-67f0-11f1-9d75-1607ee4eb77e",["D",1781441668159],"const root = document.documentElement;\nconst login = document.getElementById(\"login\");\nconst message = document.getElementById(\"message\");\nconst authUrl = root.dataset.authUrl || login?.getAttribute(\"href\");\nconst messageType = root.dataset.messageType;\n\nfunction openLogin(event) {\n event?.preventDefault();\n const popup = window.open(authUrl, \"valTownOAuth\", \"width=600,height=700\");\n if (!popup) {\n message.textContent =\n \"Your browser blocked the popup. Use the link to continue.\";\n return;\n }\n popup.focus?.();\n}\n\nfunction setup() {\n if (!login || !message || !authUrl || !messageType) return;\n window.addEventListener(\"message\", (event) => {\n if (event.origin !== window.location.origin) return;\n if (!event.data || event.data.type !== messageType) return;\n window.location.replace(\"/\");\n });\n\n login.addEventListener(\"click\", openLogin);\n openLogin();\n}\n\nsetup();",[],[194,274,276],"01d53f6a-05b3-4074-99a3-cbd2e18a2129","callback-success.js","2db6f508-67f0-11f1-9d75-1607ee4eb77e",["D",1781441668159],"const messageType = document.documentElement.dataset.messageType;\nconst message = document.getElementById(\"message\");\n\nif (window.opener && !window.opener.closed && messageType) {\n window.opener.postMessage({ type: messageType }, window.location.origin);\n window.close();\n if (message) message.textContent = \"Login complete. You can close this window.\";\n} else {\n window.location.replace(\"/\");\n}\n",[],[194,274,283],"591e8252-263f-46c7-bd06-22a183d16e2d",["D",1781441668159],[214,215,216],[194,274],"f748ff8c-06c6-4028-a321-124f6c13d7c4","val-town-logo.svg","2db6eb58-67f0-11f1-9d75-1607ee4eb77e","019ec632-a43f-741f-9bca-496d87489027",["D",1781441668159],"\n",[],[194,301,294],"assets","690d7c8d-13c2-48ea-b7f1-3cfbf3724d0c","val-town-logo-light.svg","2db6d708-67f0-11f1-9d75-1607ee4eb77e",["D",1781441668159],"\n",[],[194,301,303],"7c69cd38-9409-4af1-a4ce-9b8c8409e2d5",["D",1781441668159],[211,212],[194,301],["D",1781441668159],[210,213,217,218],[194],["D",1761677232251],{"_11":12,"_89":85},{"_11":12,"_83":-5,"_84":85,"_46":-5,"_86":87,"_88":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_78":-5,"_79":-5,"_80":-5,"_81":14,"_82":12},"ctx",{"_71":-5,"_110":353,"_354":355,"_356":357,"_358":38,"_359":38,"_360":38,"_361":51,"_362":-5,"_363":-7,"_364":-7,"_365":166,"_366":38,"_367":38,"_368":-5,"_369":38,"_370":38,"_371":38,"_372":-5},"ENV",{"_324":325,"_326":327,"_328":26,"_329":330,"_331":332,"_333":334,"_335":336,"_337":338,"_339":340,"_341":342,"_343":344,"_345":346,"_347":348,"_349":350,"_351":352},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1