\n \n \n \n\n",[],[66,111],["D",1748008297272],[120,121,122],[72],{"_36":139,"_13":38,"_39":140,"_41":73,"_42":43,"_44":141,"_46":47,"_48":142,"_17":50,"_51":24,"_52":143,"_54":55,"_56":-5,"_82":144,"_18":145},{"_36":132,"_13":133,"_39":134,"_41":73,"_42":43,"_44":74,"_46":47,"_48":135,"_17":50,"_51":93,"_52":136,"_54":55,"_56":-5,"_82":137,"_18":138},{"_36":123,"_13":124,"_39":125,"_41":73,"_42":43,"_44":126,"_46":47,"_48":127,"_17":68,"_51":128,"_52":129,"_54":55,"_56":-5,"_82":130,"_18":131},"576f14dc-37dd-11f0-a07e-9e149126039e","index.ts","1b6e380a-37dd-11f0-addf-9e149126039e",11,["D",1748008424259],"http","import { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\nimport { GitHubAPI, exchangeCodeForToken } from \"./github.ts\";\n\nconst app = new Hono();\n\n// Cookie helper functions\nfunction getCookie(c: any, name: string): string | undefined {\n const cookieHeader = c.req.header('Cookie');\n if (!cookieHeader) return undefined;\n \n const cookies = cookieHeader.split(';').reduce((acc: any, cookie: string) => {\n const [key, value] = cookie.trim().split('=');\n acc[key] = decodeURIComponent(value);\n return acc;\n }, {});\n \n return cookies[name];\n}\n\nfunction setCookie(c: any, name: string, value: string, options: any = {}) {\n const cookieOptions = [];\n cookieOptions.push(`${name}=${encodeURIComponent(value)}`);\n \n if (options.maxAge) cookieOptions.push(`Max-Age=${options.maxAge}`);\n if (options.httpOnly) cookieOptions.push('HttpOnly');\n if (options.secure) cookieOptions.push('Secure');\n if (options.sameSite) cookieOptions.push(`SameSite=${options.sameSite}`);\n \n c.header('Set-Cookie', cookieOptions.join('; '));\n}\n\nfunction deleteCookie(c: any, name: string) {\n setCookie(c, name, '', { maxAge: 0 });\n}\n\n// Unwrap Hono errors to see original error details\napp.onError((err, c) => {\n throw err;\n});\n\n// Serve static files\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n\n// Main page - serve HTML with initial data\napp.get(\"/\", async (c) => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Check if user is authenticated\n const accessToken = getCookie(c, \"github_token\");\n let initialData = { user: null, repos: [], loading: false, error: null };\n \n if (accessToken) {\n try {\n const github = new GitHubAPI(accessToken);\n const user = await github.getUser();\n initialData.user = user;\n } catch (error) {\n console.error(\"Failed to fetch user data:\", error);\n // Clear invalid token\n deleteCookie(c, \"github_token\");\n }\n }\n \n // Inject initial data\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n});\n\n// Start GitHub OAuth flow\napp.get(\"/auth/login\", (c) => {\n const clientId = Deno.env.get(\"GITHUB_CLIENT_ID\");\n \n if (!clientId) {\n return c.json({ error: \"GitHub OAuth not configured\" }, 500);\n }\n \n const baseUrl = new URL(c.req.url).origin;\n const redirectUri = `${baseUrl}/auth/callback`;\n const scope = \"user:email,repo\";\n const state = crypto.randomUUID(); // CSRF protection\n \n // Store state in cookie for verification\n setCookie(c, \"oauth_state\", state, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 600, // 10 minutes\n });\n \n const authUrl = new URL(\"https://github.com/login/oauth/authorize\");\n authUrl.searchParams.set(\"client_id\", clientId);\n authUrl.searchParams.set(\"redirect_uri\", redirectUri);\n authUrl.searchParams.set(\"scope\", scope);\n authUrl.searchParams.set(\"state\", state);\n \n return new Response(null, {\n status: 302,\n headers: { Location: authUrl.toString() }\n });\n});\n\n// Handle OAuth callback\napp.get(\"/auth/callback\", async (c) => {\n const url = new URL(c.req.url);\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n const error = url.searchParams.get(\"error\");\n \n // Check for OAuth errors\n if (error) {\n return c.html(`\n

Authentication Error

GitHub OAuth error: ${error}

\n Go back\n `);\n }\n \n // Verify state parameter (CSRF protection)\n const storedState = getCookie(c, \"oauth_state\");\n if (!state || state !== storedState) {\n return c.html(`\n

Authentication Error

Invalid state parameter. Please try again.

\n Go back\n `);\n }\n \n // Clear state cookie\n deleteCookie(c, \"oauth_state\");\n \n if (!code) {\n return c.html(`\n

Authentication Error

No authorization code received.

\n Go back\n `);\n }\n \n try {\n // Exchange code for access token\n const tokenData = await exchangeCodeForToken(code);\n \n // Store token in secure cookie\n setCookie(c, \"github_token\", tokenData.access_token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 30, // 30 days\n });\n \n // Redirect to main page\n return new Response(null, {\n status: 302,\n headers: { Location: \"/\" }\n });\n \n } catch (error) {\n console.error(\"OAuth callback error:\", error);\n return c.html(`\n

Authentication Error

Failed to complete authentication: ${error.message}

\n Go back\n `);\n }\n});\n\n// Logout - clear cookies\napp.get(\"/auth/logout\", (c) => {\n deleteCookie(c, \"github_token\");\n return new Response(null, {\n status: 302,\n headers: { Location: \"/\" }\n });\n});\n\n// API: Get authenticated user\napp.get(\"/api/user\", async (c) => {\n const accessToken = getCookie(c, \"github_token\");\n \n if (!accessToken) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n \n try {\n const github = new GitHubAPI(accessToken);\n const user = await github.getUser();\n return c.json(user);\n } catch (error) {\n console.error(\"Failed to fetch user:\", error);\n // Clear invalid token\n deleteCookie(c, \"github_token\");\n return c.json({ error: \"Failed to fetch user data\" }, 401);\n }\n});\n\n// API: Get user repositories\napp.get(\"/api/repos\", async (c) => {\n const accessToken = getCookie(c, \"github_token\");\n \n if (!accessToken) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n \n try {\n const github = new GitHubAPI(accessToken);\n const repos = await github.getRepos();\n return c.json(repos);\n } catch (error) {\n console.error(\"Failed to fetch repos:\", error);\n return c.json({ error: \"Failed to fetch repositories\" }, 500);\n }\n});\n\n// Health check\napp.get(\"/health\", (c) => {\n return c.json({ status: \"ok\", timestamp: new Date().toISOString() });\n});\n\nexport default app.fetch;",[],[72,124],"0bbe2a78-37dd-11f0-ace0-9e149126039e","github.ts","0bbe2b2c-37dd-11f0-ace0-9e149126039e",["D",1748008297272],"// GitHub API client for server-side requests\n\nimport type { GitHubUser, GitHubRepo, OAuthTokenResponse } from \"../shared/types.ts\";\n\nexport class GitHubAPI {\n private baseURL = \"https://api.github.com\";\n \n constructor(private accessToken: string) {}\n\n private async request(endpoint: string): Promise {\n const response = await fetch(`${this.baseURL}${endpoint}`, {\n headers: {\n \"Authorization\": `Bearer ${this.accessToken}`,\n \"Accept\": \"application/vnd.github.v3+json\",\n \"User-Agent\": \"Val-Town-GitHub-OAuth-Template\",\n },\n });\n\n if (!response.ok) {\n throw new Error(`GitHub API error: ${response.status} ${response.statusText}`);\n }\n\n return response.json();\n }\n\n async getUser(): Promise {\n return this.request(\"/user\");\n }\n\n async getRepos(page = 1, perPage = 30): Promise {\n return this.request(`/user/repos?page=${page}&per_page=${perPage}&sort=updated`);\n }\n}\n\nexport async function exchangeCodeForToken(code: string): Promise {\n const clientId = Deno.env.get(\"GITHUB_CLIENT_ID\");\n const clientSecret = Deno.env.get(\"GITHUB_CLIENT_SECRET\");\n\n if (!clientId || !clientSecret) {\n throw new Error(\"GitHub OAuth credentials not configured\");\n }\n\n const response = await fetch(\"https://github.com/login/oauth/access_token\", {\n method: \"POST\",\n headers: {\n \"Accept\": \"application/json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n client_id: clientId,\n client_secret: clientSecret,\n code,\n }),\n });\n\n if (!response.ok) {\n throw new Error(`Failed to exchange code for token: ${response.statusText}`);\n }\n\n const data = await response.json();\n \n if (data.error) {\n throw new Error(`GitHub OAuth error: ${data.error_description || data.error}`);\n }\n\n return data;\n}",[],[72,133],"686181da-37dd-11f0-ac79-9e149126039e","6861828e-37dd-11f0-ac79-9e149126039e",12,["D",1748008452695],"# Backend - GitHub OAuth Template\n\nThis directory contains the backend implementation for the GitHub OAuth template using Hono framework.\n\n## Files\n\n- `index.ts` - Main Hono application with OAuth routes and API endpoints\n- `github.ts` - GitHub API client for server-side requests\n\n## Features\n\n### OAuth Flow\n- **Login**: `/auth/login` - Initiates GitHub OAuth flow\n- **Callback**: `/auth/callback` - Handles OAuth callback and token exchange\n- **Logout**: `/auth/logout` - Clears authentication cookies\n\n### API Endpoints\n- **User Profile**: `GET /api/user` - Returns authenticated user's GitHub profile\n- **Repositories**: `GET /api/repos` - Returns user's repositories\n- **Health Check**: `GET /health` - Application health status\n\n### Security Features\n- **HTTP-only Cookies**: Tokens stored securely, not accessible to JavaScript\n- **CSRF Protection**: State parameter validation during OAuth flow\n- **Secure Cookies**: HTTPS-only transmission with SameSite protection\n- **Token Validation**: Automatic cleanup of invalid tokens\n\n## Cookie Management\n\nThe application uses custom cookie helper functions since Hono's cookie helpers had import issues:\n\n```typescript\n// Get cookie value\nconst token = getCookie(c, \"github_token\");\n\n// Set secure cookie\nsetCookie(c, \"github_token\", accessToken, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 30 // 30 days\n});\n\n// Delete cookie\ndeleteCookie(c, \"github_token\");\n```\n\n## Environment Variables\n\nRequired environment variables:\n- `GITHUB_CLIENT_ID` - GitHub OAuth app client ID\n- `GITHUB_CLIENT_SECRET` - GitHub OAuth app client secret\n\n## Error Handling\n\nThe application includes comprehensive error handling:\n- OAuth errors are displayed with user-friendly messages\n- Invalid tokens are automatically cleared\n- API errors return appropriate HTTP status codes\n- All errors bubble up with full context for debugging\n\n## GitHub API Integration\n\nThe `GitHubAPI` class provides a clean interface for GitHub API requests:\n\n```typescript\nconst github = new GitHubAPI(accessToken);\nconst user = await github.getUser();\nconst repos = await github.getRepos();\n```\n\nAll requests include proper headers and error handling.",[],[72,38],"b49baf68-37dc-11f0-b339-9e149126039e",["D",1748008151091],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_198":194},"org",{"_11":12,"_192":-5,"_193":194,"_155":156,"_195":196,"_197":55},"branch",{"_17":141,"_13":16,"_36":43,"_184":146,"_185":-5,"_186":-5,"_187":-5,"_188":-5,"_189":-5,"_190":14,"_191":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":146,"_13":14,"_48":264,"_148":-5,"_149":55,"_150":151,"_152":151,"_153":-5,"_154":-5,"_155":156,"_157":125,"_158":47,"_159":47,"_160":-5,"_161":61,"_162":163,"_164":-5,"_165":-5,"_166":-5,"_167":-5,"_168":169,"_170":169,"_171":172,"_173":172,"_174":172,"_175":169,"_176":169,"_177":265,"_179":266,"_181":267,"_183":55},[234,238,241,243],"files",[234,235,236,237,238,239,240,241,242,243],"counts",{"_225":50,"_226":45,"_227":50,"_31":228,"_229":230},[217,218,219,220],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_36":71,"_13":72,"_39":73,"_41":-5,"_42":43,"_44":74,"_46":47,"_48":75,"_17":50,"_51":63,"_52":-5,"_54":55,"_56":-5,"_18":224},{"_36":65,"_13":66,"_39":67,"_41":-5,"_42":43,"_44":68,"_46":47,"_48":69,"_17":50,"_51":63,"_52":-5,"_54":55,"_56":-5,"_18":223},{"_36":58,"_13":59,"_39":60,"_41":-5,"_42":43,"_44":61,"_46":47,"_48":62,"_17":50,"_51":63,"_52":-5,"_54":55,"_56":-5,"_18":222},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":49,"_17":50,"_51":24,"_52":53,"_54":55,"_56":-5,"_18":221},[38],[59],[66],[72],"pulls","branches","forks",{"_231":50,"_233":50},"connections",{"_231":50,"_232":50},"count","unfilledCount","emptyCount",{"_36":71,"_13":72,"_39":73,"_41":-5,"_42":43,"_44":74,"_46":47,"_48":117,"_17":50,"_51":63,"_52":-5,"_54":55,"_56":-5,"_82":262,"_18":263},{"_36":139,"_13":38,"_39":140,"_41":73,"_42":43,"_44":141,"_46":47,"_48":142,"_17":50,"_51":24,"_52":143,"_54":55,"_56":-5,"_82":260,"_18":261},{"_36":132,"_13":133,"_39":134,"_41":73,"_42":43,"_44":74,"_46":47,"_48":135,"_17":50,"_51":93,"_52":136,"_54":55,"_56":-5,"_82":258,"_18":259},{"_36":123,"_13":124,"_39":125,"_41":73,"_42":43,"_44":126,"_46":47,"_48":127,"_17":68,"_51":128,"_52":129,"_54":55,"_56":-5,"_82":256,"_18":257},{"_36":65,"_13":66,"_39":67,"_41":-5,"_42":43,"_44":68,"_46":47,"_48":97,"_17":50,"_51":63,"_52":-5,"_54":55,"_56":-5,"_82":254,"_18":255},{"_36":110,"_13":111,"_39":112,"_41":67,"_42":43,"_44":68,"_46":47,"_48":113,"_17":50,"_51":24,"_52":114,"_54":55,"_56":-5,"_82":252,"_18":253},{"_36":102,"_13":103,"_39":104,"_41":67,"_42":43,"_44":105,"_46":47,"_48":106,"_17":50,"_51":24,"_52":107,"_54":55,"_56":-5,"_82":250,"_18":251},{"_36":58,"_13":59,"_39":60,"_41":-5,"_42":43,"_44":61,"_46":47,"_48":85,"_17":50,"_51":63,"_52":-5,"_54":55,"_56":-5,"_82":248,"_18":249},{"_36":89,"_13":90,"_39":91,"_41":60,"_42":43,"_44":61,"_46":47,"_48":92,"_17":50,"_51":93,"_52":94,"_54":55,"_56":-5,"_82":246,"_18":247},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":81,"_17":50,"_51":24,"_52":53,"_54":55,"_56":-5,"_82":244,"_18":245},[],[38],[],[59,90],[242],[59],[],[66,103],[],[66,111],[239,240],[66],[],[72,124],[],[72,133],[],[72,38],[235,236,237],[72],["D",1748008151091],{"_11":12,"_198":194},{"_11":12,"_192":-5,"_193":194,"_155":156,"_195":196,"_197":55},{"_17":141,"_13":16,"_36":43,"_184":146,"_185":-5,"_186":-5,"_187":-5,"_188":-5,"_189":-5,"_190":14,"_191":12},"ctx",{"_177":-5,"_214":301,"_302":303,"_304":305,"_306":55,"_307":55,"_308":55,"_309":47,"_310":-5,"_311":-7,"_312":-7,"_313":50,"_314":55,"_315":55,"_316":-5,"_317":55,"_318":55,"_319":55,"_320":-5},"ENV",{"_272":273,"_274":275,"_276":16,"_277":278,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]