[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_195":196,"_197":198},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_144":145,"_37":-7,"_146":-5,"_17":147,"_148":149,"_150":151,"_152":153,"_154":155,"_51":-5,"_156":-5,"_157":-5,"_158":24,"_159":160,"_161":162,"_163":-5,"_164":-5,"_165":166},"routes/_app.x.$handle.$name.branch.$branch.history",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5},"handle","theguythatmakesstuff","name","reborn-auth","branchName","main","project",{"_31":98,"_13":14,"_35":99,"_100":-5,"_101":24,"_102":103,"_104":103,"_105":-5,"_106":-5,"_25":66,"_107":-5,"_108":24,"_109":-5,"_110":-5,"_111":20,"_39":40,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":117,"_118":117,"_119":120,"_121":120,"_122":120,"_123":117,"_124":117,"_49":125,"_126":127,"_128":129,"_130":24},"page",0,"history",[26,27,28,29,30],"hasNext",false,"userId",{"_31":91,"_33":34,"_35":92,"_37":93,"_39":40,"_41":84,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":94,"_51":95,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":96},{"_31":84,"_33":34,"_35":85,"_37":86,"_39":40,"_41":77,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":87,"_51":88,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":89},{"_31":77,"_33":34,"_35":78,"_37":79,"_39":40,"_41":69,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":80,"_51":81,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":82},{"_31":69,"_33":34,"_35":70,"_37":71,"_39":40,"_41":32,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":72,"_51":73,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":74},{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":58},"id","3ceb239e-e467-11f0-98f4-42dde27851f2","branchId","3ce7ef76-e467-11f0-98f4-42dde27851f2","createdAt",["D",1766979250313],"version",1,"orgId","019b67f9-870c-75ac-9bb3-24210d3c5641","parentId","incomingCommitId","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","clientLabel","user",{"_31":66,"_39":40,"_11":12,"_67":68},"file",{"_60":61,"_13":62,"_63":64,"_65":24},"pull","merge","revert","multiple","commits",[59],{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":-5,"_54":-5,"_55":-5},"fileId","3ce96c0c-e467-11f0-98f4-42dde27851f2","main.ts","fileType","script","deleted","019b67f9-870c-75ac-9bb3-2238af5e603d","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zN1Y2Yk5SZFd1TU41ZU1TbXB4Nnc3Q1VnU2wifQ","3dc7170a-e467-11f0-89ea-42dde27851f2",["D",1766979251748],2,{"_31":66,"_39":40,"_11":12,"_67":68},{"_60":61,"_13":62,"_63":76,"_65":24},[75],{"_31":69,"_33":34,"_35":70,"_37":71,"_39":40,"_41":32,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":72,"_51":73,"_53":-5,"_54":-5,"_55":-5},"http","3dcb9a28-e467-11f0-a1d9-42dde27851f2",["D",1766979251749],3,{"_31":66,"_39":40,"_11":12,"_67":68},{"_60":61,"_13":62,"_63":76,"_65":24},[83],{"_31":77,"_33":34,"_35":78,"_37":79,"_39":40,"_41":69,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":80,"_51":81,"_53":-5,"_54":-5,"_55":-5},"b106731e-e467-11f0-987f-42dde27851f2",["D",1766979445104],4,{"_31":66,"_39":40,"_11":12,"_67":68},{"_60":61,"_13":62,"_63":76,"_65":24},[90],{"_31":84,"_33":34,"_35":85,"_37":86,"_39":40,"_41":77,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":87,"_51":88,"_53":-5,"_54":-5,"_55":-5},"48411f90-e468-11f0-96a1-42dde27851f2",["D",1766979698827],5,{"_31":66,"_39":40,"_11":12,"_67":68},{"_60":61,"_13":62,"_63":76,"_65":24},[97],{"_31":91,"_33":34,"_35":92,"_37":93,"_39":40,"_41":84,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":94,"_51":95,"_53":-5,"_54":-5,"_55":-5},"3ce7af70-e467-11f0-98f4-42dde27851f2",["D",1766979250303],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_143":68},"org",{"_11":12,"_139":-5,"_67":68,"_25":66,"_140":141,"_142":24},"branch",{"_37":93,"_13":16,"_31":34,"_131":98,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":14,"_138":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","tier","free","canRestrictVals","profileImageUrl","path","","adoptOrgId",{"_31":98,"_13":14,"_35":191,"_100":-5,"_101":24,"_102":103,"_104":103,"_105":-5,"_106":-5,"_25":66,"_107":-5,"_108":24,"_109":-5,"_110":-5,"_111":20,"_39":40,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":117,"_118":117,"_119":120,"_121":120,"_122":120,"_123":117,"_124":117,"_49":192,"_126":193,"_128":194,"_130":24},"tree",[186],"files",[186],"counts",{"_176":20,"_177":38,"_178":20,"_179":180,"_181":182},"contents",[167],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_31":168,"_13":62,"_60":61,"_41":-5,"_33":34,"_169":93,"_170":162,"_35":171,"_37":86,"_63":76,"_172":173,"_65":24,"_174":-5,"_144":175},"483f97d8-e468-11f0-96a1-42dde27851f2","branchVersion","latest",["D",1766979698827],"content","// Learn more: https://docs.val.town/vals/http\n// Single-file HTTP val handler with zero external packages.\n// Implements minimal auth: /health, /, /auth/login, /auth/me, /auth/logout\n\n// --- Config (edit these for val.run) ---\nconst AUTH_SHARED_SECRET = \"replace-with-strong-secret\"; // required\nconst AUTH_ALLOWED_EMAILS = [\"user@example.com\", \"admin@example.com\"]; // [] allows any email\nconst AUTH_PASSWORD = \"replace-with-demo-password\"; // required\nconst AUTH_TOKEN_TTL = \"1h\"; // e.g., \"3600s\", \"60m\", \"1h\"\nconst COOKIE_DOMAIN = \"\"; // set to your domain to enable cookie mode\nconst NODE_ENV = \"production\";\n\n// --- Helpers ---\nconst te = new TextEncoder();\nconst td = new TextDecoder();\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);\n return btoa(binary);\n}\n\nfunction base64ToBytes(base64: string): Uint8Array {\n const binary = atob(base64);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n return out;\n}\n\nfunction base64urlEncode(bytes: Uint8Array): string {\n const str = bytesToBase64(bytes);\n return str.replace(/=+$/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n}\n\nfunction base64urlEncodeJSON(obj: unknown): string {\n const json = JSON.stringify(obj);\n return base64urlEncode(te.encode(json));\n}\n\nfunction base64urlDecodeToJSON(b64: string): T | null {\n try {\n const normalized = b64.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (b64.length % 4)) % 4);\n const bytes = base64ToBytes(normalized);\n const json = td.decode(bytes);\n return JSON.parse(json) as T;\n } catch {\n return null;\n }\n}\n\nfunction parseTTL(ttl: string): number {\n const m = ttl.match(/^(\\d+)([smh])$/);\n if (!m) return 3600; // default 1h\n const n = Number(m[1]);\n const unit = m[2];\n if (unit === \"s\") return n;\n if (unit === \"m\") return n * 60;\n if (unit === \"h\") return n * 3600;\n return 3600;\n}\n\nasync function importHMACKey(secret: string): Promise {\n return crypto.subtle.importKey(\n \"raw\",\n te.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"]\n );\n}\n\nasync function hmacSign(secret: string, data: string): Promise {\n const key = await importHMACKey(secret);\n const sig = await crypto.subtle.sign(\"HMAC\", key, te.encode(data));\n return base64urlEncode(new Uint8Array(sig));\n}\n\nasync function hmacVerify(secret: string, data: string, signature: string): Promise {\n const key = await importHMACKey(secret);\n const normalized = signature.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (signature.length % 4)) % 4);\n const sigBytes = base64ToBytes(normalized);\n return crypto.subtle.verify(\"HMAC\", key, sigBytes, te.encode(data));\n}\n\n// --- Bot detection ---\nfunction isLikelyBot(req: Request): boolean {\n const ua = (req.headers.get(\"user-agent\") || \"\").toLowerCase();\n if (!ua) return true; // missing UA is suspicious\n const patterns = [\n \"bot\",\n \"spider\",\n \"crawl\",\n \"slurp\",\n \"fetch\",\n \"monitor\",\n \"headlesschrome\",\n \"phantom\",\n \"facebookexternalhit\",\n \"twitterbot\",\n \"slackbot\",\n \"discordbot\",\n \"telegrambot\",\n \"applebot\",\n \"baiduspider\",\n \"bingbot\",\n \"duckduckbot\",\n \"yandexbot\",\n \"ahrefsbot\",\n \"semrush\",\n \"curl\",\n \"wget\",\n \"postman\",\n \"insomnia\",\n \"httpclient\",\n \"okhttp\",\n \"guzzle\",\n \"libwww-perl\",\n \"python-requests\",\n \"aiohttp\",\n \"scrapy\",\n ];\n return patterns.some((p) => ua.includes(p));\n}\n\nfunction withBotHeader(req: Request, headers: HeadersInit = {}): HeadersInit {\n const isBot = isLikelyBot(req);\n return { ...headers, \"x-is-bot\": String(isBot) };\n}\n\n// --- Minimal JWT (HS256) ---\nasync function jwtSignHS256(payload: Record, secret: string): Promise {\n const header = { alg: \"HS256\", typ: \"JWT\" };\n const exp = Math.floor(Date.now() / 1000) + parseTTL(AUTH_TOKEN_TTL);\n const fullPayload = { ...payload, exp };\n const h = base64urlEncodeJSON(header);\n const p = base64urlEncodeJSON(fullPayload);\n const data = `${h}.${p}`;\n const sig = await hmacSign(secret, data);\n return `${data}.${sig}`;\n}\n\nasync function jwtVerifyHS256(token: string, secret: string): Promise | null> {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const [h, p, s] = parts;\n const ok = await hmacVerify(secret, `${h}.${p}`, s);\n if (!ok) return null;\n const payload = base64urlDecodeToJSON>(p);\n if (!payload) return null;\n const exp = Number((payload as any).exp || 0);\n if (!exp || Math.floor(Date.now() / 1000) > exp) return null;\n return payload;\n}\n\nfunction json(status: number, body: unknown, headers: HeadersInit = {}): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...headers },\n });\n}\n\nfunction notFound(): Response {\n return json(404, { error: \"Not found\" });\n}\n\nfunction unauthorized(msg = \"Unauthorized\"): Response {\n return json(401, { error: msg });\n}\n\nfunction parseCookies(req: Request): Record {\n const raw = req.headers.get(\"cookie\") || \"\";\n const out: Record = {};\n raw.split(\";\").forEach((part) => {\n const [k, ...rest] = part.trim().split(\"=\");\n if (!k) return;\n out[k] = decodeURIComponent(rest.join(\"=\"));\n });\n return out;\n}\n\nfunction getTokenFromReq(req: Request): string | null {\n const auth = req.headers.get(\"authorization\") || \"\";\n if (auth.startsWith(\"Bearer \")) return auth.slice(7);\n const cookies = parseCookies(req);\n return cookies[\"auth_token\"] || null;\n}\n\nasync function handleLogin(req: Request): Promise {\n let body: any = {};\n try {\n body = await req.json();\n } catch {}\n const email = String(body?.email || \"\").trim();\n const password = String(body?.password || \"\").trim();\n if (!email || !password) return json(400, { error: \"Invalid request\" });\n\n const allowed = AUTH_ALLOWED_EMAILS.length === 0 || AUTH_ALLOWED_EMAILS.includes(email);\n const passwordOk = password === AUTH_PASSWORD;\n if (!allowed || !passwordOk) return unauthorized(\"Invalid credentials\");\n\n const token = await jwtSignHS256({ email }, AUTH_SHARED_SECRET);\n\n if (COOKIE_DOMAIN) {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=${token}; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=${parseTTL(AUTH_TOKEN_TTL)}`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n }\n return json(200, { token, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nasync function handleMe(req: Request): Promise {\n const token = getTokenFromReq(req);\n if (!token) return unauthorized(\"Missing token\");\n const payload = await jwtVerifyHS256(token, AUTH_SHARED_SECRET);\n if (!payload) return unauthorized(\"Invalid token\");\n return json(200, { user: { email: (payload as any).email }, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nfunction handleLogout(req: Request): Response {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=0`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const { pathname } = url;\n\n if (req.method === \"GET\" && pathname === \"/health\") {\n return json(200, { ok: true, env: NODE_ENV, isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"GET\" && pathname === \"/\") {\n return json(200, { status: \"Auth server ready\", isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"POST\" && pathname === \"/auth/login\") {\n return handleLogin(req);\n }\n if (req.method === \"GET\" && pathname === \"/auth/me\") {\n return handleMe(req);\n }\n if (req.method === \"POST\" && pathname === \"/auth/logout\") {\n return handleLogout(req);\n }\n if (req.method === \"GET\" && pathname === \"/bot\") {\n return json(200, { isBot: isLikelyBot(req), userAgent: req.headers.get(\"user-agent\") || \"\" }, withBotHeader(req));\n }\n return notFound();\n}","label",[62],"pulls","branches","forks","envVars",{"_183":20,"_185":20},"connections",{"_183":20,"_184":20},"count","unfilledCount","emptyCount",{"_31":168,"_13":62,"_60":61,"_41":-5,"_33":34,"_169":93,"_170":162,"_35":187,"_37":86,"_63":76,"_172":173,"_65":24,"_174":-5,"_188":189,"_144":190},["D",1766979698827],"children",[],[62],["D",1766979250303],{"_11":12,"_143":68},{"_11":12,"_139":-5,"_67":68,"_25":66,"_140":141,"_142":24},{"_37":93,"_13":16,"_31":34,"_131":98,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":14,"_138":12},"ctx",{"_49":-5,"_164":228,"_229":230,"_231":232,"_233":24,"_234":24,"_235":24,"_236":162,"_237":-5,"_238":-7,"_239":-7,"_240":20,"_241":24,"_242":24,"_243":-5,"_244":24,"_245":24,"_246":24,"_247":-5},"ENV",{"_199":200,"_201":202,"_203":16,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History