[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_148":149,"_150":151},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_86":-7,"_87":88,"_29":-7,"_89":-5,"_15":90,"_91":92,"_93":94,"_95":96,"_97":98,"_99":-5,"_100":-5,"_101":-5,"_102":38,"_103":104,"_105":106,"_107":-5,"_108":-5,"_109":110},"routes/_app.x.$handle.$name.branches",{"_11":12,"_13":14,"_15":16,"_17":18},"handle","theguythatmakesstuff","name","reborn-auth","project",{"_20":28,"_13":14,"_22":36,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":-5,"_43":-5,"_44":45,"_46":-5,"_47":38,"_48":-5,"_49":-5,"_50":51,"_52":53,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":59,"_60":59,"_61":62,"_63":62,"_64":62,"_65":59,"_66":59,"_67":68,"_69":70,"_71":72,"_73":38},"branches",[19],{"_20":21,"_22":23,"_24":25,"_13":26,"_27":28,"_29":30,"_31":-5,"_32":-5,"_33":34,"_35":-5},"id","3ce7ef76-e467-11f0-98f4-42dde27851f2","createdAt",["D",1766979250303],"updatedAt",["D",1766979698827],"main","projectId","3ce7af70-e467-11f0-98f4-42dde27851f2","version",5,"forkedBranchId","forkedBranchVersion","lockfileKey","1766979699816-esm.town_v_theguythatmakesstuff_reborn-auth@5-main","deletedAt",["D",1766979250303],"legacyEnvVars",false,"privacy","public","httpPrivacy","description","imageUrl","userId","019b67f9-870c-75ac-9bb3-2238af5e603d","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019b67f9-870c-75ac-9bb3-24210d3c5641","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_85":81},"org",{"_11":12,"_79":-5,"_80":81,"_44":45,"_82":83,"_84":38},"branch",{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_74":-5,"_75":-5,"_76":-5,"_77":14,"_78":12},"isOwned","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zN1Y2Yk5SZFd1TU41ZU1TbXB4Nnc3Q1VnU2wifQ","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_20":28,"_13":14,"_22":144,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":-5,"_43":-5,"_44":45,"_46":-5,"_47":38,"_48":-5,"_49":-5,"_50":51,"_52":53,"_54":-5,"_55":-5,"_56":-5,"_57":-5,"_58":59,"_60":59,"_61":62,"_63":62,"_64":62,"_65":59,"_66":59,"_67":145,"_69":146,"_71":147,"_73":38},"tree",[139],"files",[139],"counts",{"_129":51,"_17":130,"_131":51,"_132":133,"_134":135},"contents",[111],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_20":112,"_13":113,"_114":115,"_116":-5,"_117":21,"_118":30,"_119":106,"_22":120,"_29":121,"_122":123,"_124":125,"_126":38,"_127":-5,"_87":128},"483f97d8-e468-11f0-96a1-42dde27851f2","main.ts","fileId","3ce96c0c-e467-11f0-98f4-42dde27851f2","parentId","branchId","branchVersion","latest",["D",1766979698827],4,"fileType","http","content","// Learn more: https://docs.val.town/vals/http\n// Single-file HTTP val handler with zero external packages.\n// Implements minimal auth: /health, /, /auth/login, /auth/me, /auth/logout\n\n// --- Config (edit these for val.run) ---\nconst AUTH_SHARED_SECRET = \"replace-with-strong-secret\"; // required\nconst AUTH_ALLOWED_EMAILS = [\"user@example.com\", \"admin@example.com\"]; // [] allows any email\nconst AUTH_PASSWORD = \"replace-with-demo-password\"; // required\nconst AUTH_TOKEN_TTL = \"1h\"; // e.g., \"3600s\", \"60m\", \"1h\"\nconst COOKIE_DOMAIN = \"\"; // set to your domain to enable cookie mode\nconst NODE_ENV = \"production\";\n\n// --- Helpers ---\nconst te = new TextEncoder();\nconst td = new TextDecoder();\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);\n return btoa(binary);\n}\n\nfunction base64ToBytes(base64: string): Uint8Array {\n const binary = atob(base64);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n return out;\n}\n\nfunction base64urlEncode(bytes: Uint8Array): string {\n const str = bytesToBase64(bytes);\n return str.replace(/=+$/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n}\n\nfunction base64urlEncodeJSON(obj: unknown): string {\n const json = JSON.stringify(obj);\n return base64urlEncode(te.encode(json));\n}\n\nfunction base64urlDecodeToJSON(b64: string): T | null {\n try {\n const normalized = b64.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (b64.length % 4)) % 4);\n const bytes = base64ToBytes(normalized);\n const json = td.decode(bytes);\n return JSON.parse(json) as T;\n } catch {\n return null;\n }\n}\n\nfunction parseTTL(ttl: string): number {\n const m = ttl.match(/^(\\d+)([smh])$/);\n if (!m) return 3600; // default 1h\n const n = Number(m[1]);\n const unit = m[2];\n if (unit === \"s\") return n;\n if (unit === \"m\") return n * 60;\n if (unit === \"h\") return n * 3600;\n return 3600;\n}\n\nasync function importHMACKey(secret: string): Promise {\n return crypto.subtle.importKey(\n \"raw\",\n te.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"]\n );\n}\n\nasync function hmacSign(secret: string, data: string): Promise {\n const key = await importHMACKey(secret);\n const sig = await crypto.subtle.sign(\"HMAC\", key, te.encode(data));\n return base64urlEncode(new Uint8Array(sig));\n}\n\nasync function hmacVerify(secret: string, data: string, signature: string): Promise {\n const key = await importHMACKey(secret);\n const normalized = signature.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (signature.length % 4)) % 4);\n const sigBytes = base64ToBytes(normalized);\n return crypto.subtle.verify(\"HMAC\", key, sigBytes, te.encode(data));\n}\n\n// --- Bot detection ---\nfunction isLikelyBot(req: Request): boolean {\n const ua = (req.headers.get(\"user-agent\") || \"\").toLowerCase();\n if (!ua) return true; // missing UA is suspicious\n const patterns = [\n \"bot\",\n \"spider\",\n \"crawl\",\n \"slurp\",\n \"fetch\",\n \"monitor\",\n \"headlesschrome\",\n \"phantom\",\n \"facebookexternalhit\",\n \"twitterbot\",\n \"slackbot\",\n \"discordbot\",\n \"telegrambot\",\n \"applebot\",\n \"baiduspider\",\n \"bingbot\",\n \"duckduckbot\",\n \"yandexbot\",\n \"ahrefsbot\",\n \"semrush\",\n \"curl\",\n \"wget\",\n \"postman\",\n \"insomnia\",\n \"httpclient\",\n \"okhttp\",\n \"guzzle\",\n \"libwww-perl\",\n \"python-requests\",\n \"aiohttp\",\n \"scrapy\",\n ];\n return patterns.some((p) => ua.includes(p));\n}\n\nfunction withBotHeader(req: Request, headers: HeadersInit = {}): HeadersInit {\n const isBot = isLikelyBot(req);\n return { ...headers, \"x-is-bot\": String(isBot) };\n}\n\n// --- Minimal JWT (HS256) ---\nasync function jwtSignHS256(payload: Record, secret: string): Promise {\n const header = { alg: \"HS256\", typ: \"JWT\" };\n const exp = Math.floor(Date.now() / 1000) + parseTTL(AUTH_TOKEN_TTL);\n const fullPayload = { ...payload, exp };\n const h = base64urlEncodeJSON(header);\n const p = base64urlEncodeJSON(fullPayload);\n const data = `${h}.${p}`;\n const sig = await hmacSign(secret, data);\n return `${data}.${sig}`;\n}\n\nasync function jwtVerifyHS256(token: string, secret: string): Promise | null> {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const [h, p, s] = parts;\n const ok = await hmacVerify(secret, `${h}.${p}`, s);\n if (!ok) return null;\n const payload = base64urlDecodeToJSON>(p);\n if (!payload) return null;\n const exp = Number((payload as any).exp || 0);\n if (!exp || Math.floor(Date.now() / 1000) > exp) return null;\n return payload;\n}\n\nfunction json(status: number, body: unknown, headers: HeadersInit = {}): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...headers },\n });\n}\n\nfunction notFound(): Response {\n return json(404, { error: \"Not found\" });\n}\n\nfunction unauthorized(msg = \"Unauthorized\"): Response {\n return json(401, { error: msg });\n}\n\nfunction parseCookies(req: Request): Record {\n const raw = req.headers.get(\"cookie\") || \"\";\n const out: Record = {};\n raw.split(\";\").forEach((part) => {\n const [k, ...rest] = part.trim().split(\"=\");\n if (!k) return;\n out[k] = decodeURIComponent(rest.join(\"=\"));\n });\n return out;\n}\n\nfunction getTokenFromReq(req: Request): string | null {\n const auth = req.headers.get(\"authorization\") || \"\";\n if (auth.startsWith(\"Bearer \")) return auth.slice(7);\n const cookies = parseCookies(req);\n return cookies[\"auth_token\"] || null;\n}\n\nasync function handleLogin(req: Request): Promise {\n let body: any = {};\n try {\n body = await req.json();\n } catch {}\n const email = String(body?.email || \"\").trim();\n const password = String(body?.password || \"\").trim();\n if (!email || !password) return json(400, { error: \"Invalid request\" });\n\n const allowed = AUTH_ALLOWED_EMAILS.length === 0 || AUTH_ALLOWED_EMAILS.includes(email);\n const passwordOk = password === AUTH_PASSWORD;\n if (!allowed || !passwordOk) return unauthorized(\"Invalid credentials\");\n\n const token = await jwtSignHS256({ email }, AUTH_SHARED_SECRET);\n\n if (COOKIE_DOMAIN) {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=${token}; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=${parseTTL(AUTH_TOKEN_TTL)}`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n }\n return json(200, { token, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nasync function handleMe(req: Request): Promise {\n const token = getTokenFromReq(req);\n if (!token) return unauthorized(\"Missing token\");\n const payload = await jwtVerifyHS256(token, AUTH_SHARED_SECRET);\n if (!payload) return unauthorized(\"Invalid token\");\n return json(200, { user: { email: (payload as any).email }, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nfunction handleLogout(req: Request): Response {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=0`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const { pathname } = url;\n\n if (req.method === \"GET\" && pathname === \"/health\") {\n return json(200, { ok: true, env: NODE_ENV, isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"GET\" && pathname === \"/\") {\n return json(200, { status: \"Auth server ready\", isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"POST\" && pathname === \"/auth/login\") {\n return handleLogin(req);\n }\n if (req.method === \"GET\" && pathname === \"/auth/me\") {\n return handleMe(req);\n }\n if (req.method === \"POST\" && pathname === \"/auth/logout\") {\n return handleLogout(req);\n }\n if (req.method === \"GET\" && pathname === \"/bot\") {\n return json(200, { isBot: isLikelyBot(req), userAgent: req.headers.get(\"user-agent\") || \"\" }, withBotHeader(req));\n }\n return notFound();\n}","deleted","label",[113],"pulls",1,"forks","envVars",{"_136":51,"_138":51},"connections",{"_136":51,"_137":51},"count","unfilledCount","emptyCount",{"_20":112,"_13":113,"_114":115,"_116":-5,"_117":21,"_118":30,"_119":106,"_22":140,"_29":121,"_122":123,"_124":125,"_126":38,"_127":-5,"_141":142,"_87":143},["D",1766979698827],"children",[],[113],["D",1766979250303],{"_11":12,"_85":81},{"_11":12,"_79":-5,"_80":81,"_44":45,"_82":83,"_84":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_74":-5,"_75":-5,"_76":-5,"_77":14,"_78":12},"ctx",{"_67":-5,"_108":181,"_182":183,"_184":185,"_186":38,"_187":38,"_188":38,"_189":106,"_190":-5,"_191":-7,"_192":-7,"_193":51,"_194":38,"_195":38,"_196":-5,"_197":38,"_198":38,"_199":38,"_200":-5},"ENV",{"_152":153,"_154":155,"_156":26,"_157":158,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1