[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_143":144,"_145":146},"routes/_app.x.$handle.$name",{"_16":17,"_20":21,"_81":64,"_82":83,"_62":-7,"_84":-5,"_13":85,"_86":87,"_11":88,"_89":90,"_91":92,"_93":-5,"_94":-5,"_95":-5,"_96":26,"_97":98,"_99":100,"_101":-5,"_102":-5,"_103":104},"routes/_app.x.$handle.$name.search.$(branch)",{"_11":12,"_13":14,"_15":-5,"_16":17},"files",[],"project",{"_18":19,"_20":21,"_22":23,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":-5,"_31":-5,"_32":33,"_34":-5,"_35":26,"_36":-5,"_37":-5,"_38":39,"_40":41,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":47,"_48":47,"_49":50,"_51":50,"_52":50,"_53":47,"_54":47,"_55":56,"_57":58,"_59":60,"_61":26},"query","handle","theguythatmakesstuff","id","3ce7af70-e467-11f0-98f4-42dde27851f2","name","reborn-auth","createdAt",["D",1766979250303],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","imageUrl","userId","019b67f9-870c-75ac-9bb3-2238af5e603d","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019b67f9-870c-75ac-9bb3-24210d3c5641","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_16":17,"_80":76},"org",{"_16":17,"_74":-5,"_75":76,"_32":33,"_77":78,"_79":26},"branch",{"_62":63,"_20":64,"_18":65,"_66":19,"_67":-5,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":21,"_73":17},"isOwned","version",5,"main","3ce7ef76-e467-11f0-98f4-42dde27851f2","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zN1Y2Yk5SZFd1TU41ZU1TbXB4Nnc3Q1VnU2wifQ","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_18":19,"_20":21,"_22":139,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":-5,"_31":-5,"_32":33,"_34":-5,"_35":26,"_36":-5,"_37":-5,"_38":39,"_40":41,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":47,"_48":47,"_49":50,"_51":50,"_52":50,"_53":47,"_54":47,"_55":140,"_57":141,"_59":142,"_61":26},"tree",[134],[134],"counts",{"_123":39,"_124":125,"_126":39,"_127":128,"_129":130},"contents",[105],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_18":106,"_20":107,"_108":109,"_110":-5,"_111":65,"_112":63,"_113":100,"_22":114,"_62":115,"_116":117,"_118":119,"_120":26,"_121":-5,"_82":122},"483f97d8-e468-11f0-96a1-42dde27851f2","main.ts","fileId","3ce96c0c-e467-11f0-98f4-42dde27851f2","parentId","branchId","branchVersion","latest",["D",1766979698827],4,"fileType","http","content","// Learn more: https://docs.val.town/vals/http\n// Single-file HTTP val handler with zero external packages.\n// Implements minimal auth: /health, /, /auth/login, /auth/me, /auth/logout\n\n// --- Config (edit these for val.run) ---\nconst AUTH_SHARED_SECRET = \"replace-with-strong-secret\"; // required\nconst AUTH_ALLOWED_EMAILS = [\"user@example.com\", \"admin@example.com\"]; // [] allows any email\nconst AUTH_PASSWORD = \"replace-with-demo-password\"; // required\nconst AUTH_TOKEN_TTL = \"1h\"; // e.g., \"3600s\", \"60m\", \"1h\"\nconst COOKIE_DOMAIN = \"\"; // set to your domain to enable cookie mode\nconst NODE_ENV = \"production\";\n\n// --- Helpers ---\nconst te = new TextEncoder();\nconst td = new TextDecoder();\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);\n return btoa(binary);\n}\n\nfunction base64ToBytes(base64: string): Uint8Array {\n const binary = atob(base64);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n return out;\n}\n\nfunction base64urlEncode(bytes: Uint8Array): string {\n const str = bytesToBase64(bytes);\n return str.replace(/=+$/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n}\n\nfunction base64urlEncodeJSON(obj: unknown): string {\n const json = JSON.stringify(obj);\n return base64urlEncode(te.encode(json));\n}\n\nfunction base64urlDecodeToJSON(b64: string): T | null {\n try {\n const normalized = b64.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (b64.length % 4)) % 4);\n const bytes = base64ToBytes(normalized);\n const json = td.decode(bytes);\n return JSON.parse(json) as T;\n } catch {\n return null;\n }\n}\n\nfunction parseTTL(ttl: string): number {\n const m = ttl.match(/^(\\d+)([smh])$/);\n if (!m) return 3600; // default 1h\n const n = Number(m[1]);\n const unit = m[2];\n if (unit === \"s\") return n;\n if (unit === \"m\") return n * 60;\n if (unit === \"h\") return n * 3600;\n return 3600;\n}\n\nasync function importHMACKey(secret: string): Promise {\n return crypto.subtle.importKey(\n \"raw\",\n te.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"]\n );\n}\n\nasync function hmacSign(secret: string, data: string): Promise {\n const key = await importHMACKey(secret);\n const sig = await crypto.subtle.sign(\"HMAC\", key, te.encode(data));\n return base64urlEncode(new Uint8Array(sig));\n}\n\nasync function hmacVerify(secret: string, data: string, signature: string): Promise {\n const key = await importHMACKey(secret);\n const normalized = signature.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (4 - (signature.length % 4)) % 4);\n const sigBytes = base64ToBytes(normalized);\n return crypto.subtle.verify(\"HMAC\", key, sigBytes, te.encode(data));\n}\n\n// --- Bot detection ---\nfunction isLikelyBot(req: Request): boolean {\n const ua = (req.headers.get(\"user-agent\") || \"\").toLowerCase();\n if (!ua) return true; // missing UA is suspicious\n const patterns = [\n \"bot\",\n \"spider\",\n \"crawl\",\n \"slurp\",\n \"fetch\",\n \"monitor\",\n \"headlesschrome\",\n \"phantom\",\n \"facebookexternalhit\",\n \"twitterbot\",\n \"slackbot\",\n \"discordbot\",\n \"telegrambot\",\n \"applebot\",\n \"baiduspider\",\n \"bingbot\",\n \"duckduckbot\",\n \"yandexbot\",\n \"ahrefsbot\",\n \"semrush\",\n \"curl\",\n \"wget\",\n \"postman\",\n \"insomnia\",\n \"httpclient\",\n \"okhttp\",\n \"guzzle\",\n \"libwww-perl\",\n \"python-requests\",\n \"aiohttp\",\n \"scrapy\",\n ];\n return patterns.some((p) => ua.includes(p));\n}\n\nfunction withBotHeader(req: Request, headers: HeadersInit = {}): HeadersInit {\n const isBot = isLikelyBot(req);\n return { ...headers, \"x-is-bot\": String(isBot) };\n}\n\n// --- Minimal JWT (HS256) ---\nasync function jwtSignHS256(payload: Record, secret: string): Promise {\n const header = { alg: \"HS256\", typ: \"JWT\" };\n const exp = Math.floor(Date.now() / 1000) + parseTTL(AUTH_TOKEN_TTL);\n const fullPayload = { ...payload, exp };\n const h = base64urlEncodeJSON(header);\n const p = base64urlEncodeJSON(fullPayload);\n const data = `${h}.${p}`;\n const sig = await hmacSign(secret, data);\n return `${data}.${sig}`;\n}\n\nasync function jwtVerifyHS256(token: string, secret: string): Promise | null> {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const [h, p, s] = parts;\n const ok = await hmacVerify(secret, `${h}.${p}`, s);\n if (!ok) return null;\n const payload = base64urlDecodeToJSON>(p);\n if (!payload) return null;\n const exp = Number((payload as any).exp || 0);\n if (!exp || Math.floor(Date.now() / 1000) > exp) return null;\n return payload;\n}\n\nfunction json(status: number, body: unknown, headers: HeadersInit = {}): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...headers },\n });\n}\n\nfunction notFound(): Response {\n return json(404, { error: \"Not found\" });\n}\n\nfunction unauthorized(msg = \"Unauthorized\"): Response {\n return json(401, { error: msg });\n}\n\nfunction parseCookies(req: Request): Record {\n const raw = req.headers.get(\"cookie\") || \"\";\n const out: Record = {};\n raw.split(\";\").forEach((part) => {\n const [k, ...rest] = part.trim().split(\"=\");\n if (!k) return;\n out[k] = decodeURIComponent(rest.join(\"=\"));\n });\n return out;\n}\n\nfunction getTokenFromReq(req: Request): string | null {\n const auth = req.headers.get(\"authorization\") || \"\";\n if (auth.startsWith(\"Bearer \")) return auth.slice(7);\n const cookies = parseCookies(req);\n return cookies[\"auth_token\"] || null;\n}\n\nasync function handleLogin(req: Request): Promise {\n let body: any = {};\n try {\n body = await req.json();\n } catch {}\n const email = String(body?.email || \"\").trim();\n const password = String(body?.password || \"\").trim();\n if (!email || !password) return json(400, { error: \"Invalid request\" });\n\n const allowed = AUTH_ALLOWED_EMAILS.length === 0 || AUTH_ALLOWED_EMAILS.includes(email);\n const passwordOk = password === AUTH_PASSWORD;\n if (!allowed || !passwordOk) return unauthorized(\"Invalid credentials\");\n\n const token = await jwtSignHS256({ email }, AUTH_SHARED_SECRET);\n\n if (COOKIE_DOMAIN) {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=${token}; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=${parseTTL(AUTH_TOKEN_TTL)}`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n }\n return json(200, { token, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nasync function handleMe(req: Request): Promise {\n const token = getTokenFromReq(req);\n if (!token) return unauthorized(\"Missing token\");\n const payload = await jwtVerifyHS256(token, AUTH_SHARED_SECRET);\n if (!payload) return unauthorized(\"Invalid token\");\n return json(200, { user: { email: (payload as any).email }, isBot: isLikelyBot(req) }, withBotHeader(req));\n}\n\nfunction handleLogout(req: Request): Response {\n const headers: HeadersInit = {\n \"set-cookie\": `auth_token=; HttpOnly; SameSite=Lax; ${NODE_ENV === \"production\" ? \"Secure; \" : \"\"}${COOKIE_DOMAIN ? `Domain=${COOKIE_DOMAIN}; ` : \"\"}Path=/; Max-Age=0`,\n };\n return json(200, { ok: true, isBot: isLikelyBot(req) }, withBotHeader(req, headers));\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const { pathname } = url;\n\n if (req.method === \"GET\" && pathname === \"/health\") {\n return json(200, { ok: true, env: NODE_ENV, isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"GET\" && pathname === \"/\") {\n return json(200, { status: \"Auth server ready\", isBot: isLikelyBot(req) }, withBotHeader(req));\n }\n if (req.method === \"POST\" && pathname === \"/auth/login\") {\n return handleLogin(req);\n }\n if (req.method === \"GET\" && pathname === \"/auth/me\") {\n return handleMe(req);\n }\n if (req.method === \"POST\" && pathname === \"/auth/logout\") {\n return handleLogout(req);\n }\n if (req.method === \"GET\" && pathname === \"/bot\") {\n return json(200, { isBot: isLikelyBot(req), userAgent: req.headers.get(\"user-agent\") || \"\" }, withBotHeader(req));\n }\n return notFound();\n}","deleted","label",[107],"pulls","branches",1,"forks","envVars",{"_131":39,"_133":39},"connections",{"_131":39,"_132":39},"count","unfilledCount","emptyCount",{"_18":106,"_20":107,"_108":109,"_110":-5,"_111":65,"_112":63,"_113":100,"_22":135,"_62":115,"_116":117,"_118":119,"_120":26,"_121":-5,"_136":137,"_82":138},["D",1766979698827],"children",[],[107],["D",1766979250303],{"_16":17,"_80":76},{"_16":17,"_74":-5,"_75":76,"_32":33,"_77":78,"_79":26},{"_62":63,"_20":64,"_18":65,"_66":19,"_67":-5,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":21,"_73":17},"ctx",{"_55":-5,"_102":176,"_177":178,"_179":180,"_181":26,"_182":26,"_183":26,"_184":100,"_185":-5,"_186":-7,"_187":-7,"_188":39,"_189":26,"_190":26,"_191":-5,"_192":26,"_193":26,"_194":26,"_195":-5},"ENV",{"_147":148,"_149":150,"_151":64,"_152":153,"_154":155,"_156":157,"_158":159,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Search