[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_339":340,"_341":342},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_247":-5,"_20":248,"_22":249,"_250":251,"_252":253,"_26":254,"_24":255,"_256":257,"_258":259,"_260":53,"_261":262,"_263":75,"_264":-5,"_265":-5,"_266":267},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":29,"_30":-5,"_31":32,"_33":34,"_35":-5},"handle","tsuchi_ya","name","luciaMagicLinkStarter","branchName","main","version","path","frontend","project",{"_36":203,"_13":14,"_38":204,"_51":-5,"_205":53,"_54":55,"_206":55,"_207":-5,"_208":-5,"_209":210,"_211":160,"_212":75,"_213":75,"_214":-5,"_215":32,"_58":216,"_217":-5,"_218":-5,"_219":-5,"_220":-5,"_221":222,"_223":222,"_224":225,"_226":225,"_227":225,"_228":222,"_229":222,"_230":231,"_232":233,"_234":235,"_52":53},"tree",[99,100,101],"file",{"_36":96,"_13":19,"_66":69,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":97,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_18":98},"contents",[61,62,63],"upstream",{"_36":37,"_38":39,"_40":41,"_13":16,"_42":43,"_17":44,"_45":46,"_47":48,"_49":50,"_51":-5,"_52":53,"_54":55,"_56":57,"_58":59,"_60":14},"pull","ahead",0,"behind",5,"envVars","id","d58458a4-2b7c-11f0-b025-569c3dd06744","createdAt",["D",1746647560619],"updatedAt",["D",1770901632622],"projectId","d5804cd2-2b7c-11f0-b025-569c3dd06744",174,"forkedBranchId","961078ea-f528-11ef-aa68-569c3dd06744","forkedBranchVersion",39,"lockfileKey","1781070447004-esm.town_v_stevekrouse_luciaMagicLinkStarter@174-main","deletedAt","isOwned",false,"privacy","public","userHandle","stevekrouse","orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","projectName",{"_36":90,"_13":91,"_66":92,"_68":69,"_70":71,"_72":73,"_74":75,"_38":93,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_18":95},{"_36":84,"_13":85,"_66":86,"_68":69,"_70":71,"_72":73,"_74":75,"_38":87,"_17":32,"_77":24,"_79":88,"_81":53,"_82":-5,"_18":89},{"_36":64,"_13":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_38":76,"_17":32,"_77":78,"_79":80,"_81":53,"_82":-5,"_18":83},"31e8bd7c-3949-11f0-817e-9e149126039e","index.tsx","fileId","6b75f346-7753-489d-9c23-ca816da6e87a","parentId","110c2d10-9afe-4d5d-af09-3fa67bb3561c","branchId","31e5b58c-3949-11f0-817e-9e149126039e","branchVersion",1,"latest",true,["D",1748164698080],"fileType","script","content","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client\";\nimport { App } from \"./components/App.tsx\";\n\nconst initialDataString = document.getElementById(\"initial-data\")!.textContent as string;\nlet initialData = JSON.parse(initialDataString);\n\nconst urlParams = new URLSearchParams(window.location.search);\nconst errorParam = urlParams.get(\"error\");\nif (errorParam === \"invalid_token\" && !initialData.user) {\n initialData.error = \"Invalid or expired magic link. Please request a new one.\";\n} else {\n initialData.error = errorParam;\n}\n\ncreateRoot(document.getElementById(\"root\")!).render();","deleted","label",[19,65],"31e8bbec-3949-11f0-817e-9e149126039e","index.html","f7884d8a-092b-43b0-9a20-78cf7026b3fe",["D",1748164698080],"\n\n \n \n \n Lucia Auth Demo\n \n \n \n

\n \n \n \n",[19,85],"31e8ba3e-3949-11f0-817e-9e149126039e","components","8d59cbd3-8da9-4064-ada9-886e58eb2ebd",["D",1748164698080],"directory",[19,91],"31e8bf16-3949-11f0-817e-9e149126039e",["D",1748164698080],[19],{"_36":149,"_13":150,"_66":151,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":152,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":153,"_18":154},{"_36":96,"_13":19,"_66":69,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":110,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":111,"_18":112},{"_36":102,"_13":103,"_66":104,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":105,"_17":32,"_77":24,"_79":106,"_81":53,"_82":-5,"_107":108,"_18":109},"31e8c0ce-3949-11f0-817e-9e149126039e","README.md","c284661c-907f-485d-a752-d3a32a242c83",["D",1748164698080],"# Lucia Auth Starter\n\nA demonstration of [Lucia, the guide](https://lucia-next.pages.dev/), and magic link authentication using Val Town.\n\nThis uses [Val Town SQLite](https://docs.val.town/std/sqlite/) and [Val Town Email](https://docs.val.town/std/email/), so you can Remix & roll-your-own-auth in a single-click. Literally zero set up required.\n\nNote: Sending emails to users besides yourself requires [Val Town Pro](https://www.val.town/pricing).\n\n## Features\n\n- Magic link authentication\n- Server-side rendering with client-side hydration\n- User profile management (username editing)\n- Session management with secure cookies\n- Responsive UI with Tailwind CSS\n\n## Authentication Flow\n\n1. User enters their email address on the login page\n2. A magic link is sent to the user's email\n3. User clicks the magic link in their email\n4. The server validates the token, creates a session, and sets a secure cookie\n5. User is redirected to the authenticated home page\n\n## Technical Implementation\n\n- **Database**:[Val Town SQLite](https://docs.val.town/std/sqlite/) for storing users, sessions, and magic link tokens\n- **Frontend**: React with Tailwind CSS\n- **Backend**: Hono.js for API routes and middleware\n- **Authentication**: Built by following the [Lucia guide](https://lucia-next.pages.dev/)\n\n## API Endpoints\n\nProvided by the Auth Middleware in `backend/auth.ts`:\n\n- `POST /auth/magic-link` - Request a magic link\n- `GET /auth/magic-link/:token` - Validate a magic link token\n- `POST /auth/logout` - Log out the current user\n\nIn the app's API, in `backend/index.ts`:\n\n- `POST /api/user/username` - Update the user's username\n\n## Notes\n\n- Email sending requires Val Town Pro subscription for sending to addresses other than your own\n- Magic links expire after 15 minutes\n- Session tokens are automatically rotated when 50% of their lifetime remains (15 days)\n- Sessions expire after 30 days\n\n## Todos\n\n- When I tried to make the magic link token single-use, it caused issues. I think the best practice there is something a bit more complicated, ie a GET request to an HTML page that makes a POST request.\n- When I tried to make the SameSite=Strict, the cookie stopped working. It's currently Lax, which I think is OK, but it'd be nice to know Strict isn't working.","children",[],[103],["D",1748164698080],[113,114,115],[19],{"_36":90,"_13":91,"_66":92,"_68":69,"_70":71,"_72":73,"_74":75,"_38":122,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":123,"_18":124},{"_36":84,"_13":85,"_66":86,"_68":69,"_70":71,"_72":73,"_74":75,"_38":119,"_17":32,"_77":24,"_79":88,"_81":53,"_82":-5,"_107":120,"_18":121},{"_36":64,"_13":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_38":116,"_17":32,"_77":78,"_79":80,"_81":53,"_82":-5,"_107":117,"_18":118},["D",1748164698080],[],[19,65],["D",1748164698080],[],[19,85],["D",1748164698080],[125,126,127],[19,91],{"_36":142,"_13":143,"_66":144,"_68":92,"_70":71,"_72":73,"_74":75,"_38":145,"_17":32,"_77":78,"_79":146,"_81":53,"_82":-5,"_107":147,"_18":148},{"_36":135,"_13":136,"_66":137,"_68":92,"_70":71,"_72":73,"_74":75,"_38":138,"_17":32,"_77":78,"_79":139,"_81":53,"_82":-5,"_107":140,"_18":141},{"_36":128,"_13":129,"_66":130,"_68":92,"_70":71,"_72":73,"_74":75,"_38":131,"_17":32,"_77":78,"_79":132,"_81":53,"_82":-5,"_107":133,"_18":134},"31e8b46c-3949-11f0-817e-9e149126039e","UserProfile.tsx","136566b7-03ef-400d-88dc-e776d9bbb1dc",["D",1748164698080],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState } from \"https://esm.sh/react@18.2.0\";\n\ninterface User {\n id: number;\n email?: string;\n username?: string;\n}\n\ninterface UserProfileProps {\n user: User;\n onUpdate: (user: User) => void;\n}\n\nexport function UserProfile({ user, onUpdate }: UserProfileProps) {\n const [username, setUsername] = useState(user.username || \"\");\n const [isEditing, setIsEditing] = useState(false);\n const [isSubmitting, setIsSubmitting] = useState(false);\n const [error, setError] = useState(null);\n\n const handleSubmit = async (e: React.FormEvent) => {\n e.preventDefault();\n\n if (!username.trim()) {\n setError(\"Username cannot be empty\");\n return;\n }\n\n // Client-side validation to match server-side rules\n if (username.length < 3 || username.length > 50) {\n setError(\"Username must be between 3 and 50 characters\");\n return;\n }\n\n // Ensure username is only letters and numbers\n if (!/^[a-zA-Z0-9]+$/.test(username)) {\n setError(\"Username can only contain letters and numbers\");\n return;\n }\n\n setIsSubmitting(true);\n setError(null);\n\n try {\n const response = await fetch(\"/api/user/username\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ username }),\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n throw new Error(data.error || \"Failed to update username\");\n }\n\n onUpdate({ ...user, username });\n setIsEditing(false);\n } catch (err) {\n console.error(\"Error updating username:\", err);\n setError(err instanceof Error ? err.message : \"Failed to update username\");\n } finally {\n setIsSubmitting(false);\n }\n };\n\n return (\n

Welcome!

\n Email: {user.email}\n

\n\n {error && (\n

\n {error}\n setError(null)}\n >\n ×\n \n

\n )}\n\n {isEditing\n ? (\n \n )\n : (\n

\n Username: {user.username\n ? {user.username}\n : Not set}\n

\n setIsEditing(true)}\n >\n {user.username ? \"Edit Username\" : \"Set Username\"}\n \n

\n )}\n\n

\n \n Logout\n \n

\n );\n}",[],[19,91,129],"31e8ae7c-3949-11f0-817e-9e149126039e","LoginForm.tsx","e09b859b-4056-4ecc-8bff-e33c4e12b448",["D",1748164698080],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState } from \"https://esm.sh/react@18.2.0\";\n\ninterface LoginFormProps {\n onError: (error: string) => void;\n}\n\nexport function LoginForm({ onError }: LoginFormProps) {\n const [email, setEmail] = useState(\"\");\n const [isSubmitting, setIsSubmitting] = useState(false);\n const [emailSent, setEmailSent] = useState(false);\n\n const handleSubmit = async (e: React.FormEvent) => {\n e.preventDefault();\n\n if (!email || !email.includes(\"@\")) {\n onError(\"Please enter a valid email address\");\n return;\n }\n\n setIsSubmitting(true);\n\n try {\n const response = await fetch(\"/auth/magic-link\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ email }),\n });\n\n const data = await response.json();\n\n if (!response.ok) {\n if (data.error) {\n onError(data.error);\n return;\n }\n throw new Error(data.error || \"Failed to send magic link\");\n }\n setEmailSent(true);\n } catch (err) {\n console.error(\"Error sending magic link:\", err);\n onError(err instanceof Error ? err.message : \"Failed to send magic link\");\n } finally {\n setIsSubmitting(false);\n }\n };\n\n if (emailSent) {\n return (\n

Check your email!

\n We've sent a magic link to {email}. Click the link in the email to log in.\n

\n );\n }\n\n return (\n

\n \n

\n );\n}",[],[19,91,136],"31e8ad1e-3949-11f0-817e-9e149126039e","App.tsx","fb00d902-a82f-4d53-bcc9-9bcd808362b9",["D",1748164698080],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useState } from \"https://esm.sh/react@18.2.0\";\nimport { LoginForm } from \"./LoginForm.tsx\";\nimport { UserProfile } from \"./UserProfile.tsx\";\n\ninterface User {\n id: number;\n email?: string;\n username?: string;\n}\n\ninterface InitialData {\n user: User | null;\n projectURL: string;\n error: string | null;\n}\n\nexport function App({ initialData }: { initialData: InitialData }) {\n const [user, setUser] = useState(initialData.user);\n const [error, setError] = useState(initialData.error);\n\n // Update user data after username change\n const updateUser = (updatedUser: User) => {\n setUser(updatedUser);\n };\n\n return (\n

Lucia Demo

\n\n {error && (\n

\n {error}\n setError(null)}\n >\n ×\n \n

\n )}\n\n

\n \n View Source Code\n \n

\n\n {user ? : }\n

\n );\n}",[],[19,91,143],"31e8abb6-3949-11f0-817e-9e149126039e","backend","328be5d6-0800-45ae-90f4-021c58e5fc18",["D",1748164698080],[155,156,157],[150],{"_36":173,"_13":174,"_66":175,"_68":151,"_70":71,"_72":73,"_74":75,"_38":176,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":177,"_18":178},{"_36":166,"_13":167,"_66":168,"_68":151,"_70":71,"_72":73,"_74":75,"_38":169,"_17":32,"_77":78,"_79":170,"_81":53,"_82":-5,"_107":171,"_18":172},{"_36":158,"_13":159,"_66":160,"_68":151,"_70":71,"_72":73,"_74":75,"_38":161,"_17":32,"_77":162,"_79":163,"_81":53,"_82":-5,"_107":164,"_18":165},"31e8a8dc-3949-11f0-817e-9e149126039e","index.ts","2d1eb53b-7996-48f4-bd36-2c46ff926b94",["D",1748164698080],"http","import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\nimport { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nimport { Hono } from \"npm:hono\";\nimport { authMiddleware } from \"./auth.ts\";\nimport { USER_TABLE } from \"./database/schema.ts\";\n\nconst app = new Hono();\n\n// Serve all /frontend files\napp.get(\"/frontend/**/*\", c => serveFile(c.req.path, import.meta.url));\n\napp.use(authMiddleware);\n\n// Serve index.html at the root / with bootstrapped data\napp.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n\n const user = c.get(\"user\");\n const dataScript = ``;\n\n // Insert the script right before the closing tag\n html = html.replace(\"\", `${dataScript}`);\n\n return c.html(html);\n});\n\n// API endpoint to update username\napp.post(\"/api/user/username\", async c => {\n const user = c.get(\"user\");\n\n if (!user) {\n return c.json({ success: false, error: \"Not authenticated\" }, 401);\n }\n\n try {\n const { username } = await c.req.json();\n\n if (!username || typeof username !== \"string\") {\n return c.json({ success: false, error: \"Invalid username\" }, 400);\n }\n\n // Validate username length (3-50 characters)\n if (username.length < 3 || username.length > 50) {\n return c.json({\n success: false,\n error: \"Username must be between 3 and 50 characters\",\n }, 400);\n }\n\n // Validate username contains only alphanumeric characters\n if (!/^[a-zA-Z0-9]+$/.test(username)) {\n return c.json({\n success: false,\n error: \"Username contains invalid characters\",\n }, 400);\n }\n\n // Update the username\n await sqlite.execute(\n `UPDATE ${USER_TABLE} SET username = ? WHERE id = ?`,\n [username, user.id],\n );\n\n return c.json({ success: true, username });\n } catch (error) {\n console.error(\"Error updating username:\", error);\n return c.json({ success: false, error: \"An unexpected error occurred\" }, 500);\n }\n});\n\n// Unwrap and rethrow Hono errors as the original error\n// If you delete this, all errors will be \"Internal Server Error\"\napp.onError((err, c) => {\n throw err;\n});\n\n// HTTP vals expect an exported \"fetch handler\"\n// This is how you \"run the server\" in Val Town with Hono\nexport default app.fetch;",[],[150,159],"31e8a526-3949-11f0-817e-9e149126039e","auth.ts","f67d09f2-df46-46e7-8cf9-f4096adbb134",["D",1748164698080],"import { getCookie, setCookie } from \"npm:hono/cookie\";\nimport { createMiddleware } from \"npm:hono/factory\";\nimport { createMagicLinkToken, sendMagicLinkEmail, validateMagicLinkToken } from \"./database/magic-links.ts\";\nimport { createSession, generateSessionToken, invalidateSession, validateSessionToken } from \"./database/sessions.ts\";\n\nexport const authMiddleware = createMiddleware(async (c, next) => {\n const url = new URL(c.req.url);\n const path = url.pathname;\n const origin = c.req.header(\"Origin\");\n\n // CSRF Protection, more info: https://lucia-next.pages.dev/sessions/cookies/\n if (c.req.method !== \"GET\") {\n const host = new URL(c.req.url).hostname;\n if (origin === null || origin !== url.origin) {\n return c.text(\"CSRF Protection\", 401);\n }\n }\n\n // Handle magic link request\n if (path === \"/auth/magic-link\" && c.req.method === \"POST\") {\n try {\n const { email } = await c.req.json();\n\n if (!email || typeof email !== \"string\" || !email.includes(\"@\")) {\n return c.json({ success: false, error: \"Invalid email address\" }, 400);\n }\n\n // Create a magic link token\n const token = await createMagicLinkToken(email);\n\n // Send the magic link email\n const emailSent = await sendMagicLinkEmail(url.origin, email, token);\n\n if (!emailSent) {\n return c.json({\n success: false,\n error:\n \"Failed to send email. Val Town requires Pro subscription to send emails to addresses other than your own. See https://www.val.town/pricing\",\n }, 500);\n }\n\n return c.json({ success: true });\n } catch (error) {\n console.error(\"Error creating magic link:\", error);\n return c.json({ success: false, error: \"An unexpected error occurred\" }, 500);\n }\n }\n\n // Handle magic link validation\n if (path.startsWith(\"/auth/magic-link/\") && c.req.method === \"GET\") {\n const token = path.split(\"/\").pop();\n if (token) {\n const result = await validateMagicLinkToken(token);\n if (result.valid && result.userId) {\n // Create a new session\n const sessionToken = generateSessionToken();\n await createSession(sessionToken, result.userId);\n\n // Set the session cookie\n setCookie(c, \"session\", sessionToken, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: 60 * 60 * 24 * 30, // 30 days\n });\n\n // Redirect to the home page\n return c.redirect(\"/\");\n } else {\n // Invalid or expired token\n return c.redirect(\"/?error=invalid_token\");\n }\n }\n }\n\n // Regular session validation\n const token = getCookie(c, \"session\");\n if (token) {\n const { session, user, newToken } = await validateSessionToken(token);\n // If a new token was generated (session rotation), update the cookie\n if (newToken) {\n setCookie(c, \"session\", newToken, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: 60 * 60 * 24 * 30, // 30 days\n });\n }\n\n // Handle logout\n if (session && path === \"/auth/logout\") {\n await invalidateSession(session.id);\n\n setCookie(c, \"session\", \"\", {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: 0,\n });\n\n return c.redirect(\"/\");\n }\n\n if (user) {\n c.set(\"user\", user);\n } else {\n // delete the session cookie\n setCookie(c, \"session\", \"\", {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: 0,\n });\n }\n }\n\n // If you end up on the logout page when you weren't logged in, redirect to the home page\n if (path === \"/auth/logout\") {\n return c.redirect(\"/\");\n }\n\n await next();\n});",[],[150,167],"31e8a35a-3949-11f0-817e-9e149126039e","database","6a53a440-00d9-46ff-86b5-f0a277d16acb",["D",1748164698080],[179,180,181],[150,174],{"_36":196,"_13":197,"_66":198,"_68":175,"_70":71,"_72":73,"_74":75,"_38":199,"_17":32,"_77":78,"_79":200,"_81":53,"_82":-5,"_107":201,"_18":202},{"_36":189,"_13":190,"_66":191,"_68":175,"_70":71,"_72":73,"_74":75,"_38":192,"_17":32,"_77":78,"_79":193,"_81":53,"_82":-5,"_107":194,"_18":195},{"_36":182,"_13":183,"_66":184,"_68":175,"_70":71,"_72":73,"_74":75,"_38":185,"_17":32,"_77":78,"_79":186,"_81":53,"_82":-5,"_107":187,"_18":188},"31e8a030-3949-11f0-817e-9e149126039e","sessions.ts","11859c6a-bb9d-402f-8180-bea854d96f61",["D",1748164698080],"import { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nimport { sha256 } from \"npm:@oslojs/crypto/sha2\";\nimport { encodeBase32LowerCaseNoPadding, encodeHexLowerCase } from \"npm:@oslojs/encoding\";\nimport { SESSIONS_TABLE, USER_TABLE } from \"./schema.ts\";\n\nexport function generateSessionToken(): string {\n const bytes = new Uint8Array(20);\n crypto.getRandomValues(bytes);\n const token = encodeBase32LowerCaseNoPadding(bytes);\n return token;\n}\n\nexport async function createSession(token: string, userId: number): Promise {\n const sessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(token)));\n const session: Session = {\n id: sessionId,\n userId,\n expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),\n };\n await sqlite.execute(\n `INSERT INTO ${SESSIONS_TABLE} (id, user_id, expires_at) VALUES (?, ?, ?)`,\n [session.id, session.userId, Math.floor(session.expiresAt.getTime() / 1000)],\n );\n return session;\n}\n\nexport async function validateSessionToken(token: string): Promise {\n const sessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(token)));\n const { rows } = await sqlite.execute(\n `SELECT s.id, s.user_id, s.expires_at, u.id, u.email, u.username \n FROM ${SESSIONS_TABLE} s \n INNER JOIN ${USER_TABLE} u ON u.id = s.user_id \n WHERE s.id = ?`,\n [sessionId],\n );\n\n if (rows.length === 0) {\n return { session: null, user: null };\n }\n\n const row = rows[0];\n const session: Session = {\n id: row[0],\n userId: row[1],\n expiresAt: new Date(row[2] * 1000),\n };\n const user: User = {\n id: row[3],\n email: row[4],\n username: row[5],\n };\n\n if (Date.now() >= session.expiresAt.getTime()) {\n await sqlite.execute(`DELETE FROM ${SESSIONS_TABLE} WHERE id = ?`, [session.id]);\n return { session: null, user: null };\n }\n\n // If 50% of the session lifetime has passed (15 days out of 30), rotate the token\n if (Date.now() >= session.expiresAt.getTime() - 1000 * 60 * 60 * 24 * 15) {\n // Generate a new token\n const newToken = generateSessionToken();\n const newSessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(newToken)));\n\n // Create a new session with the new token\n const newExpiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24 * 30);\n\n // Insert the new session\n await sqlite.execute(\n `INSERT INTO ${SESSIONS_TABLE} (id, user_id, expires_at) VALUES (?, ?, ?)`,\n [newSessionId, session.userId, Math.floor(newExpiresAt.getTime() / 1000)],\n );\n\n // Delete the old session\n await sqlite.execute(`DELETE FROM ${SESSIONS_TABLE} WHERE id = ?`, [session.id]);\n\n // Return the new session and token\n const newSession: Session = {\n id: newSessionId,\n userId: session.userId,\n expiresAt: newExpiresAt,\n };\n\n return { session: newSession, user, newToken };\n }\n\n return { session, user };\n}\n\nexport async function invalidateSession(sessionId: string): Promise {\n await sqlite.execute(`DELETE FROM ${SESSIONS_TABLE} WHERE id = ?`, [sessionId]);\n}\n\nexport type SessionValidationResult =\n | { session: Session; user: User; newToken?: string }\n | { session: null; user: null };\n\nexport interface Session {\n id: string;\n userId: number;\n expiresAt: Date;\n}\n\nexport interface User {\n id: number;\n email?: string;\n username?: string;\n}",[],[150,174,183],"31e89cde-3949-11f0-817e-9e149126039e","schema.ts","1c12d656-7d60-47fe-b070-b53c002b59a6",["D",1748164698080],"import { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\n\nexport const USER_TABLE = \"lucia_demo_users\";\nexport const SESSIONS_TABLE = \"lucia_demo_sessions\";\nexport const MAGIC_LINKS_TABLE = \"lucia_demo_magic_links_v2\";\n\nasync function createTables() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${USER_TABLE} (\n id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,\n created_at INTEGER NOT NULL,\n email STRING UNIQUE,\n username STRING UNIQUE\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${SESSIONS_TABLE} (\n id TEXT NOT NULL PRIMARY KEY,\n user_id INTEGER NOT NULL REFERENCES ${USER_TABLE}(id),\n expires_at INTEGER NOT NULL\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${MAGIC_LINKS_TABLE} (\n id TEXT NOT NULL PRIMARY KEY,\n email TEXT NOT NULL,\n created_at INTEGER NOT NULL,\n expires_at INTEGER NOT NULL\n )\n `);\n}\n\nawait createTables();",[],[150,174,190],"31e873ee-3949-11f0-817e-9e149126039e","magic-links.ts","67598069-620b-47e3-add0-81340a697678",["D",1748164698080],"import { email } from \"https://esm.town/v/std/email\";\nimport { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nimport { sha256 } from \"npm:@oslojs/crypto/sha2\";\nimport { encodeHexLowerCase } from \"npm:@oslojs/encoding\";\nimport { MAGIC_LINKS_TABLE, USER_TABLE } from \"./schema.ts\";\nimport { createSession, generateSessionToken } from \"./sessions.ts\";\n\n// Hash a token using sha256\nfunction hashToken(token: string): string {\n return encodeHexLowerCase(sha256(new TextEncoder().encode(token)));\n}\n\n// Create a magic link token for the given email\nexport async function createMagicLinkToken(userEmail: string): Promise {\n const token = generateSessionToken();\n const tokenHash = hashToken(token);\n const now = Math.floor(Date.now() / 1000);\n const expiresAt = now + 60 * 15; // 15 minutes expiration\n\n await sqlite.execute(\n `INSERT INTO ${MAGIC_LINKS_TABLE} (id, email, created_at, expires_at) VALUES (?, ?, ?, ?)`,\n [tokenHash, userEmail, now, expiresAt],\n );\n\n return token;\n}\n\n// Send a magic link email\nexport async function sendMagicLinkEmail(url: string, userEmail: string, token: string): Promise {\n try {\n const magicLink = `${url}/auth/magic-link/${token}`;\n\n await email({\n to: userEmail,\n subject: \"Your login link for Lucia Demo\",\n text: `Click this link to log in: ${magicLink}`,\n html: `\n

Login to Lucia Demo

Click the button below to log in:

\n \n Log in\n \n

Or copy and paste this URL into your browser:

${magicLink}

This link will expire in 15 minutes.

\n `,\n });\n\n return true;\n } catch (error) {\n console.error(\"Error sending email:\", error);\n return false;\n }\n}\n\n// Validate a magic link token and create a session\nexport async function validateMagicLinkToken(token: string): Promise<{ valid: boolean; userId?: number }> {\n const now = Math.floor(Date.now() / 1000);\n const tokenHash = hashToken(token);\n\n // Get the token from the database using its hash\n const { rows } = await sqlite.execute(\n `SELECT email, expires_at FROM ${MAGIC_LINKS_TABLE} WHERE id = ?`,\n [tokenHash],\n );\n\n if (rows.length === 0) {\n console.log(\"Did not find magic link token in database\");\n return { valid: false };\n }\n\n const { email, expiresAt } = rows[0];\n\n // Check if the token has expired\n if (now > expiresAt) {\n console.log(\"Magic link token has expired\", expiresAt);\n // Delete expired token\n await sqlite.execute(`DELETE FROM ${MAGIC_LINKS_TABLE} WHERE id = ?`, [tokenHash]);\n return { valid: false };\n }\n\n console.log(\"Valid magic link token\");\n\n // Get or create the user\n const { rows: userRows } = await sqlite.execute(\n `SELECT id FROM ${USER_TABLE} WHERE email = ?`,\n [email],\n );\n\n let userId: number;\n\n if (userRows.length === 0) {\n console.log(\"Creating user\", email);\n // Create a new user\n const { lastInsertRowid } = await sqlite.execute(\n `INSERT INTO ${USER_TABLE} (email, created_at) VALUES (?, ?)`,\n [email, now],\n );\n userId = lastInsertRowid;\n } else {\n console.log(\"Found user\", email);\n userId = userRows[0][0];\n }\n\n // Delete the used token\n // TODO - investigate: I found that when I immediately delete the token (single use),\n // That it causes issues. It seems like somehow the token is getting used before it's getting used.\n // Maybe my browser or something is making a pre-flight request that's using it up? Maybe my email client?\n // await sqlite.execute(`DELETE FROM ${MAGIC_LINKS_TABLE} WHERE id = ?`, [tokenHash]);\n\n return { valid: true, userId };\n}",[],[150,174,197],"31e39b12-3949-11f0-817e-9e149126039e",["D",1748164698080],"legacyEnvVars","httpPrivacy","description","imageUrl","userId","fc0bd9ca-263d-48ce-84f0-30b4a2ea6082","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","fc71265b-929d-440a-aa31-727271a3da69","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_246":242},"org",{"_11":12,"_240":-5,"_241":242,"_209":210,"_243":244,"_245":53},"branch",{"_17":73,"_13":16,"_36":71,"_42":203,"_45":37,"_47":236,"_237":55,"_238":43,"_239":59,"_60":14,"_56":12},169,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ycVRJUVhlbWlxQ1ZNUnJVcWpHQ1dWNGEwcU0ifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":203,"_13":14,"_38":335,"_51":-5,"_205":53,"_54":55,"_206":55,"_207":-5,"_208":-5,"_209":210,"_211":160,"_212":75,"_213":75,"_214":-5,"_215":32,"_58":216,"_217":-5,"_218":-5,"_219":-5,"_220":-5,"_221":222,"_223":222,"_224":225,"_226":225,"_227":225,"_228":222,"_229":222,"_230":336,"_232":337,"_234":338,"_52":53},[290,297,304],"files",[290,291,292,293,294,295,296,297,298,299,300,301,302,303,304],"counts",{"_281":32,"_282":73,"_283":32,"_35":284,"_285":286},[275,276,277],{"_36":96,"_13":19,"_66":69,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":97,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_18":274},"upstreamProject",{"_36":43,"_13":14,"_207":270,"_208":271,"_54":55,"_230":272},"upstreamBranch",{"_36":37,"_38":268,"_40":269,"_13":16,"_42":43,"_17":44,"_45":46,"_47":48,"_49":50,"_51":-5,"_52":53,"_54":55,"_56":57,"_58":59,"_60":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1746647560619],["D",1770901632622],"Demo app of roll-your-own auth & magic link login","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/ef5744e2-62bc-4f47-8081-012828fcc300/square512?exp=1789570799&sig=b3e3f54a638bfd442ce6e19c9e562c30da740265a9c5143f5364143f327b40d7",{"_11":57,"_246":273},"https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg",[19],{"_36":90,"_13":91,"_66":92,"_68":69,"_70":71,"_72":73,"_74":75,"_38":93,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_18":280},{"_36":84,"_13":85,"_66":86,"_68":69,"_70":71,"_72":73,"_74":75,"_38":87,"_17":32,"_77":24,"_79":88,"_81":53,"_82":-5,"_18":279},{"_36":64,"_13":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_38":76,"_17":32,"_77":78,"_79":80,"_81":53,"_82":-5,"_18":278},[19,65],[19,85],[19,91],"pulls","branches","forks",{"_287":32,"_289":32},"connections",{"_287":32,"_288":32},"count","unfilledCount","emptyCount",{"_36":149,"_13":150,"_66":151,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":152,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":333,"_18":334},{"_36":173,"_13":174,"_66":175,"_68":151,"_70":71,"_72":73,"_74":75,"_38":176,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":331,"_18":332},{"_36":196,"_13":197,"_66":198,"_68":175,"_70":71,"_72":73,"_74":75,"_38":199,"_17":32,"_77":78,"_79":200,"_81":53,"_82":-5,"_107":329,"_18":330},{"_36":189,"_13":190,"_66":191,"_68":175,"_70":71,"_72":73,"_74":75,"_38":192,"_17":32,"_77":78,"_79":193,"_81":53,"_82":-5,"_107":327,"_18":328},{"_36":182,"_13":183,"_66":184,"_68":175,"_70":71,"_72":73,"_74":75,"_38":185,"_17":32,"_77":78,"_79":186,"_81":53,"_82":-5,"_107":325,"_18":326},{"_36":166,"_13":167,"_66":168,"_68":151,"_70":71,"_72":73,"_74":75,"_38":169,"_17":32,"_77":78,"_79":170,"_81":53,"_82":-5,"_107":323,"_18":324},{"_36":158,"_13":159,"_66":160,"_68":151,"_70":71,"_72":73,"_74":75,"_38":161,"_17":32,"_77":162,"_79":163,"_81":53,"_82":-5,"_107":321,"_18":322},{"_36":96,"_13":19,"_66":69,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":110,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":319,"_18":320},{"_36":90,"_13":91,"_66":92,"_68":69,"_70":71,"_72":73,"_74":75,"_38":122,"_17":32,"_77":94,"_79":-5,"_81":53,"_82":-5,"_107":317,"_18":318},{"_36":142,"_13":143,"_66":144,"_68":92,"_70":71,"_72":73,"_74":75,"_38":145,"_17":32,"_77":78,"_79":146,"_81":53,"_82":-5,"_107":315,"_18":316},{"_36":135,"_13":136,"_66":137,"_68":92,"_70":71,"_72":73,"_74":75,"_38":138,"_17":32,"_77":78,"_79":139,"_81":53,"_82":-5,"_107":313,"_18":314},{"_36":128,"_13":129,"_66":130,"_68":92,"_70":71,"_72":73,"_74":75,"_38":131,"_17":32,"_77":78,"_79":132,"_81":53,"_82":-5,"_107":311,"_18":312},{"_36":84,"_13":85,"_66":86,"_68":69,"_70":71,"_72":73,"_74":75,"_38":119,"_17":32,"_77":24,"_79":88,"_81":53,"_82":-5,"_107":309,"_18":310},{"_36":64,"_13":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_38":116,"_17":32,"_77":78,"_79":80,"_81":53,"_82":-5,"_107":307,"_18":308},{"_36":102,"_13":103,"_66":104,"_68":-5,"_70":71,"_72":73,"_74":75,"_38":105,"_17":32,"_77":24,"_79":106,"_81":53,"_82":-5,"_107":305,"_18":306},[],[103],[],[19,65],[],[19,85],[],[19,91,129],[],[19,91,136],[],[19,91,143],[299,300,301],[19,91],[298,302,303],[19],[],[150,159],[],[150,167],[],[150,174,183],[],[150,174,190],[],[150,174,197],[292,293,294],[150,174],[291,295,296],[150],["D",1748164698080],{"_11":12,"_246":242},{"_11":12,"_240":-5,"_241":242,"_209":210,"_243":244,"_245":53},{"_17":73,"_13":16,"_36":71,"_42":203,"_45":37,"_47":236,"_237":55,"_238":43,"_239":59,"_60":14,"_56":12},"ctx",{"_230":-5,"_265":372,"_373":374,"_375":376,"_377":53,"_378":53,"_379":53,"_380":75,"_381":-5,"_382":-7,"_383":-7,"_384":32,"_385":53,"_386":53,"_387":-5,"_388":53,"_389":53,"_390":53,"_391":-5},"ENV",{"_343":344,"_345":346,"_347":16,"_348":349,"_350":351,"_352":353,"_354":355,"_356":357,"_358":359,"_360":361,"_362":363,"_364":365,"_366":367,"_368":369,"_370":371},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]