[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_164":165,"_166":167},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_61":134,"_16":-7,"_135":-5,"_17":136,"_137":138,"_28":139,"_21":140,"_23":141,"_142":-5,"_143":-5,"_144":-5,"_145":36,"_146":147,"_148":34,"_149":-5,"_150":-5,"_151":152},"routes/_app.x.$handle.$name._index",{"_11":12,"_13":14,"_15":-7,"_16":-7,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-7,"_26":-5,"_27":-5,"_28":29,"_30":-5,"_31":-5,"_32":-5,"_33":34,"_35":36,"_37":34},"handle","umaisdeveloper","name","nrg-token-exchange","branchName","version","project",{"_39":78,"_13":14,"_50":79,"_80":-5,"_81":36,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":-5,"_91":36,"_92":-5,"_93":-5,"_94":67,"_95":96,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":102,"_103":102,"_104":105,"_106":105,"_107":105,"_108":102,"_109":102,"_110":111,"_112":113,"_114":115,"_116":36},"tags",[],"counts",{"_66":67,"_68":69,"_70":67,"_71":72,"_73":74},"contents",[63],"readme","upstream","pull","files",[38],"preview","ahead","behind","showHomeCustomizationHint",true,"showHTTPPreviewSettingsHint",false,"hasHTTPFiles",{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":51,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_59":60,"_61":62},"id","a47f1f0a-68de-43d9-bab4-431abc588fc4","main.ts","fileId","87af7930-5392-11f1-953d-ee650bb23af1","parentId","branchId","87aa9e10-5392-11f1-953d-ee650bb23af1","branchVersion",5,"latest","createdAt",["D",1786569201428],4,"fileType","http","content","// Val Town HTTP function — the only server component in this architecture.\n//\n// Three routes:\n// POST / OAuth code -> token exchange (unchanged, original behavior)\n// POST /encrypt { token, path, plaintext } -> { ciphertext }\n// POST /decrypt { token, path } -> { plaintext }\n//\n// WHY THE CRYPTO LIVES HERE, NOT IN THE BROWSER\n// The frontend is a static bundle on GitHub Pages — anything shipped in it is\n// public, and window.APP_CONFIG is even writable from the console. A key handed\n// to the browser is a published key. So the key never leaves this function:\n// callers send a path, we verify they own it, and we return plaintext.\n//\n// CORS IS NOT AUTHENTICATION. Access-Control-Allow-Origin is enforced by\n// browsers; curl ignores it entirely. Every privileged route below therefore\n// verifies the caller's GitHub token server-side. Do not remove those checks on\n// the assumption that CORS restricts who can call this.\n//\n// Env vars:\n// GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET — OAuth app (token exchange)\n// ALLOWED_ORIGIN — exact frontend origin\n// NOTE_ENCRYPTION_KEY — base64 32 bytes (AES-256-GCM)\n// TARGET_REPO — \"owner/repo\" the notes live in\n//\n// Generate a key with:\n// crypto.getRandomValues(new Uint8Array(32)) -> base64\n// BACK IT UP. Losing it means every encrypted note is unrecoverable.\n\nconst GITHUB_API = \"https://api.github.com\";\n\n// Rate limit: per-login cap over a rolling window. A decryption endpoint\n// without this is a quiet bulk-exfiltration path.\nconst RATE_LIMIT_MAX = 60;\nconst RATE_LIMIT_WINDOW_MS = 60_000;\nconst rateBuckets = new Map();\n\n// Small in-memory identity cache so each note read does not cost two GitHub\n// API calls. Short TTL: revoking access should take effect quickly.\nconst IDENTITY_TTL_MS = 60_000;\nconst identityCache = new Map();\n\nfunction jsonResponse(\n body: unknown,\n status: number,\n cors: Record,\n) {\n return new Response(JSON.stringify(body), {\n status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n}\n\n// ── crypto ──────────────────────────────────────────────────────────────────\n\nfunction b64encode(bytes: Uint8Array): string {\n let binary = \"\";\n const chunk = 0x8000;\n for (let i = 0; i < bytes.length; i += chunk) {\n binary += String.fromCharCode(...bytes.subarray(i, i + chunk));\n }\n return btoa(binary);\n}\n\nfunction b64decode(text: string): Uint8Array {\n const binary = atob(text.replace(/\\s+/g, \"\"));\n return Uint8Array.from(binary, (c) => c.charCodeAt(0));\n}\n\nasync function getKey(): Promise {\n const raw = Deno.env.get(\"NOTE_ENCRYPTION_KEY\");\n if (!raw) {\n throw new Error(\"NOTE_ENCRYPTION_KEY is not configured\");\n }\n const bytes = b64decode(raw);\n if (bytes.length !== 32) {\n throw new Error(\"NOTE_ENCRYPTION_KEY must be 32 bytes (base64-encoded)\");\n }\n return crypto.subtle.importKey(\"raw\", bytes, { name: \"AES-GCM\" }, false, [\n \"encrypt\",\n \"decrypt\",\n ]);\n}\n\n// Output layout: base64( iv[12] || ciphertext+tag ). A fresh IV per note is\n// mandatory — reusing an IV under the same key breaks GCM badly.\nasync function encryptText(plaintext: string): Promise {\n const key = await getKey();\n const iv = crypto.getRandomValues(new Uint8Array(12));\n const encoded = new TextEncoder().encode(plaintext);\n const cipher = new Uint8Array(\n await crypto.subtle.encrypt({ name: \"AES-GCM\", iv }, key, encoded),\n );\n const out = new Uint8Array(iv.length + cipher.length);\n out.set(iv, 0);\n out.set(cipher, iv.length);\n return b64encode(out);\n}\n\nasync function decryptText(payload: string): Promise {\n const key = await getKey();\n const bytes = b64decode(payload);\n if (bytes.length <= 12) {\n throw new Error(\"Ciphertext is too short to contain an IV\");\n }\n const iv = bytes.subarray(0, 12);\n const cipher = bytes.subarray(12);\n // Throws if the GCM auth tag fails — i.e. the data was tampered with\n const plain = await crypto.subtle.decrypt(\n { name: \"AES-GCM\", iv },\n key,\n cipher,\n );\n return new TextDecoder().decode(plain);\n}\n\n// ── caller identity ─────────────────────────────────────────────────────────\n\nasync function resolveCaller(token: string): Promise {\n if (!token || typeof token !== \"string\") return null;\n\n const cached = identityCache.get(token);\n if (cached && Date.now() - cached.at < IDENTITY_TTL_MS) {\n return cached.login;\n }\n\n const res = await fetch(`${GITHUB_API}/user`, {\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github+json\",\n },\n });\n if (!res.ok) return null;\n const user = await res.json();\n const login = user?.login;\n if (!login) return null;\n\n identityCache.set(token, { login, at: Date.now() });\n return login;\n}\n\nasync function isCollaborator(\n token: string,\n repo: string,\n login: string,\n): Promise {\n const [owner] = repo.split(\"/\");\n if (login.toLowerCase() === owner.toLowerCase()) return true;\n const res = await fetch(\n `${GITHUB_API}/repos/${repo}/collaborators/${login}`,\n {\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github+json\",\n },\n },\n );\n return res.status === 204;\n}\n\n// Reads a repo file with the CALLER's token. Using their token rather than a\n// privileged one means we can never read something they could not read anyway.\nasync function readRepoFile(\n token: string,\n repo: string,\n path: string,\n): Promise {\n const res = await fetch(\n `${GITHUB_API}/repos/${repo}/contents/${\n path.split(\"/\").map(encodeURIComponent).join(\"/\")\n }`,\n {\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github+json\",\n },\n cache: \"no-store\",\n },\n );\n if (!res.ok) return null;\n const data = await res.json();\n const b64 = (data.content || \"\").replace(/\\n/g, \"\");\n return new TextDecoder().decode(b64decode(b64));\n}\n\n// Role comes from coaches/users.json in the repo, never from the request body —\n// a client-supplied \"I am an admin\" claim proves nothing to a server.\nasync function resolveRole(\n token: string,\n repo: string,\n login: string,\n): Promise<{ role: string; coach?: string; memberSlug?: string }> {\n const text = await readRepoFile(token, repo, \"coaches/users.json\");\n if (!text) return { role: \"coach\" }; // unlisted defaults to coach, matching the app\n try {\n const users = JSON.parse(text)?.users || [];\n const entry = users.find(\n (u: { githubLogin?: string }) =>\n String(u.githubLogin || \"\").toLowerCase() === login.toLowerCase(),\n );\n if (!entry || ![\"admin\", \"coach\", \"member\"].includes(entry.role)) {\n return { role: \"coach\" };\n }\n return {\n role: entry.role,\n coach: entry.coach,\n memberSlug: entry.memberSlug,\n };\n } catch {\n return { role: \"coach\" };\n }\n}\n\n// ── path authorization ──────────────────────────────────────────────────────\n// Mirrors assertOwnedPath / assertReadablePath in src/lib/githubAuth.js. It is\n// re-implemented here deliberately: a client-side check proves nothing to a\n// server, so this must stand on its own.\n\nfunction isSafePath(path: string): boolean {\n if (!path || typeof path !== \"string\") return false;\n if (path.includes(\"..\") || path.includes(\"\\\\\") || path.startsWith(\"/\")) {\n return false;\n }\n return /^coaches\\/[A-Za-z0-9-]+\\//.test(path);\n}\n\nfunction isNotePath(path: string): boolean {\n return /^coaches\\/[A-Za-z0-9-]+\\/members\\/[^/]+\\/notes\\/[^/]+\\.txt$/i.test(\n path,\n );\n}\n\nfunction pathCoach(path: string): string | null {\n const m = /^coaches\\/([A-Za-z0-9-]+)\\//.exec(path);\n return m ? m[1] : null;\n}\n\nfunction pathMemberSlug(path: string): string | null {\n const m = /^coaches\\/[A-Za-z0-9-]+\\/members\\/([^/]+)\\/notes\\//i.exec(path);\n return m ? m[1] : null;\n}\n\nfunction authorizePath(\n path: string,\n login: string,\n role: { role: string; coach?: string; memberSlug?: string },\n action: \"encrypt\" | \"decrypt\",\n): { ok: true } | { ok: false; reason: string } {\n if (!isSafePath(path)) {\n return { ok: false, reason: \"Unsafe or malformed path\" };\n }\n if (!isNotePath(path)) return { ok: false, reason: \"Not a note path\" };\n\n const coach = pathCoach(path);\n const slug = pathMemberSlug(path);\n\n // A coach works only inside their own folder\n if (coach && coach.toLowerCase() === login.toLowerCase()) return { ok: true };\n\n // Admins may read across coaches, but never write\n if (role.role === \"admin\") {\n if (action === \"decrypt\") return { ok: true };\n return { ok: false, reason: \"Admins have read-only access\" };\n }\n\n // A member may read only notes about themselves, in their own coach's folder\n if (role.role === \"member\") {\n if (action !== \"decrypt\") {\n return { ok: false, reason: \"Members cannot write notes\" };\n }\n if (!role.coach || !role.memberSlug) {\n return { ok: false, reason: \"Member is not linked to a member record\" };\n }\n if (coach?.toLowerCase() !== role.coach.toLowerCase()) {\n return { ok: false, reason: \"Note belongs to a different coach\" };\n }\n if (slug !== role.memberSlug) {\n return { ok: false, reason: \"Note is about a different member\" };\n }\n return { ok: true };\n }\n\n return { ok: false, reason: \"Path is outside your own folder\" };\n}\n\n// The Visibility header gates member access. Checked HERE rather than in the\n// browser so a member can never obtain the plaintext of a private note about\n// themselves — previously the client fetched every note just to read this.\nfunction isNoteShared(noteText: string): boolean {\n const head = String(noteText || \"\").split(/\\r?\\n\\r?\\n/)[0] || \"\";\n return /^Visibility:\\s*shared\\s*$/im.test(head);\n}\n\n// ── rate limiting + audit ───────────────────────────────────────────────────\n\nfunction rateLimited(login: string): boolean {\n const now = Date.now();\n const hits = (rateBuckets.get(login) || []).filter((t) =>\n now - t < RATE_LIMIT_WINDOW_MS\n );\n hits.push(now);\n rateBuckets.set(login, hits);\n return hits.length > RATE_LIMIT_MAX;\n}\n\n// Records who touched what. Deliberately never logs the token or the plaintext.\nfunction audit(entry: {\n login: string;\n path: string;\n action: string;\n allowed: boolean;\n reason?: string;\n}) {\n console.log(\n JSON.stringify({\n ts: new Date().toISOString(),\n type: \"note-access\",\n ...entry,\n }),\n );\n}\n\n// ── routes ──────────────────────────────────────────────────────────────────\n\nasync function handleCrypto(\n req: Request,\n cors: Record,\n action: \"encrypt\" | \"decrypt\",\n) {\n const repo = Deno.env.get(\"TARGET_REPO\");\n if (!repo) {\n return jsonResponse({ error: \"TARGET_REPO is not configured\" }, 500, cors);\n }\n if (!Deno.env.get(\"NOTE_ENCRYPTION_KEY\")) {\n return jsonResponse(\n { error: \"NOTE_ENCRYPTION_KEY is not configured\" },\n 500,\n cors,\n );\n }\n\n let payload: {\n token?: string;\n path?: string;\n plaintext?: string;\n ciphertext?: string;\n };\n try {\n payload = await req.json();\n } catch {\n return jsonResponse({ error: \"Invalid JSON body\" }, 400, cors);\n }\n\n const token = payload?.token;\n const path = String(payload?.path || \"\");\n if (!token) return jsonResponse({ error: \"Missing token\" }, 401, cors);\n\n const login = await resolveCaller(token);\n if (!login) {\n return jsonResponse(\n { error: \"Invalid or expired GitHub token\" },\n 401,\n cors,\n );\n }\n\n if (rateLimited(login)) {\n audit({ login, path, action, allowed: false, reason: \"rate limited\" });\n return jsonResponse(\n { error: \"Rate limit exceeded. Try again shortly.\" },\n 429,\n cors,\n );\n }\n\n if (!(await isCollaborator(token, repo, login))) {\n audit({\n login,\n path,\n action,\n allowed: false,\n reason: \"not a collaborator\",\n });\n return jsonResponse(\n { error: \"Not a collaborator on this repository\" },\n 403,\n cors,\n );\n }\n\n const role = await resolveRole(token, repo, login);\n const verdict = authorizePath(path, login, role, action);\n if (!verdict.ok) {\n audit({ login, path, action, allowed: false, reason: verdict.reason });\n return jsonResponse(\n { error: `Access denied: ${verdict.reason}` },\n 403,\n cors,\n );\n }\n\n try {\n if (action === \"encrypt\") {\n if (typeof payload.plaintext !== \"string\") {\n return jsonResponse({ error: \"Missing plaintext\" }, 400, cors);\n }\n const ciphertext = await encryptText(payload.plaintext);\n audit({ login, path, action, allowed: true });\n return jsonResponse({ ciphertext }, 200, cors);\n }\n\n // decrypt: members only ever see notes explicitly marked shared\n if (role.role === \"member\") {\n const noteText = await readRepoFile(token, repo, path);\n if (noteText === null) {\n return jsonResponse({ error: \"Note not found\" }, 404, cors);\n }\n if (!isNoteShared(noteText)) {\n audit({\n login,\n path,\n action,\n allowed: false,\n reason: \"note is private\",\n });\n return jsonResponse(\n { error: \"This note has not been shared with you.\" },\n 403,\n cors,\n );\n }\n }\n\n if (typeof payload.ciphertext !== \"string\") {\n return jsonResponse({ error: \"Missing ciphertext\" }, 400, cors);\n }\n const plaintext = await decryptText(payload.ciphertext);\n audit({ login, path, action, allowed: true });\n return jsonResponse({ plaintext }, 200, cors);\n } catch (error) {\n audit({ login, path, action, allowed: false, reason: \"crypto failure\" });\n return jsonResponse(\n { error: `Unable to ${action}: ${(error as Error).message}` },\n 400,\n cors,\n );\n }\n}\n\nexport default async function (req: Request): Promise {\n const ALLOWED_ORIGIN = Deno.env.get(\"ALLOWED_ORIGIN\") ||\n \"https://username.github.io\";\n const cors = {\n \"Access-Control-Allow-Origin\": ALLOWED_ORIGIN,\n \"Access-Control-Allow-Methods\": \"POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n };\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: cors });\n }\n\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405, headers: cors });\n }\n\n const { pathname } = new URL(req.url);\n if (pathname.endsWith(\"/encrypt\")) return handleCrypto(req, cors, \"encrypt\");\n if (pathname.endsWith(\"/decrypt\")) return handleCrypto(req, cors, \"decrypt\");\n\n // ── default route: OAuth token exchange (original behavior, unchanged) ────\n const payload = await req.json();\n const code = payload?.code;\n const redirectUri = payload?.redirect_uri;\n if (!code || !redirectUri) {\n return new Response(\n JSON.stringify({ error: \"Missing code or redirect_uri\" }),\n {\n status: 400,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n },\n );\n }\n\n const res = await fetch(\"https://github.com/login/oauth/access_token\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n },\n body: JSON.stringify({\n client_id: Deno.env.get(\"GITHUB_CLIENT_ID\"),\n client_secret: Deno.env.get(\"GITHUB_CLIENT_SECRET\"),\n code,\n redirect_uri: redirectUri,\n }),\n });\n\n const body = await res.text();\n return new Response(body, {\n status: res.status,\n headers: { ...cors, \"Content-Type\": \"application/json\" },\n });\n}","deleted","label","children",[],"path",[41],{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":64,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_61":65},["D",1786569201428],[41],"pulls",0,"branches",1,"forks","envVars",{"_75":48,"_77":67},"connections",{"_75":67,"_76":67},"count","unfilledCount","emptyCount","87a9d7be-5392-11f1-953d-ee650bb23af1",["D",1779202423157],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","GitHub OAuth token exchange for NRG Coaching Hub","imageUrl","userId","c9b33dd0-dc61-457f-a983-a505e55ab016","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019e40b9-2be9-733d-acf1-14e23f19b160","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_133":129},"org",{"_11":12,"_126":127,"_128":129,"_88":89,"_130":131,"_132":36},"branch",{"_16":48,"_13":117,"_39":46,"_118":78,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":-5,"_124":14,"_125":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","umais-developer","avatar","https://avatars.githubusercontent.com/u/258364893?v=4","tier","free","canRestrictVals","profileImageUrl","","adoptOrgId",{"_39":78,"_13":14,"_50":160,"_80":-5,"_81":36,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":-5,"_91":36,"_92":-5,"_93":-5,"_94":67,"_95":96,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":102,"_103":102,"_104":105,"_106":105,"_107":105,"_108":102,"_109":102,"_110":161,"_112":162,"_114":163,"_116":36},"tree",[157],[157],{"_66":67,"_68":69,"_70":67,"_71":155,"_73":156},[153],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":64,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_61":154},[41],{"_75":48,"_77":67},{"_75":67,"_76":67},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":51,"_16":52,"_53":54,"_55":56,"_57":36,"_58":-5,"_59":158,"_61":159},[],[41],["D",1779202423157],{"_11":12,"_133":129},{"_11":12,"_126":127,"_128":129,"_88":89,"_130":131,"_132":36},{"_16":48,"_13":117,"_39":46,"_118":78,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":-5,"_124":14,"_125":12},"ctx",{"_110":-5,"_150":197,"_198":199,"_200":201,"_202":36,"_203":36,"_204":36,"_205":34,"_206":-5,"_207":-7,"_208":-7,"_209":67,"_210":36,"_211":36,"_212":-5,"_213":36,"_214":36,"_215":36,"_216":-5},"ENV",{"_168":169,"_170":171,"_172":117,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]