pleroma librarian setup

One-time xAuth exchange. The password is sent only to Instapaper and is not stored by this service.

`);\n}\n\nasync function handleSetup(request: Request): Promise {\n const environment = envValues();\n const status = configurationStatus(environment);\n if (!status.setupEnabled) return new Response(\"setup disabled\", { status: 404 });\n if (request.method === \"GET\") return setupForm();\n if (request.method !== \"POST\") return new Response(\"method not allowed\", { status: 405 });\n\n const form = await request.formData();\n const submittedSetupToken = String(form.get(\"setup_token\") ?? \"\");\n if (!isBearerAuthorized(`Bearer ${submittedSetupToken}`, environment.SETUP_TOKEN)) {\n return secureHtml(\"

Unauthorized

\", 401);\n }\n const username = String(form.get(\"username\") ?? \"\");\n let password = String(form.get(\"password\") ?? \"\");\n if (!username || !password) return secureHtml(\"

Missing credentials

\", 400);\n\n try {\n const bootstrapClient = new InstapaperClient({\n consumerKey: environment.INSTAPAPER_CONSUMER_KEY!,\n consumerSecret: environment.INSTAPAPER_CONSUMER_SECRET!,\n });\n const tokens = await bootstrapClient.exchangeAccessToken(username, password);\n password = \"\";\n return secureHtml(`tokens generated

Access tokens generated

Add these two values to the Val Town environment, then remove SETUP_TOKEN.

INSTAPAPER_ACCESS_TOKEN

${escapeHtml(tokens.oauth_token)}

INSTAPAPER_ACCESS_TOKEN_SECRET

${escapeHtml(tokens.oauth_token_secret)}

Do not send these values through chat.

`);\n } catch (error) {\n password = \"\";\n const message = error instanceof Error ? error.message : \"setup failed\";\n return secureHtml(`

Setup failed

${escapeHtml(message)}

`, 400);\n }\n}\n\nexport default async function handler(request: Request): Promise {\n const url = new URL(request.url);\n if (url.pathname === \"/health\") {\n return Response.json({\n ok: true,\n service: SERVICE,\n configuration: configurationStatus(envValues()),\n }, { headers: { \"cache-control\": \"no-store\" } });\n }\n if (url.pathname === \"/setup\") return await handleSetup(request);\n if (url.pathname === \"/\") {\n return new Response(\"pleroma librarian\\npersonal reading and research integration\\n\", {\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n }\n if (url.pathname !== \"/mcp\") return new Response(\"not found\", { status: 404 });\n\n const environment = envValues();\n if (!isBearerAuthorized(request.headers.get(\"authorization\"), environment.MCP_BEARER_TOKEN)) {\n return new Response(\"unauthorized\", {\n status: 401,\n headers: { \"www-authenticate\": \"Bearer\" },\n });\n }\n return await mcpHandler.fetch(request);\n}\n",[],[203],"a0015f8b-5be3-41e6-acd6-c15cb936730f","lib.ts","10ea5ca8-9c2a-11f1-8eb6-1607ee4eb77e",["D",1787183991142],"export function percentEncode(value: string | number): string {\n return encodeURIComponent(String(value)).replace(/[!'()*]/g, (character) =>\n `%${character.charCodeAt(0).toString(16).toUpperCase()}`\n );\n}\n\nexport type OAuthAuthorizationOptions = {\n method: string;\n url: string;\n consumerKey: string;\n consumerSecret: string;\n token?: string;\n tokenSecret?: string;\n bodyParams?: Record;\n nonce?: string;\n timestamp?: string;\n};\n\nfunction bytesToBase64(bytes: ArrayBuffer): string {\n let binary = \"\";\n for (const byte of new Uint8Array(bytes)) binary += String.fromCharCode(byte);\n return btoa(binary);\n}\n\nexport async function createOAuthAuthorization(\n options: OAuthAuthorizationOptions,\n): Promise<{ header: string; signature: string; baseString: string }> {\n const parsedUrl = new URL(options.url);\n const oauthParams: Record = {\n oauth_consumer_key: options.consumerKey,\n oauth_nonce: options.nonce ?? crypto.randomUUID().replaceAll(\"-\", \"\"),\n oauth_signature_method: \"HMAC-SHA1\",\n oauth_timestamp: options.timestamp ?? String(Math.floor(Date.now() / 1000)),\n };\n if (options.token) oauthParams.oauth_token = options.token;\n\n const allParams: Array<[string, string]> = [];\n for (const [key, value] of parsedUrl.searchParams.entries()) {\n allParams.push([percentEncode(key), percentEncode(value)]);\n }\n for (const [key, value] of Object.entries(options.bodyParams ?? {})) {\n allParams.push([percentEncode(key), percentEncode(value)]);\n }\n for (const [key, value] of Object.entries(oauthParams)) {\n allParams.push([percentEncode(key), percentEncode(value)]);\n }\n allParams.sort(([keyA, valueA], [keyB, valueB]) =>\n keyA === keyB ? valueA.localeCompare(valueB) : keyA.localeCompare(keyB)\n );\n\n const normalizedParams = allParams.map(([key, value]) => `${key}=${value}`).join(\"&\");\n const baseUrl = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;\n const baseString = [\n options.method.toUpperCase(),\n percentEncode(baseUrl),\n percentEncode(normalizedParams),\n ].join(\"&\");\n const signingKey = `${percentEncode(options.consumerSecret)}&${percentEncode(options.tokenSecret ?? \"\")}`;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(signingKey),\n { name: \"HMAC\", hash: \"SHA-1\" },\n false,\n [\"sign\"],\n );\n const signature = bytesToBase64(\n await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(baseString)),\n );\n const headerParams = { ...oauthParams, oauth_signature: signature };\n const header = \"OAuth \" + Object.entries(headerParams)\n .sort(([a], [b]) => a.localeCompare(b))\n .map(([key, value]) => `${percentEncode(key)}=\\\"${percentEncode(value)}\\\"`)\n .join(\", \");\n\n return { header, signature, baseString };\n}\n\nexport function parseFormEncoded(body: string): Record {\n return Object.fromEntries(new URLSearchParams(body).entries());\n}\n\nexport function isBearerAuthorized(\n authorizationHeader: string | null,\n expectedToken: string | undefined,\n): boolean {\n if (!authorizationHeader || !expectedToken) return false;\n const prefix = \"Bearer \";\n if (!authorizationHeader.startsWith(prefix)) return false;\n const actualToken = authorizationHeader.slice(prefix.length);\n if (actualToken.length !== expectedToken.length) return false;\n let difference = 0;\n for (let index = 0; index < expectedToken.length; index++) {\n difference |= actualToken.charCodeAt(index) ^ expectedToken.charCodeAt(index);\n }\n return difference === 0;\n}\n",[],[210],["D",1787381456328],[],[18],["D",1787183267868],{"_11":12,"_137":71},{"_11":12,"_133":-5,"_70":71,"_30":69,"_134":135,"_136":24},{"_40":124,"_13":16,"_34":37,"_125":88,"_126":-5,"_127":-5,"_128":-5,"_129":-5,"_130":-5,"_131":14,"_132":12},"ctx",{"_54":-5,"_156":256,"_257":258,"_259":260,"_261":24,"_262":24,"_263":24,"_264":101,"_265":-5,"_266":-7,"_267":-7,"_268":26,"_269":24,"_270":24,"_271":-5,"_272":24,"_273":24,"_274":24,"_275":-5},"ENV",{"_227":228,"_229":230,"_231":16,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · instapaper.ts