[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_183":184,"_185":186},"routes/_app.x.$handle.$name",{"_104":103,"_37":49,"_112":94,"_32":106,"_13":14,"_113":-5,"_11":114,"_115":116,"_117":118,"_119":120,"_121":122,"_26":-5,"_123":-5,"_124":-5,"_125":30,"_126":127,"_128":30,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_47":48,"_37":49,"_42":50,"_51":-5,"_52":30,"_53":54,"_55":54,"_56":57,"_58":-5,"_19":59,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":-5,"_77":78,"_79":78,"_80":81,"_82":81,"_83":81,"_84":78,"_85":78,"_86":87,"_88":89,"_90":91,"_92":30},"version",3,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","303eccff-8fc0-4645-9e48-cfcec141697d","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":-7,"_29":30,"_31":30,"_32":33,"_34":33},"file",{"_35":36,"_37":33,"_38":39,"_40":41,"_42":43,"_44":14,"_45":46,"_29":30},"previous","deleted",false,"deletedHere","path","auth.ts","latestPath","fileId","ace8cfc2-a7d3-11f1-8230-1607ee4eb77e","name","fileType","script","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport type { Context, Next } from \"npm:hono\";\n\nexport interface User {\n id: number;\n email: string;\n role: \"admin\" | \"user\";\n}\n\nexport const SESSION_COOKIE = \"pcc_session\";\nconst SESSION_DAYS = 30;\n\nconst encoder = new TextEncoder();\n\nfunction bufToHex(buf: ArrayBuffer): string {\n return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction hexToBuf(hex: string): Uint8Array {\n const out = new Uint8Array(hex.length / 2);\n for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n return out;\n}\n\nasync function randomHex(bytes: number): Promise {\n const buf = crypto.getRandomValues(new Uint8Array(bytes));\n return bufToHex(buf.buffer);\n}\n\n/** PBKDF2-SHA256 password hashing with a per-user random salt. */\nexport async function hashPassword(password: string): Promise<{ salt: string; hash: string }> {\n const salt = await randomHex(16);\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: hexToBuf(salt), iterations: 120_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return { salt, hash: bufToHex(bits) };\n}\n\nexport async function verifyPassword(password: string, salt: string, hash: string): Promise {\n try {\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt: hexToBuf(salt), iterations: 120_000, hash: \"SHA-256\" },\n keyMaterial,\n 256,\n );\n return bufToHex(bits) === hash;\n } catch {\n return false;\n }\n}\n\n/** Create a session for a user; returns the raw token to set as the cookie. */\nexport async function createSession(userId: number): Promise<{ token: string; expiresAt: string }> {\n const id = await randomHex(16);\n const token = await randomHex(32);\n const tokenHash = bufToHex((await crypto.subtle.digest(\"SHA-256\", encoder.encode(token))).buffer);\n const expiresAt = new Date(Date.now() + SESSION_DAYS * 24 * 60 * 60 * 1000).toISOString();\n await sqlite.execute(\n `INSERT INTO sessions (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)`,\n [id, userId, tokenHash, expiresAt],\n );\n return { token, expiresAt };\n}\n\nexport function sessionCookieHeader(token: string, expiresAt: string): string {\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Lax; Path=/; Expires=${new Date(expiresAt).toUTCString()}`;\n}\n\nexport const clearCookieHeader = `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0`;\n\n/** Resolve the current user from the request's cookie, or null. */\nexport async function getSessionUser(req: Request): Promise {\n const cookie = req.headers.get(\"cookie\") ?? \"\";\n const match = cookie.split(\";\").map((s) => s.trim()).find((c) => c.startsWith(`${SESSION_COOKIE}=`));\n if (!match) return null;\n const token = match.slice(SESSION_COOKIE.length + 1);\n if (!token) return null;\n const tokenHash = bufToHex((await crypto.subtle.digest(\"SHA-256\", encoder.encode(token))).buffer);\n const rows = await sqlite.execute(\n `SELECT s.expires_at AS exp, u.id AS id, u.email AS email, u.role AS role\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = ?`,\n [tokenHash],\n );\n if (rows.rows.length === 0) return null;\n const row = rows.rows[0] as { exp: string; id: number; email: string; role: string };\n if (new Date(row.exp).getTime() < Date.now()) return null;\n return { id: Number(row.id), email: row.email, role: row.role as \"admin\" | \"user\" };\n}\n\n/** Hono middleware: require a logged-in user, else 401 JSON (for /api/*). */\nexport async function requireAuth(c: Context, next: Next) {\n const user = await getSessionUser(c.req.raw);\n if (!user) {\n return c.json({ error: \"Not authenticated\" }, 401);\n }\n c.set(\"user\", user);\n await next();\n}\n\n/** Hono middleware: require admin role. */\nexport async function requireAdmin(c: Context, next: Next) {\n const user = c.get(\"user\");\n if (!user || user.role !== \"admin\") {\n return c.json({ error: \"Forbidden\" }, 403);\n }\n await next();\n}\n","createdAt",["D",1788466300593],"branchVersion","branchId","be1fb918-ad42-444d-9d39-35276cd47cc6","id","9c7d0c21-6fce-451a-b6a0-ca5de197aeab","production-command-center",["D",1788450878892],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","NDX internal job production, labor, equipment, and cost dash","imageUrl","fe3e8c07-bae6-44d7-85dc-b222854b68d6","pinnedFileId","179f165a-a7d4-11f1-92c0-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a06443-646e-71a4-ad2c-20559176a0b0","tursoName","9c7d0c216fce451ab6a0ca5de197aeab","tursoHostname","9c7d0c216fce451ab6a0ca5de197aeab-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789514495229],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_104":103,"_111":106},"org",{"_104":103,"_105":106,"_107":106,"_19":59,"_108":109,"_110":30},"branch",{"_13":93,"_37":94,"_47":46,"_95":48,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":49,"_102":103},"isOwned",63,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","wnewton","handle","displayName","","avatar","tier","pro","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_47":48,"_37":49,"_42":178,"_51":-5,"_52":30,"_53":54,"_55":54,"_56":57,"_58":-5,"_19":59,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":67,"_68":69,"_70":71,"_72":73,"_74":179,"_76":-5,"_77":78,"_79":78,"_80":81,"_82":81,"_83":81,"_84":78,"_85":78,"_86":180,"_88":181,"_90":182,"_92":30},"tree",[165,166,167],"files",[165,166,167],"counts",{"_155":67,"_156":140,"_157":67,"_158":159,"_160":161},"contents",[133,134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_47":152,"_37":33,"_35":36,"_139":-5,"_45":46,"_44":14,"_141":63,"_42":153,"_13":67,"_38":39,"_40":41,"_29":30,"_143":-5,"_32":154},{"_47":145,"_37":146,"_35":147,"_139":-5,"_45":46,"_44":148,"_141":30,"_42":149,"_13":67,"_38":39,"_40":150,"_29":30,"_143":-5,"_32":151},{"_47":136,"_37":137,"_35":138,"_139":-5,"_45":46,"_44":140,"_141":63,"_42":142,"_13":67,"_38":39,"_40":106,"_29":30,"_143":-5,"_32":144},"0ba39e2b-78ae-4125-8280-9482a4fdad83","main.ts","c4e2e564-a7af-11f1-b820-1607ee4eb77e","parentId",1,"latest",["D",1788450878935],"label",[137],"1db81fae-c46d-4442-b59d-681694b9d3bd","db.ts","9d68b710-a7d3-11f1-bea0-1607ee4eb77e",2,["D",1788466274587],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n/**\n * Database migrations for the Production Command Center.\n *\n * The migration has its own DB tables for users, sessions, approved emails,\n * jobs, job labor rates, job data, Monday snapshots, and uploaded-file metadata.\n * All statements use CREATE TABLE IF NOT EXISTS / ALTER guard so the setup is\n * idempotent across restarts.\n */\n\nconst migrations: { name: string; sql: string[] }[] = [\n {\n name: \"0001_initial_auth_and_jobs\",\n sql: [\n `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'user' CHECK (role IN ('admin','user')),\n password_salt TEXT,\n password_hash TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS sessions (\n id TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n token_hash TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n expires_at TEXT NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)`,\n `CREATE TABLE IF NOT EXISTS approved_emails (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n role TEXT NOT NULL DEFAULT 'user' CHECK (role IN ('admin','user')),\n created_by INTEGER REFERENCES users(id),\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS jobs (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n source TEXT,\n job_number TEXT,\n status TEXT,\n superintendent TEXT,\n project_manager TEXT,\n estimator TEXT,\n location TEXT,\n jurisdiction TEXT,\n general_contractor TEXT,\n foreman TEXT,\n prevailing_wage TEXT,\n permit_number TEXT,\n schedule_group TEXT,\n monday_url TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS job_labor_rates (\n job_id INTEGER PRIMARY KEY REFERENCES jobs(id) ON DELETE CASCADE,\n labor REAL,\n operator REAL,\n foreman REAL,\n updated_at TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS job_data (\n job_id INTEGER PRIMARY KEY REFERENCES jobs(id) ON DELETE CASCADE,\n data TEXT,\n updated_at TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS monday_snapshots (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n fetched_at TEXT NOT NULL DEFAULT (datetime('now')),\n jobs_json TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS job_files (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n job_id INTEGER REFERENCES jobs(id) ON DELETE CASCADE,\n kind TEXT NOT NULL,\n filename TEXT NOT NULL,\n content_type TEXT,\n size INTEGER,\n blob_key TEXT NOT NULL,\n uploaded_by INTEGER REFERENCES users(id),\n uploaded_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS settings (\n key TEXT PRIMARY KEY,\n value TEXT\n )`,\n ],\n },\n];\n\nconst applied = new Set();\n\nexport async function migrate(): Promise {\n // Track applied migrations.\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS _migrations (\n name TEXT PRIMARY KEY,\n applied_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n );\n\n for (const migration of migrations) {\n const row = await sqlite.execute(\n `SELECT name FROM _migrations WHERE name = ?`,\n [migration.name],\n );\n if (row.rows.length > 0) {\n applied.add(migration.name);\n continue;\n }\n await sqlite.batch(\n migration.sql.map((sql) => ({ sql })),\n );\n await sqlite.execute(\n `INSERT INTO _migrations (name) VALUES (?)`,\n [migration.name],\n );\n applied.add(migration.name);\n }\n}\n\n/** Runs migrations once at import time (idempotent). */\nexport const ready = migrate();\n",[146],"345b0511-440e-4372-8675-5a014e9ef1c1",["D",1788466300593],[33],"pulls","branches","forks","envVars",{"_162":14,"_164":67},"connections",{"_162":67,"_163":67},"count","unfilledCount","emptyCount",{"_47":152,"_37":33,"_35":36,"_139":-5,"_45":46,"_44":14,"_141":63,"_42":175,"_13":67,"_38":39,"_40":41,"_29":30,"_143":-5,"_169":176,"_32":177},{"_47":145,"_37":146,"_35":147,"_139":-5,"_45":46,"_44":148,"_141":30,"_42":172,"_13":67,"_38":39,"_40":150,"_29":30,"_143":-5,"_169":173,"_32":174},{"_47":136,"_37":137,"_35":138,"_139":-5,"_45":46,"_44":140,"_141":63,"_42":168,"_13":67,"_38":39,"_40":106,"_29":30,"_143":-5,"_169":170,"_32":171},["D",1788450878935],"children",[],[137],["D",1788466274587],[],[146],["D",1788466300593],[],[33],["D",1788450878892],["D",1789514495229],{"_104":103,"_111":106},{"_104":103,"_105":106,"_107":106,"_19":59,"_108":109,"_110":30},{"_13":93,"_37":94,"_47":46,"_95":48,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":49,"_102":103},"ctx",{"_86":-5,"_130":216,"_217":218,"_219":220,"_221":30,"_222":30,"_223":30,"_224":63,"_225":-5,"_226":-7,"_227":-7,"_228":67,"_229":30,"_230":30,"_231":-5,"_232":30,"_233":30,"_234":30,"_235":-5},"ENV",{"_187":188,"_189":190,"_191":94,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3