[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_155":156,"_157":158},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_104":85,"_27":53,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":121,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",4,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":37,"_35":36,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","fd0579f8-5b00-11f1-8330-ee650bb23af1","name","fileType","script","content","import { createHmac, randomBytes } from \"node:crypto\";\n\n// ── Stripe webhook signature verification ────────────────────────────────────\n// Stripe uses HMAC-SHA256 over `${timestamp}.${rawBody}` with the webhook secret.\nfunction verifyStripeSignature(\n rawBody: string,\n header: string,\n secret: string,\n): boolean {\n try {\n const parts = Object.fromEntries(\n header.split(\",\").map((p) => p.split(\"=\")),\n );\n const ts = parts[\"t\"];\n const sig = parts[\"v1\"];\n if (!ts || !sig) return false;\n const payload = `${ts}.${rawBody}`;\n const expected = createHmac(\"sha256\", secret).update(payload).digest(\"hex\");\n // Constant-time compare\n if (sig.length !== expected.length) return false;\n let diff = 0;\n for (let i = 0; i < sig.length; i++) {\n diff |= sig.charCodeAt(i) ^ expected.charCodeAt(i);\n }\n return diff === 0;\n } catch {\n return false;\n }\n}\n\n// ── Key minting (mirrors generate-key.js) ────────────────────────────────────\nfunction mintKey(email: string, secret: string): string {\n const nonce = randomBytes(4).toString(\"hex\");\n const encodedEmail = Buffer.from(email).toString(\"base64url\");\n const message = `HLM:${encodedEmail}:${nonce}`;\n const hmac = createHmac(\"sha256\", secret).update(message).digest(\"hex\");\n return `HLM-${encodedEmail}-${nonce}-${hmac}`;\n}\n\n// ── Email delivery via Resend ─────────────────────────────────────────────────\nasync function sendLicenseEmail(\n to: string,\n key: string,\n resendKey: string,\n fromEmail: string,\n) {\n const body = {\n from: fromEmail,\n to: [to],\n subject: \"Your Helm license key\",\n html: `\n

Here is your Helm Pro license key:

${key}

Open Helm and click I have a key to activate.

This key works on up to 2 Macs. Keep it somewhere safe.

\n`,\n };\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${resendKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(body),\n });\n if (!res.ok) {\n throw new Error(`Resend error ${res.status}: ${await res.text()}`);\n }\n}\n\n// ── Handler ───────────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const webhookSecret = Deno.env.get(\"STRIPE_WEBHOOK_SECRET\") ?? \"\";\n const licenseSecret = Deno.env.get(\"HELM_LICENSE_SECRET\") ?? \"\";\n const resendKey = Deno.env.get(\"RESEND_API_KEY\") ?? \"\";\n const fromEmail = Deno.env.get(\"HELM_FROM_EMAIL\") ?? \"\";\n\n const rawBody = await req.text();\n const sigHeader = req.headers.get(\"stripe-signature\") ?? \"\";\n\n // Dev bypass: if webhook secret is still placeholder, skip sig check and return dry-run\n if (webhookSecret === \"whsec_PLACEHOLDER\" || webhookSecret === \"\") {\n console.log(\"helmCheckout: dry-run mode, no webhook secret configured\");\n return Response.json({ ok: true, status: \"dry_run_bypass\" });\n }\n\n if (!verifyStripeSignature(rawBody, sigHeader, webhookSecret)) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n\n let payload: any;\n try {\n payload = JSON.parse(rawBody);\n } catch {\n return new Response(\"Bad Request\", { status: 400 });\n }\n\n if (payload.type !== \"checkout.session.completed\") {\n // Acknowledge other event types without processing\n return Response.json({ received: true });\n }\n\n const email = payload.data?.object?.customer_details?.email as\n | string\n | undefined;\n if (!email) {\n return Response.json({ ok: false, reason: \"no_email\" }, { status: 400 });\n }\n\n if (!licenseSecret) {\n return Response.json({ ok: false, reason: \"server_misconfigured\" }, {\n status: 500,\n });\n }\n\n const key = mintKey(email, licenseSecret);\n\n if (resendKey && resendKey !== \"re_PLACEHOLDER\" && fromEmail) {\n try {\n await sendLicenseEmail(email, key, resendKey, fromEmail);\n } catch (err) {\n console.error(\"Email delivery failed:\", err);\n // Don't fail the webhook — Stripe will retry. Log and return 200.\n return Response.json({ ok: true, key, warning: \"email_failed\" });\n }\n } else {\n console.log(\n `helmCheckout: email not configured, minted key for ${email}: ${key}`,\n );\n }\n\n return Response.json({ ok: true });\n}","http","createdAt",["D",1780202501362],"branchVersion","branchId","fd0288e2-5b00-11f1-8330-ee650bb23af1","id","fd01b4ee-5b00-11f1-8330-ee650bb23af1","helmCheckout",["D",1780019522806],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","6672ef94-066d-4947-9570-5b0ce7f352d5","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e306a-94bf-733b-a503-3575488085e4","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_103":99},"org",{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned",8,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","zyrxun","handle","displayName","Richard Xun","avatar","https://lh3.googleusercontent.com/a/ACg8ocLWG-UJ5cFmJNKhsROFvQZEkojxEI1DiAh7HQRUHjFCOK5FRw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":151,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":152,"_79":153,"_81":154,"_83":25},"tree",[146],"files",[146],"counts",{"_134":61,"_135":136,"_137":61,"_138":139,"_140":141},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":37,"_35":36,"_24":25,"_132":-5,"_27":133},"04bc9a36-5cab-11f1-b290-1607ee4eb77e","parentId","latest",["D",1780202501362],3,"label",[28],"pulls","branches",1,"forks","envVars",{"_142":144,"_145":61},"connections",{"_142":61,"_143":61},"count","unfilledCount",5,"emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":147,"_13":131,"_33":37,"_35":36,"_24":25,"_132":-5,"_148":149,"_27":150},["D",1780202501362],"children",[],[28],["D",1780019522806],{"_95":94,"_103":99},{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_77":-5,"_123":188,"_189":190,"_191":192,"_193":25,"_194":25,"_195":25,"_196":121,"_197":-5,"_198":-7,"_199":-7,"_200":61,"_201":25,"_202":25,"_203":-5,"_204":25,"_205":25,"_206":25,"_207":-5},"ENV",{"_159":160,"_161":162,"_163":85,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v4