import { deleteCookie, getCookies, setCookie } from "https://deno.land/std@0.219.0/http/cookie.ts"; import { alias } from "https://esm.town/v/easrng/alias"; import { user } from "https://esm.town/v/easrng/user"; import { html } from "https://esm.town/v/postpostscript/html?v=28"; import { sqlite } from "https://esm.town/v/std/sqlite"; const SESSION_LENGTH = 1000 * 60 * 60 * 24 * 7; const cookie = "__siwvt-token"; const htmlPrefix = html``; const commentVal = "auth/verify" let prefixLen: number; let prefix = () => { prefix = () => { prefixLen = 0; return []; }; const p = [ "CREATE TABLE IF NOT EXISTS siwvt (token STRING PRIMARY KEY, userId STRING, commentToken STRING, expiry INTEGER NOT NULL)", { sql: "DELETE FROM siwvt WHERE expiry < :now", args: { now: Date.now(), }, }, ]; prefixLen = p.length; return p; }; export type User = { id: string; bio: string | null; username: string; profileImageUrl: string }; export type AuthenticatedRequest = Request & { user: User }; export const signInWithValTown = (handler: (req: AuthenticatedRequest) => Response | PromiseLike) => async function(req: Request): Promise { if (req.headers.has("sec-fetch-mode") && (req.headers.get("sec-fetch-mode") !== "navigate")) { return new Response(null, { status: 403, }); } const cookies = getCookies(req.headers); let token: string | undefined = cookies[cookie]; let info: { token: string; userId: string | null; commentToken: string | null; expiry: number; }; const url = new URL(req.url); if (url.pathname === "/signout" && req.method === "POST") { if ( (req.headers.has("origin") && (req.headers.get("origin") !== url.origin)) || (req.headers.has("sec-fetch-mode") && (req.headers.get("sec-fetch-mode") !== "navigate")) ) { return new Response("Invalid crossorigin request"); } await sqlite.batch([ ...prefix(), { sql: "DELETE FROM siwvt WHERE token = :token", args: { token, }, }, ]); const headers = new Headers({ location: "/", }); deleteCookie(headers, cookie); return new Response(null, { status: 302, headers, }); } if (token) { const [result] = (await sqlite.batch([ ...prefix(), { sql: "SELECT * FROM siwvt WHERE token = :token", args: { token, }, }, { sql: "UPDATE siwvt SET expiry = :expiry WHERE token = :token", args: { token, expiry: Date.now() + SESSION_LENGTH, }, }, ])).slice(prefixLen); if (result.rows.length) { info = Object.fromEntries((result.rows[0] as any).map((val, i) => [result.columns[i], val || null])) as any; } } if (!info) { await sqlite.batch([ ...prefix(), { sql: "INSERT INTO siwvt(token, userId, commentToken, expiry) VALUES (:token, :userId, :commentToken, :expiry)", args: info = { token: token = crypto.randomUUID(), userId: null, commentToken: crypto.randomUUID(), expiry: Date.now() + SESSION_LENGTH, }, }, ]); } const headers = new Headers(); setCookie(headers, { name: cookie, value: token, expires: Date.now() + SESSION_LENGTH, secure: true, httpOnly: true, domain: url.hostname, sameSite: "Lax", }); const signedIn = async (user: User) => { const userReq: AuthenticatedRequest = req as any; userReq.user = user; const res = await handler(userReq); for (const [k, v] of (headers as any).entries()) { res.headers.set(k, v); } return res; }; if (info.userId) { return await signedIn( await user({ id: info.userId, }), ); } const res = await fetch( `https://www.val.town/v/${commentVal}?_data=routes%2F_app.v.%24handle.%24name._index`, { headers: { "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0", }, }, ); if (!res.ok) return new Response("Error checking for comments: " + await res.text()); const { comments } = await res.json(); const userComment = comments.find((comment) => comment.body.includes(info.commentToken)); if (userComment) { const userInfo = await alias({ username: userComment.user.handle, }); const updatePromise = sqlite.execute({ sql: "UPDATE siwvt SET userId = :userId, commentToken = NULL WHERE token = :token", args: { userId: userInfo.id, token: info.token, }, }); const res = await signedIn(userInfo); await updatePromise; return res; } headers.set("content-type", "text/html"); return new Response( (html`${htmlPrefix}Sign In with Val Town

Sign In with Val Town

`) .toString(), { headers, status: 403, }, ); };