[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_40":41,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_33":-7,"_34":35,"_36":37,"_38":39,"_40":41,"_42":31,"_43":31,"_44":31,"_45":31,"_46":31,"_47":31,"_48":49,"_50":49,"_51":31,"_52":-7,"_53":-7,"_54":55,"_56":57,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":14,"_22":23,"_24":-5,"_25":26,"_27":28,"_28":29,"_30":31,"_32":14},"ref","2dcf323b30c181e2ed63c4245cd44c0012ef225c","path","apps/server/src/auth/session.ts","oid","bc0010f23cda7495d9b6754d1bee8b3e2518fdab","size",9517,"commit","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","import { createHash, timingSafeEqual } from \"node:crypto\";\n\nimport type { StorageAdapter } from \"../storage/port\";\nimport type { UserRecord, WebSession } from \"../storage/model\";\n\nconst SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1_000;\nconst ATTEMPT_TTL_MS = 10 * 60 * 1_000;\nconst CIPHER_VERSION = 1;\nconst NONCE_BYTES = 12;\nconst SECRET_BYTES = 32;\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\ntype Clock = () => Date;\n\ntype OAuthPlaintext = {\n\tv: 1;\n\ttoken: string;\n};\n\nexport type AuthenticatedSession = {\n\tsession: WebSession;\n\tuser: UserRecord;\n\toauthToken: string;\n};\n\nexport type IssuedSession = {\n\tid: string;\n\tcookie: string;\n\texpiresAt: Date;\n};\n\nexport type OAuthAttempt = {\n\tstate: string;\n\tverifier: string;\n\tchallenge: string;\n\tcookie: string;\n\texpiresAt: Date;\n};\n\ntype StoredAttempt = {\n\tv: 1;\n\tstate: string;\n\tverifier: string;\n\texpiresAt: string;\n};\n\nfunction random(bytes: number): Uint8Array {\n\tlet value = new Uint8Array(bytes);\n\tcrypto.getRandomValues(value);\n\treturn value;\n}\n\nfunction base64(value: Uint8Array): string {\n\treturn Buffer.from(value).toString(\"base64url\");\n}\n\nfunction decoded(value: string): Uint8Array | undefined {\n\tif (!value || !/^[A-Za-z0-9_-]+$/.test(value)) return undefined;\n\ttry {\n\t\tlet bytes = new Uint8Array(Buffer.from(value, \"base64url\"));\n\t\treturn bytes.length > 0 && base64(bytes) === value ? bytes : undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction hash(value: Uint8Array): Uint8Array {\n\treturn new Uint8Array(createHash(\"sha256\").update(value).digest());\n}\n\nfunction buffer(value: Uint8Array): ArrayBuffer {\n\treturn value.slice().buffer as ArrayBuffer;\n}\n\nfunction equal(left: Uint8Array, right: Uint8Array): boolean {\n\treturn left.length === right.length && timingSafeEqual(left, right);\n}\n\nfunction values(request: Request, name: string): string[] {\n\tlet header = request.headers.get(\"cookie\");\n\tif (!header) return [];\n\tlet found: string[] = [];\n\tfor (let part of header.split(\";\")) {\n\t\tlet separator = part.indexOf(\"=\");\n\t\tif (separator < 0 || part.slice(0, separator).trim() !== name) continue;\n\t\tfound.push(part.slice(separator + 1).trim());\n\t}\n\treturn found;\n}\n\nfunction serialized(\n\tname: string,\n\tvalue: string,\n\texpiresAt: Date,\n\tsecure: boolean,\n\tpath = \"/\",\n\tmaxAge = Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1_000)),\n): string {\n\tlet attributes = [\n\t\t`${name}=${value}`,\n\t\t`Path=${path}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t`Max-Age=${maxAge}`,\n\t\t`Expires=${expiresAt.toUTCString()}`,\n\t];\n\tif (secure) attributes.push(\"Secure\");\n\treturn attributes.join(\"; \");\n}\n\nfunction cleared(name: string, secure: boolean, path = \"/\"): string {\n\treturn serialized(name, \"\", new Date(0), secure, path, 0);\n}\n\nasync function imported(value: Uint8Array): Promise {\n\treturn crypto.subtle.importKey(\"raw\", buffer(value), \"AES-GCM\", false, [\"encrypt\", \"decrypt\"]);\n}\n\nasync function encrypted(key: CryptoKey, aad: string, plaintext: unknown): Promise {\n\tlet nonce = random(NONCE_BYTES);\n\tlet content = encoder.encode(JSON.stringify(plaintext));\n\tlet ciphertext = await crypto.subtle.encrypt(\n\t\t{ name: \"AES-GCM\", iv: buffer(nonce), additionalData: buffer(encoder.encode(aad)) },\n\t\tkey,\n\t\tbuffer(content),\n\t);\n\tlet envelope = new Uint8Array(1 + NONCE_BYTES + ciphertext.byteLength);\n\tenvelope[0] = CIPHER_VERSION;\n\tenvelope.set(nonce, 1);\n\tenvelope.set(new Uint8Array(ciphertext), 1 + NONCE_BYTES);\n\treturn envelope;\n}\n\nasync function decrypted(key: CryptoKey, aad: string, envelope: Uint8Array): Promise {\n\tif (envelope.length <= 1 + NONCE_BYTES || envelope[0] !== CIPHER_VERSION) {\n\t\tthrow new Error(\"bad envelope\");\n\t}\n\tlet nonce = envelope.slice(1, 1 + NONCE_BYTES);\n\tlet ciphertext = envelope.slice(1 + NONCE_BYTES);\n\tlet plaintext = await crypto.subtle.decrypt(\n\t\t{ name: \"AES-GCM\", iv: buffer(nonce), additionalData: buffer(encoder.encode(aad)) },\n\t\tkey,\n\t\tbuffer(ciphertext),\n\t);\n\treturn JSON.parse(decoder.decode(plaintext));\n}\n\nfunction oauth(value: unknown): OAuthPlaintext | undefined {\n\tif (!value || typeof value !== \"object\") return undefined;\n\tlet record = value as Record;\n\tif (record.v !== 1 || typeof record.token !== \"string\" || !record.token) return undefined;\n\treturn { v: 1, token: record.token };\n}\n\nfunction attempt(value: unknown): StoredAttempt | undefined {\n\tif (!value || typeof value !== \"object\") return undefined;\n\tlet record = value as Record;\n\tif (\n\t\trecord.v !== 1\n\t\t|| typeof record.state !== \"string\"\n\t\t|| typeof record.verifier !== \"string\"\n\t\t|| typeof record.expiresAt !== \"string\"\n\t) return undefined;\n\treturn { v: 1, state: record.state, verifier: record.verifier, expiresAt: record.expiresAt };\n}\n\n/** Durable login sessions: only a secret hash and OAuth ciphertext reach storage. */\nexport class Sessions {\n\treadonly #storage: StorageAdapter;\n\treadonly #key: Promise;\n\treadonly #secure: boolean;\n\treadonly #clock: Clock;\n\treadonly cookieName: string;\n\n\tconstructor(\n\t\tstorage: StorageAdapter,\n\t\tkey: Uint8Array,\n\t\tsecure: boolean,\n\t\tclock: Clock = () => new Date(),\n\t) {\n\t\tthis.#storage = storage;\n\t\tthis.#key = imported(key);\n\t\tthis.#secure = secure;\n\t\tthis.#clock = clock;\n\t\tthis.cookieName = secure ? \"__Host-chopin_session\" : \"chopin_session\";\n\t}\n\n\tasync issue(userId: string, oauthToken: string): Promise {\n\t\tlet id = crypto.randomUUID();\n\t\tlet secret = random(SECRET_BYTES);\n\t\tlet createdAt = this.#clock();\n\t\tlet expiresAt = new Date(createdAt.getTime() + SESSION_TTL_MS);\n\t\tlet token = await encrypted(\n\t\t\tawait this.#key,\n\t\t\t`chopin:web-session:v1:${id}:${userId}`,\n\t\t\t{ v: 1, token: oauthToken } satisfies OAuthPlaintext,\n\t\t);\n\t\tawait this.#storage.sessions.create({\n\t\t\tid,\n\t\t\tuserId,\n\t\t\tsecretHash: hash(secret),\n\t\t\toauthToken: token,\n\t\t\texpiresAt,\n\t\t\tcreatedAt,\n\t\t});\n\t\treturn {\n\t\t\tid,\n\t\t\tcookie: serialized(\n\t\t\t\tthis.cookieName,\n\t\t\t\t`${id}.${base64(secret)}`,\n\t\t\t\texpiresAt,\n\t\t\t\tthis.#secure,\n\t\t\t\t\"/\",\n\t\t\t\tSESSION_TTL_MS / 1_000,\n\t\t\t),\n\t\t\texpiresAt,\n\t\t};\n\t}\n\n\tasync authenticate(request: Request): Promise {\n\t\tlet parsed = this.#parse(request);\n\t\tif (!parsed) return undefined;\n\t\tlet stored = await this.#storage.sessions.get(parsed.id, this.#clock());\n\t\tif (!stored || !equal(hash(parsed.secret), stored.secretHash)) return undefined;\n\t\tlet user = await this.#storage.users.get(stored.userId);\n\t\tif (!user) return undefined;\n\t\ttry {\n\t\t\tlet plaintext = oauth(\n\t\t\t\tawait decrypted(\n\t\t\t\t\tawait this.#key,\n\t\t\t\t\t`chopin:web-session:v1:${stored.id}:${stored.userId}`,\n\t\t\t\t\tstored.oauthToken,\n\t\t\t\t),\n\t\t\t);\n\t\t\tif (!plaintext) return undefined;\n\t\t\treturn { session: stored, user, oauthToken: plaintext.token };\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tasync revoke(request: Request): Promise {\n\t\tlet parsed = this.#parse(request);\n\t\tif (!parsed) return;\n\t\tlet stored = await this.#storage.sessions.get(parsed.id, this.#clock());\n\t\tif (stored && equal(hash(parsed.secret), stored.secretHash)) {\n\t\t\tawait this.#storage.sessions.delete(stored.id);\n\t\t}\n\t}\n\n\tclearCookie(): string {\n\t\treturn cleared(this.cookieName, this.#secure);\n\t}\n\n\t#parse(request: Request): { id: string; secret: Uint8Array } | undefined {\n\t\tlet cookies = values(request, this.cookieName);\n\t\tif (cookies.length !== 1) return undefined;\n\t\tlet separator = cookies[0]!.indexOf(\".\");\n\t\tif (separator < 1) return undefined;\n\t\tlet id = cookies[0]!.slice(0, separator);\n\t\tlet secret = decoded(cookies[0]!.slice(separator + 1));\n\t\tif (\n\t\t\t!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)\n\t\t\t|| !secret\n\t\t\t|| secret.length !== SECRET_BYTES\n\t\t) return undefined;\n\t\treturn { id, secret };\n\t}\n}\n\n/** Short-lived encrypted OAuth state and PKCE verifier carried only by the browser. */\nexport class OAuthAttempts {\n\treadonly #key: Promise;\n\treadonly #secure: boolean;\n\treadonly #clock: Clock;\n\treadonly cookieName: string;\n\n\tconstructor(key: Uint8Array, secure: boolean, clock: Clock = () => new Date()) {\n\t\tthis.#key = imported(key);\n\t\tthis.#secure = secure;\n\t\tthis.#clock = clock;\n\t\tthis.cookieName = secure ? \"__Host-chopin_oauth_state\" : \"chopin_oauth_state\";\n\t}\n\n\tasync issue(): Promise {\n\t\tlet state = base64(random(SECRET_BYTES));\n\t\tlet verifier = base64(random(SECRET_BYTES));\n\t\tlet digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", encoder.encode(verifier)));\n\t\tlet expiresAt = new Date(this.#clock().getTime() + ATTEMPT_TTL_MS);\n\t\tlet envelope = await encrypted(\n\t\t\tawait this.#key,\n\t\t\t\"chopin:oauth-state:v1\",\n\t\t\t{\n\t\t\t\tv: 1,\n\t\t\t\tstate,\n\t\t\t\tverifier,\n\t\t\t\texpiresAt: expiresAt.toISOString(),\n\t\t\t} satisfies StoredAttempt,\n\t\t);\n\t\treturn {\n\t\t\tstate,\n\t\t\tverifier,\n\t\t\tchallenge: base64(digest),\n\t\t\tcookie: serialized(\n\t\t\t\tthis.cookieName,\n\t\t\t\tbase64(envelope),\n\t\t\t\texpiresAt,\n\t\t\t\tthis.#secure,\n\t\t\t\t\"/\",\n\t\t\t\tATTEMPT_TTL_MS / 1_000,\n\t\t\t),\n\t\t\texpiresAt,\n\t\t};\n\t}\n\n\tasync read(request: Request): Promise {\n\t\tlet cookies = values(request, this.cookieName);\n\t\tif (cookies.length !== 1) return undefined;\n\t\tlet envelope = decoded(cookies[0]!);\n\t\tif (!envelope) return undefined;\n\t\ttry {\n\t\t\tlet stored = attempt(await decrypted(await this.#key, \"chopin:oauth-state:v1\", envelope));\n\t\t\tif (!stored) return undefined;\n\t\t\tlet expiresAt = new Date(stored.expiresAt);\n\t\t\tif (Number.isNaN(expiresAt.getTime()) || expiresAt <= this.#clock()) return undefined;\n\t\t\treturn stored;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tclearCookie(): string {\n\t\treturn cleared(this.cookieName, this.#secure);\n\t}\n}\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_54":55,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_42":31,"_137":126,"_138":31,"_48":49,"_50":49},"branches",[73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"tags",[69,70,71,72],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","main","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":49,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_52":174,"_175":31,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_52":174,"_175":31,"_176":174,"_177":49},{"_168":169,"_170":171,"_15":169,"_172":173,"_52":174,"_175":31,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_52":174,"_175":31,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_52":174,"_175":31,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_52":174,"_175":31,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_52":31,"_175":31,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_52":31,"_175":31,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_52":31,"_175":31,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_52":31,"_175":31,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_52":31,"_175":31,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_52":31,"_175":31,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_52":31,"_175":31,"_176":31},{"_168":202,"_170":203,"_15":202,"_172":204,"_52":31,"_175":31,"_176":31},{"_168":199,"_170":200,"_15":199,"_172":201,"_52":31,"_175":31,"_176":31},{"_168":196,"_170":197,"_15":196,"_172":198,"_52":31,"_175":31,"_176":31},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794469087606,"sidebar","expanded"]