[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_41":42,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_34":-7,"_35":36,"_37":38,"_39":40,"_41":42,"_43":32,"_44":32,"_45":32,"_46":32,"_47":32,"_48":32,"_49":50,"_51":50,"_52":32,"_53":-7,"_54":-7,"_55":56,"_57":58,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5,"_26":27,"_28":29,"_29":30,"_31":32,"_33":14},"ref","main","path","apps/server/src/auth/local.ts","oid","67077cd8f70b9d7376b91a96e4642ac4458b96a0","size",18938,"commit","2182c95de44a8f63fd86af1c5874ae0ca298f807","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","import { createHash, randomBytes, timingSafeEqual } from \"node:crypto\";\n\nimport { GitHubError, GitHubTokenError } from \"../github/client\";\nimport { AdmissionDenied } from \"./admission\";\nimport { DeviceAuthorization } from \"./device\";\nimport { credentialGrant, LocalCredentials } from \"./local-store\";\n\nimport type { Admission } from \"./admission\";\nimport type { AuthConfig } from \"./config\";\nimport type { DeviceCode } from \"./device\";\nimport type { GitHub } from \"../github/client\";\nimport type { GitHubTokenGrant, GitHubUser } from \"../github/client\";\nimport type { LocalCredential } from \"./local-store\";\nimport type { Sessions } from \"./session\";\nimport type { StorageAdapter } from \"../storage/port\";\n\nconst EXPIRED = \"Device code expired before authorization completed\";\nconst CONSENT_MS = 10 * 60_000;\nconst EARLY_MS = 5 * 60_000;\n\ntype Attempt = {\n\tid: string;\n\tsecretHash: string;\n\tcontroller: AbortController;\n\tstatus:\n\t\t| \"waiting\"\n\t\t| \"authorized\"\n\t\t| \"persisting\"\n\t\t| \"consent\"\n\t\t| \"complete\"\n\t\t| \"failed\"\n\t\t| \"expired\"\n\t\t| \"denied\"\n\t\t| \"cancelled\";\n\tcode: DeviceCode;\n\texpiresAt: number;\n\tgrant?: GitHubTokenGrant;\n\tprofile?: GitHubUser;\n\tgrantReceivedAt?: number;\n\tmessage?: string;\n\tpath?: string;\n\tbinding?: { id: string; secret: string };\n\tcompleting?: Promise<{ status: string; path?: string; cookies?: string[] }>;\n};\n\nfunction digest(value: string): string {\n\treturn createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nfunction secret(): string {\n\treturn randomBytes(32).toString(\"base64url\");\n}\n\nfunction cookieValue(request: Request, name: string): string | undefined {\n\tlet pairs = request.headers.get(\"cookie\")?.split(\";\").map(value => value.trim()) ?? [];\n\tlet found = pairs.filter(value => value.startsWith(`${name}=`));\n\treturn found.length === 1 ? found[0]!.slice(name.length + 1) : undefined;\n}\n\nfunction cookie(name: string, value: string, maxAge: number, secure: boolean): string {\n\treturn `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${\n\t\tMath.max(0, Math.floor(maxAge))\n\t}${secure ? \"; Secure\" : \"\"}`;\n}\n\nfunction identity(value: string | undefined): { id: string; secret: string } | undefined {\n\tif (!value) return undefined;\n\tlet match = /^([0-9a-f-]{36})\\.([A-Za-z0-9_-]{43})$/.exec(value);\n\treturn match ? { id: match[1]!, secret: match[2]! } : undefined;\n}\n\nfunction same(left: string, right: string): boolean {\n\tlet a = Buffer.from(left, \"hex\");\n\tlet b = Buffer.from(right, \"hex\");\n\treturn a.length === b.length && timingSafeEqual(a, b);\n}\n\nexport class LocalAuth {\n\treadonly #config: AuthConfig;\n\treadonly #storage: StorageAdapter;\n\treadonly #sessions: Sessions;\n\treadonly #admission: Admission;\n\treadonly #github: GitHub;\n\treadonly #device: DeviceAuthorization;\n\treadonly #credentials: LocalCredentials;\n\treadonly #clock: () => number;\n\treadonly #secure: boolean;\n\treadonly #scheduledDelay?: (ms: number, signal: AbortSignal) => Promise;\n\treadonly #attempts = new Map();\n\treadonly #bindings = new Map<\n\t\tstring,\n\t\t{ sessionId: string; sessionCookie: string; record: LocalCredential }\n\t>();\n\treadonly #sessionBindings = new Map();\n\treadonly #restores = new Map<\n\t\tstring,\n\t\tPromise<{ cookie?: string; authenticated?: boolean; clear?: boolean }>\n\t>();\n\treadonly #revoked = new Set();\n\treadonly attemptCookie: string;\n\treadonly bindingCookie: string;\n\n\tconstructor(input: {\n\t\tconfig: AuthConfig;\n\t\tstorage: StorageAdapter;\n\t\tsessions: Sessions;\n\t\tadmission: Admission;\n\t\tgithub: GitHub;\n\t\tdevice?: DeviceAuthorization;\n\t\tcredentials?: LocalCredentials;\n\t\tclock?: () => number;\n\t\tdelay?: (ms: number, signal: AbortSignal) => Promise;\n\t}) {\n\t\tthis.#config = input.config;\n\t\tthis.#storage = input.storage;\n\t\tthis.#sessions = input.sessions;\n\t\tthis.#admission = input.admission;\n\t\tthis.#github = input.github;\n\t\tthis.#device = input.device ?? new DeviceAuthorization();\n\t\tthis.#credentials = input.credentials\n\t\t\t?? new LocalCredentials(input.config.local!.credentialsDir);\n\t\tthis.#clock = input.clock ?? Date.now;\n\t\tthis.#secure = new URL(input.config.origin).protocol === \"https:\";\n\t\tthis.#scheduledDelay = input.delay;\n\t\tthis.attemptCookie = `chopin_local_attempt_${input.config.local!.port}`;\n\t\tthis.bindingCookie = `chopin_local_binding_${input.config.local!.port}`;\n\t}\n\n\tget clearAttempt(): string {\n\t\treturn cookie(this.attemptCookie, \"\", 0, this.#secure);\n\t}\n\tget clearBinding(): string {\n\t\treturn cookie(this.bindingCookie, \"\", 0, this.#secure);\n\t}\n\n\t#bound(request: Request): Attempt | undefined {\n\t\tlet parsed = identity(cookieValue(request, this.attemptCookie));\n\t\tlet attempt = parsed && this.#attempts.get(parsed.id);\n\t\treturn attempt && same(attempt.secretHash, digest(parsed!.secret)) ? attempt : undefined;\n\t}\n\n\t#binding(request: Request): { id: string; secret: string } | undefined {\n\t\treturn identity(cookieValue(request, this.bindingCookie));\n\t}\n\n\t#scope(bindingId: string) {\n\t\treturn {\n\t\t\tinstallation: this.#config.local!.installation,\n\t\t\torigin: this.#config.origin,\n\t\t\tclientId: this.#config.clientId,\n\t\t\tbindingId,\n\t\t};\n\t}\n\n\t#record(attempt: Attempt, backend: LocalCredential[\"backend\"]): LocalCredential {\n\t\tlet binding = attempt.binding!;\n\t\tlet now = attempt.grantReceivedAt!;\n\t\treturn {\n\t\t\tv: 1,\n\t\t\t...this.#scope(binding.id),\n\t\t\taccountId: attempt.profile!.id,\n\t\t\tlogin: attempt.profile!.login,\n\t\t\tbindingSecretHash: digest(binding.secret),\n\t\t\taccessToken: attempt.grant!.accessToken,\n\t\t\taccessExpiresAt: now + attempt.grant!.accessExpiresIn * 1_000,\n\t\t\trefreshToken: attempt.grant!.refreshToken,\n\t\t\trefreshExpiresAt: now + attempt.grant!.refreshExpiresIn * 1_000,\n\t\t\tbackend,\n\t\t\tgeneration: 1,\n\t\t};\n\t}\n\n\t#safe(attempt: Attempt) {\n\t\treturn {\n\t\t\tstatus: attempt.status,\n\t\t\t...(attempt.status === \"waiting\"\n\t\t\t\t? {\n\t\t\t\t\tuserCode: attempt.code.userCode,\n\t\t\t\t\tverificationUri: attempt.code.verificationUri,\n\t\t\t\t\texpiresAt: new Date(attempt.expiresAt).toISOString(),\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t...(attempt.status === \"consent\" ? { path: attempt.path } : {}),\n\t\t\t...(attempt.status === \"failed\" ? { message: attempt.message } : {}),\n\t\t};\n\t}\n\n\tasync start(request: Request) {\n\t\tfor (let [id, attempt] of this.#attempts) {\n\t\t\tif (this.#clock() >= attempt.expiresAt && attempt.status !== \"persisting\") {\n\t\t\t\tattempt.controller.abort();\n\t\t\t\tattempt.grant = undefined;\n\t\t\t\tthis.#attempts.delete(id);\n\t\t\t}\n\t\t}\n\t\tlet previous = this.#bound(request);\n\t\tif (previous) this.cancel(request);\n\t\tlet controller = new AbortController();\n\t\tlet code = await this.#device.request(\n\t\t\tthis.#config.clientId,\n\t\t\tAbortSignal.any([controller.signal, AbortSignal.timeout(15_000)]),\n\t\t);\n\t\tlet id = crypto.randomUUID();\n\t\tlet key = secret();\n\t\tlet attempt: Attempt = {\n\t\t\tid,\n\t\t\tsecretHash: digest(key),\n\t\t\tcontroller,\n\t\t\tstatus: \"waiting\",\n\t\t\tcode,\n\t\t\texpiresAt: this.#clock() + code.expiresIn * 1_000,\n\t\t};\n\t\tthis.#attempts.set(id, attempt);\n\t\tvoid this.#poll(attempt).catch(() => {});\n\t\treturn {\n\t\t\tbody: this.#safe(attempt),\n\t\t\tcookie: cookie(this.attemptCookie, `${id}.${key}`, code.expiresIn, this.#secure),\n\t\t};\n\t}\n\n\tstatus(request: Request) {\n\t\tlet attempt = this.#bound(request);\n\t\tif (!attempt) return undefined;\n\t\tif (attempt.status === \"waiting\" && this.#clock() >= attempt.expiresAt) {\n\t\t\tattempt.status = \"expired\";\n\t\t\tattempt.controller.abort();\n\t\t}\n\t\tif (attempt.status === \"consent\" && this.#clock() >= attempt.expiresAt) {\n\t\t\tattempt.status = \"cancelled\";\n\t\t\tattempt.grant = undefined;\n\t\t}\n\t\treturn this.#safe(attempt);\n\t}\n\n\tcancel(request: Request): { status: \"cancelled\" } {\n\t\tlet attempt = this.#bound(request);\n\t\tif (attempt && attempt.status !== \"complete\") {\n\t\t\tattempt.controller.abort();\n\t\t\tattempt.status = \"cancelled\";\n\t\t\tattempt.grant = undefined;\n\t\t\tattempt.profile = undefined;\n\t\t\tif (attempt.binding) {\n\t\t\t\tthis.#revoked.add(attempt.binding.id);\n\t\t\t\tvoid this.#credentials.delete(this.#scope(attempt.binding.id)).catch(() => {});\n\t\t\t}\n\t\t}\n\t\treturn { status: \"cancelled\" };\n\t}\n\n\tasync #delay(ms: number, signal: AbortSignal) {\n\t\tawait new Promise(resolve => {\n\t\t\tlet timeout = setTimeout(() => {\n\t\t\t\tsignal.removeEventListener(\"abort\", abort);\n\t\t\t\tresolve();\n\t\t\t}, ms);\n\t\t\tlet abort = () => {\n\t\t\t\tclearTimeout(timeout);\n\t\t\t\tresolve();\n\t\t\t};\n\t\t\tsignal.addEventListener(\"abort\", abort, { once: true });\n\t\t});\n\t}\n\n\tasync #poll(attempt: Attempt) {\n\t\tlet interval = attempt.code.interval * 1_000;\n\t\tlet retry = 0;\n\t\twhile (attempt.status === \"waiting\" && !attempt.controller.signal.aborted) {\n\t\t\tlet remaining = attempt.expiresAt - this.#clock();\n\t\t\tif (remaining <= 0) break;\n\t\t\tawait (this.#scheduledDelay ?? ((ms, signal) => this.#delay(ms, signal)))(\n\t\t\t\tMath.min(remaining, Math.max(interval, retry)),\n\t\t\t\tattempt.controller.signal,\n\t\t\t);\n\t\t\tif (attempt.status !== \"waiting\" || attempt.controller.signal.aborted) return;\n\t\t\tremaining = attempt.expiresAt - this.#clock();\n\t\t\tif (remaining <= 0) break;\n\t\t\tlet answer;\n\t\t\ttry {\n\t\t\t\tanswer = await this.#device.poll(\n\t\t\t\t\tthis.#config.clientId,\n\t\t\t\t\tattempt.code.deviceCode,\n\t\t\t\t\tAbortSignal.any([\n\t\t\t\t\t\tattempt.controller.signal,\n\t\t\t\t\t\tAbortSignal.timeout(Math.min(15_000, remaining)),\n\t\t\t\t\t]),\n\t\t\t\t);\n\t\t\t} catch {\n\t\t\t\tif (attempt.controller.signal.aborted) return;\n\t\t\t\tretry = Math.max(interval, Math.min(Math.max(retry * 2, interval), 60_000));\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (attempt.status !== \"waiting\" || attempt.controller.signal.aborted) return;\n\t\t\tif (answer.status === \"pending\") {\n\t\t\t\tretry = 0;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (answer.status === \"slow_down\") {\n\t\t\t\tinterval = Math.max(interval + 5_000, (answer.interval ?? 0) * 1_000);\n\t\t\t\tretry = 0;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (answer.status === \"transient\") {\n\t\t\t\tretry = Math.max(interval, Math.min(Math.max(retry * 2, interval), 60_000));\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (answer.status === \"granted\") {\n\t\t\t\ttry {\n\t\t\t\t\tlet receivedAt = this.#clock();\n\t\t\t\t\tlet profile = await this.#admission.user(answer.grant.accessToken);\n\t\t\t\t\tif (attempt.status !== \"waiting\" || attempt.controller.signal.aborted) return;\n\t\t\t\t\tif (this.#clock() >= attempt.expiresAt) {\n\t\t\t\t\t\tattempt.status = \"expired\";\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tattempt.profile = profile;\n\t\t\t\t\tattempt.grant = answer.grant;\n\t\t\t\t\tattempt.grantReceivedAt = receivedAt;\n\t\t\t\t\tattempt.status = \"authorized\";\n\t\t\t\t\tattempt.expiresAt = Math.min(attempt.expiresAt, this.#clock() + CONSENT_MS);\n\t\t\t\t} catch (err) {\n\t\t\t\t\tif (attempt.status !== \"waiting\" || attempt.controller.signal.aborted) return;\n\t\t\t\t\tattempt.status = \"failed\";\n\t\t\t\t\tattempt.message = err instanceof AdmissionDenied\n\t\t\t\t\t\t? err.message\n\t\t\t\t\t\t: \"GitHub identity is unavailable\";\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tattempt.status = answer.status === \"denied\"\n\t\t\t\t? \"denied\"\n\t\t\t\t: answer.status === \"expired\"\n\t\t\t\t? \"expired\"\n\t\t\t\t: \"failed\";\n\t\t\tif (answer.status === \"failed\") attempt.message = answer.message;\n\t\t\treturn;\n\t\t}\n\t\tif (attempt.status === \"waiting\" && !attempt.controller.signal.aborted) {\n\t\t\tattempt.status = \"expired\";\n\t\t\tattempt.message = EXPIRED;\n\t\t}\n\t}\n\n\tasync complete(request: Request, accept?: boolean) {\n\t\tlet attempt = this.#bound(request);\n\t\tif (!attempt) return undefined;\n\t\tif (accept === false) return this.cancel(request);\n\t\tif (attempt.completing) return attempt.completing;\n\t\tif (attempt.status !== \"authorized\" && !(accept && attempt.status === \"consent\")) {\n\t\t\treturn this.#safe(attempt);\n\t\t}\n\t\tif (this.#clock() >= attempt.expiresAt) {\n\t\t\tthis.cancel(request);\n\t\t\treturn { status: \"expired\" };\n\t\t}\n\t\tlet original = attempt.status;\n\t\tattempt.status = \"persisting\";\n\t\tlet action = (async () => {\n\t\t\tattempt.binding ??= { id: crypto.randomUUID(), secret: secret() };\n\t\t\tlet record = this.#record(attempt, original === \"consent\" ? \"plaintext\" : \"keychain\");\n\t\t\ttry {\n\t\t\t\tif (original === \"authorized\") {\n\t\t\t\t\tlet saved = await this.#credentials.saveSecure(record);\n\t\t\t\t\tif (attempt.status === \"cancelled\") return { status: \"cancelled\" };\n\t\t\t\t\tif (!saved) {\n\t\t\t\t\t\tattempt.status = \"consent\";\n\t\t\t\t\t\tattempt.path = this.#credentials.path(record);\n\t\t\t\t\t\treturn { status: \"consent\", path: attempt.path };\n\t\t\t\t\t}\n\t\t\t\t} else await this.#credentials.save({ ...record, backend: \"plaintext\" });\n\t\t\t\tif (attempt.status === \"cancelled\" || this.#revoked.has(record.bindingId)) {\n\t\t\t\t\tawait this.#credentials.delete(record);\n\t\t\t\t\treturn { status: \"cancelled\" };\n\t\t\t\t}\n\t\t\t\tif (original === \"consent\") record.backend = \"plaintext\";\n\t\t\t\tawait this.#storage.users.put({ ...attempt.profile!, now: new Date(this.#clock()) });\n\t\t\t\tlet issued = await this.#sessions.issue(\n\t\t\t\t\trecord.accountId,\n\t\t\t\t\tcredentialGrant(record, this.#clock()),\n\t\t\t\t);\n\t\t\t\tthis.#bindings.set(record.bindingId, {\n\t\t\t\t\tsessionId: issued.id,\n\t\t\t\t\tsessionCookie: issued.cookie,\n\t\t\t\t\trecord,\n\t\t\t\t});\n\t\t\t\tthis.#sessionBindings.set(issued.id, record.bindingId);\n\t\t\t\tattempt.status = \"complete\";\n\t\t\t\tattempt.grant = undefined;\n\t\t\t\tlet old = this.#binding(request);\n\t\t\t\tif (old && old.id !== record.bindingId) {\n\t\t\t\t\tthis.#revoked.add(old.id);\n\t\t\t\t\tlet previous = this.#bindings.get(old.id);\n\t\t\t\t\tif (previous) {\n\t\t\t\t\t\tawait this.#sessions.revoke(\n\t\t\t\t\t\t\tnew Request(this.#config.origin, {\n\t\t\t\t\t\t\t\theaders: { cookie: previous.sessionCookie.split(\";\", 1)[0]! },\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t).catch(() => {});\n\t\t\t\t\t}\n\t\t\t\t\tawait this.#credentials.delete(this.#scope(old.id)).catch(() => {});\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tstatus: \"complete\",\n\t\t\t\t\tcookies: [\n\t\t\t\t\t\tissued.cookie,\n\t\t\t\t\t\tcookie(\n\t\t\t\t\t\t\tthis.bindingCookie,\n\t\t\t\t\t\t\t`${record.bindingId}.${attempt.binding.secret}`,\n\t\t\t\t\t\t\t(record.refreshExpiresAt - this.#clock()) / 1_000,\n\t\t\t\t\t\t\tthis.#secure,\n\t\t\t\t\t\t),\n\t\t\t\t\t\tthis.clearAttempt,\n\t\t\t\t\t],\n\t\t\t\t};\n\t\t\t} catch {\n\t\t\t\tattempt.status = \"failed\";\n\t\t\t\tattempt.message = \"Could not save credentials\";\n\t\t\t\tawait this.#credentials.delete(record).catch(() => {});\n\t\t\t\treturn { status: \"failed\", message: attempt.message };\n\t\t\t}\n\t\t})();\n\t\tattempt.completing = action;\n\t\ttry {\n\t\t\treturn await action;\n\t\t} finally {\n\t\t\tattempt.completing = undefined;\n\t\t}\n\t}\n\n\tasync persist(sessionId: string, grant: GitHubTokenGrant, revision: number): Promise {\n\t\tlet bindingId = this.#sessionBindings.get(sessionId);\n\t\tlet binding = bindingId && this.#bindings.get(bindingId);\n\t\tif (!binding || binding.sessionId !== sessionId || this.#revoked.has(bindingId!)) {\n\t\t\tthrow new Error(\"local binding was revoked\");\n\t\t}\n\t\tlet now = this.#clock();\n\t\tlet next: LocalCredential = {\n\t\t\t...binding.record,\n\t\t\taccessToken: grant.accessToken,\n\t\t\taccessExpiresAt: now + grant.accessExpiresIn * 1_000,\n\t\t\trefreshToken: grant.refreshToken,\n\t\t\trefreshExpiresAt: now + grant.refreshExpiresIn * 1_000,\n\t\t\tgeneration: revision,\n\t\t};\n\t\tawait this.#credentials.save(next);\n\t\tif (this.#revoked.has(bindingId!) || this.#bindings.get(bindingId!) !== binding) {\n\t\t\tawait this.#credentials.delete(next);\n\t\t\tthrow new Error(\"local binding was revoked\");\n\t\t}\n\t\tbinding.record = next;\n\t}\n\n\tasync revoked(sessionId: string): Promise {\n\t\tlet id = this.#sessionBindings.get(sessionId);\n\t\tif (!id) return;\n\t\tthis.#sessionBindings.delete(sessionId);\n\t\tlet binding = this.#bindings.get(id);\n\t\tif (binding?.sessionId !== sessionId) return;\n\t\tthis.#bindings.delete(id);\n\t\tthis.#revoked.add(id);\n\t\tawait this.#credentials.delete(this.#scope(id)).catch(() => {});\n\t}\n\n\tasync logout(request: Request): Promise {\n\t\tlet binding = this.#binding(request);\n\t\tif (!binding) return;\n\t\tthis.#revoked.add(binding.id);\n\t\tlet current = this.#bindings.get(binding.id);\n\t\tlet record = current?.record\n\t\t\t?? await this.#credentials.read(this.#scope(binding.id)).catch(() => undefined);\n\t\tif (!record || !same(record.bindingSecretHash, digest(binding.secret))) return;\n\t\tawait this.#credentials.delete(record);\n\t\tthis.#bindings.delete(binding.id);\n\t}\n\n\tasync restore(\n\t\trequest: Request,\n\t): Promise<{ cookie?: string; authenticated?: boolean; clear?: boolean }> {\n\t\tlet binding = this.#binding(request);\n\t\tif (!binding || this.#revoked.has(binding.id)) return { clear: !!binding };\n\t\tlet flight = `${binding.id}:${digest(binding.secret)}`;\n\t\tlet existing = this.#restores.get(flight);\n\t\tif (existing) return existing;\n\t\tlet task = this.#restore(binding);\n\t\tthis.#restores.set(flight, task);\n\t\ttry {\n\t\t\treturn await task;\n\t\t} finally {\n\t\t\tif (this.#restores.get(flight) === task) this.#restores.delete(flight);\n\t\t}\n\t}\n\tasync #restore(binding: { id: string; secret: string }) {\n\t\tlet scope = this.#scope(binding.id);\n\t\tlet record = await this.#credentials.read(scope);\n\t\tif (!record || !same(record.bindingSecretHash, digest(binding.secret))) return { clear: true };\n\t\tif (this.#revoked.has(binding.id)) return { clear: true };\n\t\tlet previous = this.#bindings.get(binding.id);\n\t\tif (previous && !this.#revoked.has(binding.id)) {\n\t\t\t// Concurrent tabs share one browser-bound session cookie instead of refreshing twice.\n\t\t\treturn { cookie: previous.sessionCookie, authenticated: true };\n\t\t}\n\t\tif (record.refreshExpiresAt <= this.#clock()) {\n\t\t\tawait this.#credentials.delete(record);\n\t\t\treturn { clear: true };\n\t\t}\n\t\ttry {\n\t\t\tif (record.accessExpiresAt <= this.#clock() + EARLY_MS) {\n\t\t\t\tlet grant = await this.#github.refresh({\n\t\t\t\t\tclientId: this.#config.clientId,\n\t\t\t\t\trefreshToken: record.refreshToken,\n\t\t\t\t});\n\t\t\t\tif (this.#revoked.has(binding.id)) return { clear: true };\n\t\t\t\tlet now = this.#clock();\n\t\t\t\trecord = {\n\t\t\t\t\t...record,\n\t\t\t\t\taccessToken: grant.accessToken,\n\t\t\t\t\taccessExpiresAt: now + grant.accessExpiresIn * 1_000,\n\t\t\t\t\trefreshToken: grant.refreshToken,\n\t\t\t\t\trefreshExpiresAt: now + grant.refreshExpiresIn * 1_000,\n\t\t\t\t\tgeneration: record.generation + 1,\n\t\t\t\t};\n\t\t\t\ttry {\n\t\t\t\t\tawait this.#credentials.save(record);\n\t\t\t\t} catch {\n\t\t\t\t\tthis.#revoked.add(binding.id);\n\t\t\t\t\tawait this.#credentials.delete(record).catch(() => {});\n\t\t\t\t\treturn { clear: true };\n\t\t\t\t}\n\t\t\t\tif (this.#revoked.has(binding.id)) {\n\t\t\t\t\tawait this.#credentials.delete(record);\n\t\t\t\t\treturn { clear: true };\n\t\t\t\t}\n\t\t\t}\n\t\t\tlet user = await this.#admission.user(record.accessToken);\n\t\t\tif (user.id !== record.accountId || user.login !== record.login) {\n\t\t\t\tawait this.#credentials.delete(record);\n\t\t\t\treturn { clear: true };\n\t\t\t}\n\t\t\tif (this.#revoked.has(binding.id)) return { clear: true };\n\t\t\tawait this.#storage.users.put({ ...user, now: new Date(this.#clock()) });\n\t\t\tlet issued = await this.#sessions.issue(user.id, credentialGrant(record, this.#clock()));\n\t\t\tif (this.#revoked.has(binding.id)) {\n\t\t\t\tawait this.#sessions.revoke(\n\t\t\t\t\tnew Request(this.#config.origin, {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\tcookie: issued.cookie.split(\";\", 1)[0]!,\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn { clear: true };\n\t\t\t}\n\t\t\tthis.#bindings.set(binding.id, {\n\t\t\t\tsessionId: issued.id,\n\t\t\t\tsessionCookie: issued.cookie,\n\t\t\t\trecord,\n\t\t\t});\n\t\t\tthis.#sessionBindings.set(issued.id, binding.id);\n\t\t\treturn { cookie: issued.cookie, authenticated: true };\n\t\t} catch (err) {\n\t\t\tif (\n\t\t\t\terr instanceof GitHubTokenError && err.terminal\n\t\t\t\t|| err instanceof GitHubError && err.status === 401 || err instanceof AdmissionDenied\n\t\t\t) {\n\t\t\t\tawait this.#credentials.delete(record);\n\t\t\t\tthis.#revoked.add(binding.id);\n\t\t\t\treturn { clear: true };\n\t\t\t}\n\t\t\tthrow err;\n\t\t}\n\t}\n}\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_55":56,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_43":32,"_137":14,"_138":32,"_49":50,"_51":50},"branches",[74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,14,127,128,129,130],"tags",[70,71,72,73],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":50,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_53":174,"_175":32,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_53":174,"_175":32,"_176":174,"_177":50},{"_168":169,"_170":171,"_15":169,"_172":173,"_53":174,"_175":32,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_53":174,"_175":32,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_53":174,"_175":32,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_53":174,"_175":32,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_53":32,"_175":32,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_53":32,"_175":32,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_53":32,"_175":32,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_53":32,"_175":32,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_53":32,"_175":32,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_53":32,"_175":32,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_53":32,"_175":32,"_176":32},{"_168":202,"_170":203,"_15":202,"_172":204,"_53":32,"_175":32,"_176":32},{"_168":199,"_170":200,"_15":199,"_172":201,"_53":32,"_175":32,"_176":32},{"_168":196,"_170":197,"_15":196,"_172":198,"_53":32,"_175":32,"_176":32},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794436423428,"sidebar","expanded"]